aragilar

18 ms·

241.
by aragilar 1y ago
I mean, it would depend on what the patch is? If you're adding a missing manpage, I'm not sure what can go wrong? Is changing the build options (e.g. enabling or disabling features) a patch, or an expected change (and if such a co
242.
by aragilar 1y ago
https://research.swtch.com/openssl provides more context: openssl was asked about the change, and seemingly approved it (whether everyone understood what was being approved is a different question). It's not clear why
243.
by aragilar 1y ago
Yeah, it's not bad when the backend will accept headers (e.g. remote_user), it's when it wants the actual certificate to check against a CA when it becomes an issue.
244.
by aragilar 1y ago
The other challenge is proxies. When the backend that cares about client cert is behind a proxy you need to dig into the less-familiar parts of the proxy and try to work out either how to pass the certificate on or extract the information f
245.
by aragilar 1y ago
Are you paying either the Linux Foundation or your distro for that work, the work that a) few people value, given few (relatively) pay for it b) few people want to do (otherwise why would this be an issue) ? Otherwise their roles are what t
246.
by aragilar 1y ago
The article was talking about the Linux kernel. The kernel doesn't care about the software is runs with, so why should they run a CA (and if the Linux Foundation did run a CA, no one would care, see what happened to LSB)? The distro is
247.
by aragilar 1y ago
I don't see what the system here mentioned here (a list of centrally tracked keys in git) doesn't do that a PKI system does. I'm also not sure why a distro would be interested in signing keys for third parties, why isn't
248.
by aragilar 2y ago
For user-facing stuff, I agree it's hard because of the challenge of managing access to data (and I would argue no system does this well, Android has a different set of failure modes, and I've not used QubesOS but presumably it ha
249.
by aragilar 2y ago
Or go old-school with multiple users and chroots? You could even install from (and host) a trusted repository, where the source and binaries are vetted (and you can pay people to do this for you).
250.
by aragilar 2y ago
One could ask why AOSP was created when there was an existing userland on linux that could be used (and was, by Nokia). More seriously, I think the reason people want to do this is threefold: 1. Android vendors almost universally seem to ma
251.
by aragilar 2y ago
I know right, when will Android vendors actually release security patches on time?
252.
by aragilar 2y ago
FPTP has a well documented effect of producing a 2 party system (along with numerous other issues): https://en.wikipedia.org/wiki/First-past-the-post_voting#Two... RCV works and is simple to understand.
253.
Mandatory short duration TLS certificates are probably coming soon(utcc.utoronto.ca)
18 points by aragilar 2y ago|23 comments
254.
by aragilar 2y ago
I'm not sure show Fedora is derived from Debian... If I recall correctly, the backdoor was set up to only activate on rpm and deb based systems, so it wouldn't have been trigged on Arch, Gentoo or NixOS, even if they linked system
255.
by aragilar 2y ago
The issue in this case is upstream is dead, so there are random patches. Same thing happened to screen for a bit.
256.
by aragilar 2y ago
unzip 6.0 is from 2009 (see the manpage or https://infozip.sourceforge.net/UnZip.html ). I suspect there are patches floating around (so YMMV as to which patches are applied), or someone has aliases/symlinked some other
257.
by aragilar 2y ago
But why do you care that the set is empty (in the abstract, obviously if there was a reason you'd expect the set to be non-empty, that's a different thing)? The trick is to think about invariants and state, which if you frame it t
258.
by aragilar 2y ago
I would have thought it would show how big the dependency tree was.
259.
by aragilar 2y ago
Also, it would be good to know how well it handles older codes of the f77/g77 era (as gfortran is not always well behaved on those).
260.
by aragilar 2y ago
Which cloud services? I don't see how automated updates nor sync count as "cloud services" (and I'll note that the sync server used to be open source, so you could pull from the community like Mozilla claims to be part
261.
by aragilar 2y ago
It's good they know they need to be cautious about it (a year seems a bit optimistic though), but "haven’t had many issues" kinda sounds concerning if it means I cannot boot (or given sudo-rs lacks sudoedit currently, locking
262.
by aragilar 2y ago
I'm not sure how sync for firefox isn't part of focusing on firefox?
263.
by aragilar 2y ago
There doesn't appear to be a link to the release notes, it would be nice to know what are the current limitations.
264.
by aragilar 2y ago
It's unclear if voice/video are supported or not?
265.
by aragilar 2y ago
> Not at all. Much or almost all the Foundation does benefits Firefox. (I think putting Thunderbird in the same sentence is an exaggeration of its importance.) Can you be specific about how the Foundation benefits Firefox (because it can
266.
by aragilar 2y ago
The paid subscriptions would be great if you could get them, I keep checking if they're available here, still not :-( Does EFF do anything in the standards process? They're not an implementer, and they don't employ devs which
267.
by aragilar 2y ago
Your editor should be able to handle this (via git mergetool).
268.
by aragilar 2y ago
Here's some back of the envelope maths: * Anything that goes to the Mozilla Foundation is not spent on Firefox or Thunderbird (by definition). * Mozilla Corporation (which spends money to maintain Firefox, and used to spend money on Th
269.
by aragilar 2y ago
You can't have "privacy-preserving advertising". Either you track users to ensure ads get displayed (because the places you'd serve the ads wouldn't serve them if they could/claim more ad views than happened),
270.
by aragilar 2y ago
The Iceweasel in Debian was Firefox without branding, IceCat (which was called Iceweasel before Debian created Iceweasel) is a GNU fork (and there are Thunderbird and Skymonkey equivalents).

More ›