cpach

It could fail though. But I have not yet heard of anyone noticing big problems due to disabling the problematic modules. And I have not noticed any such issues on our systems at ${DAYJOB}.

IMHO, since these parts of the Linux kernel are so crappy I personally would say disabling them is a good default choice. YMMV. But if you encounter problems, then you can always re-enable the modules. (Preferably after upgrading your kernel, obviously.)

I could be wrong, but I’m not sure those settings are enough to mitigate Copy Fail.

If your distro offers a patched kernel, it’s best to upgrade to that one and reboot.

You can also disable the vulnerable module (how to do it depends on what distro you’re using). But if you stay on an old unpatched kernel you might be exposed to other vulnerabilites.

I don’t oppose reasonable crypto in the kernel, like WireGuard.

Yes. Same here. The owner has never replied to my emails. I have also had contact with vendors who received the same treatment.

To be honest I’m disappointed. I have seen multiple persons linking to that site, but if it’s not updated and the owner doesn’t answer e-mail then it’s not really a reasonable reference, IMO.

Why is that?

I agree that 2>&1 is not complex. But I think I speak for many Bash users when I say that this idiom looks bad, is hard to Google, hard to read and hard to memorize.

[0] https://signal.org/blog/the-ecosystem-is-moving/

The .git folder will likely contain the URL to the repo, but not any credentials.

(Mom-and-pop-stores probably won’t. Other orgs might.)

https://www.igalia.com/

https://datatracker.ietf.org/doc/rfc9773/

In another comment someone linked to a document from the Chrome team.

Here’s a quote that I found interesting:

“In Chrome Root Program Policy 1.5, we landed changes that set a maximum ‘term-limit’ (i.e., period of inclusion) for root CA certificates included in the Chrome Root Store to 15 years.

While we still prefer a more agile approach, and may again explore this in the future, we encourage CA Owners to explore how they can adopt more frequent root rotation.”

https://googlechrome.github.io/chromerootprogram/moving-forw...

I would say that the WebPKI system seems to be quite resilient, even in the face of strong geopolitical tension.