glass-

> "They should be contributing their changes back to OpenSSL versus forking".

I suppose that this attitude comes from people who think the fork happened solely because of Heartbleed, when the real reasons are a little more intricate[0] but the straw that broke the camels back was the discovery that OpenSSL had known about certain bugs and let patches to fix them rot in their bug tracker for years. It's hard to contribute changes back when a project won't take patches.

OpenSSL could have taken LibreSSL's changes if they wanted to, it's all public in the OpenBSD source tree, but they haven't.

[0] http://www.tedunangst.com/flak/post/origins-of-libressl

This blog post about Wasabi is worth a read (another perspective from someone who worked there): http://www.tedunangst.com/flak/post/technical-debt-and-tacki...

With those categorisations a maybe-probably-theoretical-phase-of-the-mooon vulnerability such as CVE-2010-1633 gets put into the same category ("remote information leak") as Heartbleed. This is why severity levels exist.

> Rust

So instead of using C we should write our security-critical software in a language that was released 3 months ago and has no major deployments.

> Unless all you use is enterprisey crap or play AAA titles from bad companies

Is Photoshop a AAA title or enterprisey crap? How about all other common software that many, normal people use daily that doesn't run under Wine?

And instead people are going to use what?

ABP is not a one-man show, it's now developed by a company (Eyeo GmbH) that makes a lot of money getting companies like Google to buy into their "acceptable ads" scheme.

ABP also considers ads that track people (such as Google's) to be acceptable and whitelists them by default.

I run multiple exits and consider much of what is written about the risks of running exit nodes to be overblown scaremongering, so it is nice to see an article about the actual reality of running exits: it's boring.

There are legitimate fears for people living in certain countries but many of the people handwringing about it aren't in those countries.

Google and Snopes exist and yet people still forward hoax emails to their friends and post/share hoaxes on Facebook.

This policy was created in 2009 in response to the controversy when NoScript started messing around with ABP and broke functionality so that ads would display on the NoScript developer's website.

https://adblockplus.org/blog/attention-noscript-users

https://blog.mozilla.org/addons/2009/05/01/no-surprises/

No it doesn't. This is some bizarre myth that keeps being perpetuated.[0]

[0] https://github.com/gorhill/uBlock/wiki/Does-uBlock-block-ads...

Google Analytics had a self-hosted version, or more specifically Google Analytics was a self-hosted solution when it was Urchin before Google acquired it.

You could still get the self-hosted version for a price until Google killed it in 2012.

The reason Google doesn't want you to do this is simple: they want the data.

You don't find it offensive. I and millions of other people do. You deal with it.

It's not only about the VPN leak. WebRTC also leaks internal IP addresses which provide additional entropy that can be used for fingerprinting.

> They talk about FreeBSD in the original article and the guy tests that on other OS and say it's not a serious vuln?

Mr Hansteen is saying it is not a serious OpenSSH vuln, like the tech media is claiming it is.

> This is a serious vuln for FreeBSD. Period.

That's why the original disclosure and subsequent news articles clearly stated it was a FreeBSD and/or PAM vulnerability, and didn't run with headlines such as "OpenSSH keyboard-interactive authentication brute force vulnerability"[0] or "Bug in widely used OpenSSH opens servers to password cracking"[1].

[0] https://kingcope.wordpress.com/2015/07/16/openssh-keyboard-i...

[1] http://arstechnica.com/security/2015/07/bug-in-widely-used-o...

The messenger reported the problem privately 9 months ago[0] and it was only fixed as they were preparing to go to the press. The day before the "stunt hacking" Jeep were claiming it was not a problem[1].

[0] https://twitter.com/0xcharlie/status/623492229714313216

[1] https://twitter.com/daviottenheimer/status/62351634451271270...

Because Theo is right, having to write programs to observe programs is insane.

While spender is wrong for multiple reasons. Such as that /var is mounted nosuid on OpenBSD by default so their hypothetical "httpd chmod'ing to setuid" doesn't work ("nix" points this out to them but isn't aware of OpenBSD's defaults in this area). The other reason is they are decrying the whole system because of a fairly weak attack scenario (requires a local user account) and it's not like that attack isn't possible now, so while tame() doesn't protect against that specific thing it protects against others but spender is just saying nope, it doesn't protect against this specific scenario therefore it's useless.

Also if you keep reading spender's commenters they go on to claim OpenBSD's devs are delusional plagiarists so "vendetta" does seem appropriate.

Are they person who runs the @grsecurity twitter account that seems terminally bitter about everything OpenBSD does?

People thinking and saying that this only works for small teams should take a look at how many devs are listed in OpenBSD's latest release announcement.

Hint: it's more than 2, more than 3, and more than 50.

Developer changes code and create a diff. This diff is sent to the mailing list or other developers to test and review. The patch only gets committed when other developers have ok'd it.

You can also view the source on the cvs web mirror: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/

It reminds me of Douglas Crockford's talk where he mentioned that a company asked him for an exemption to the "do no evil" clause in the JSON License, and he said he didn't want to name the company as that would embarrass them so he would instead give their initials: IBM.

+1 for Fastmail. I really enjoy spam filtering based on personal bayes rather than a global database.

I see spam from gmail all the time, and for about the last year they wouldn't accept reports from SpamCop (that changed a couple of weeks ago).

So what you're saying is, in the United States "treason" is defined so that a helicopter gunner who murders journalists and unarmed civilians is a hero while the person who exposes this war crime is a traitor.

Check vim's style guide (:help style-example in vim), you'll find a note that says:

> NOTE: Don't use ANSI style function declarations. A few people still have to use a compiler that doesn't support it.

That analogy doesn't account for what happens when a submission gets posted to both a "pinot" subreddit and a "sewage" subreddit, and subscribers in the sewage subreddit see the post in the pinot subreddit from the other discussions tab and "invade" the other subreddit.

Subreddits and their communities are not neatly contained in clearly labelled bottles.

LibreSSL is a drop-in replacement for OpenSSL.

> nothing proved to be more reliable to this moment.

Huh? Of the 22 vulnerabilities OpenSSL has disclosed since March (4 high severity, 14 moderate, 4 low), LibreSSL has been vulnerable to 8 (0 high, 6 moderate, 2 low).

References:

March: https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2

June: https://marc.info/?l=openbsd-announce&m=143406498020131&w=2

Today: https://marc.info/?l=openbsd-tech&m=143645910727507&w=2

> Getting a list from EasyList is just as much a leak as getting a list from Google. Someone has your IP either way.

The problem with SafeBrowsing isn't downloading the list, it's that it sends data back to Google if it finds a match. Malware lists with AdBlock plugins don't do this.