acoppora

Seems like you're making a bit of a jump there. :-)

> there was general agreement with a small amount of opposition including the cherry-picked message, and the change was made.

Help me understand here. The reply by Julian is a huge overreaction. The text you quote seems to be condemning him (a user, not the developer) for fighting a seemingly worthwhile change on the principle of it being the way it was for a long time.

So doesn't that kind of prove the point that you're saying isn't true?

Why is tcp wrappers still there? The overlying theme of the SSH section is about going against upstream in the name of backwards compatibility, which it sounds like FreeBSD still does (albeit to a smaller degree).

I meant by default. The title of this paper I'm commenting on should make it clear, but sorry if it wasn't.

I see a lot of negative and dismissive comments from you in this thread. Perhaps you'd care to quantify some of the things you say are wrong. I'd also recommend against ad hominem attacks against someone who wrote an article you disagree with.

The "hardening" menu in the installer is pretty pathetic if we're being honest. "enable /tmp cleaning"... wow. I'm secure now.

Can you confirm that Dragonfly has all of the CPU vulnerability mitigations that Linux has, including Retbleed, Spectre V1, and Spectre-BHB? FreeBSD does not have those three.

It would also be good to read about Dragonfly's exploit mitigations. Are these documented somewhere?

To clarify, FreeBSD 14.0 is not out and probably won't be out for quite some time. All users of the current release are still without even basic ASLR.

Unfortunately Intel sold us all a very dangerous technology that we got used to. Hyperthreading has been disabled in more security-conscious OSes like OpenBSD and HardenedBSD. Greg KH praised OpenBSD for making this decision, even if he couldn't for Linux.