cesarb

41 ms·

661.
by cesarb 3y ago
> I was wondering why one would pull in libsystemd as a dependency for this. I mean, there's a pure-Python library [...] With proper error handling, that's about 50 lines of C code. There's also a pure C library (libsystem
662.
by cesarb 3y ago
> Maybe another backdoor, or alternative access mechanism they were using, got closed and they wanted another one in a hurry. Or maybe the opportunity window for the mechanism this backdoor would use was closing. According to the timelin
663.
by cesarb 3y ago
> off topic, but how many actual non-extradition countries are there these days (for the US)? Several countries do not extradite their own citizens. For citizens of these countries, going back to their own home country would be enough.
664.
by cesarb 3y ago
> And how did we get to the point that a complex system is required to build a compression library -- something that doesn't really have to do much more than math and memory allocation? The project in question contained a compress
665.
by cesarb 3y ago
> and then convincing the distros to pick up their fork instead of the older original. Given the current situation, I'm slightly worried about Fedora's planned move to zlib-ng instead of zlib in the next release ( https:/&
666.
by cesarb 3y ago
A lot of people were in that exact same situation. So many, that the original author of log4j 1.x released a fork to allow these people to keep using the old code while technically being "up to date" and free of known vulnerabil
667.
by cesarb 3y ago
> Never understood why our industry seems unique in our willingness to do unpaid work for giant corps. Your compression library isn't saving the world, it's making it easier for amazon to save a few bucks. The work was not bein
668.
by cesarb 3y ago
> traveling from, say, Asia to North America isn’t cheap and there could be visa issues. And there are other reasons some people might not want to travel outside their nearby region. For instance, they might be taking care of an elderly
669.
by cesarb 3y ago
> As for why systemd links against xz, I don't know, and it's a bit surprising that an init system needs compression utils It's for the journal. It can be optionally compressed with zlib, lzma, or zstd. That library had no
670.
by cesarb 3y ago
> Far too many people, including developers, seem to just accept upgrades as always-good instead of carefully considering the risks and benefits. Another example of this was log4j: if you were still using the old 1.x log4j versions, you
671.
by cesarb 3y ago
A popular project with release-only distribution is Lua. I don't know whether they have proper source control, but even if they do, AFAIK it isn't publicly available.
672.
by cesarb 3y ago
This is called NOBUS: https://en.wikipedia.org/wiki/NOBUS
673.
by cesarb 3y ago
> but assuming we're speaking about their implementations in the industry (rather elaborate tracing GCs; rather crude refcounting GCs) That might be because a tracing GC needs to be rather elaborate to get good performance and avo
674.
by cesarb 3y ago
> The math of the lzma algorithm doesn't change. The library was "done" and that's ok. Playing devil's advocate: the math doesn't change, but the environment around it does. Just off the top of my head, we h
675.
by cesarb 3y ago
> How is a try-with-resources not guaranteed? At least in Java, it is guaranteed to run There's a subtle detail you have to be careful with, however: if you try to allocate memory or call a method between allocating your resource an
676.
by cesarb 3y ago
> Having these types in the standard library is the language having those types. It depends on whether you consider the standard library an indivisible part of the language or not. For Rust, it's clearly not the case, since you have
677.
by cesarb 3y ago
> Most languages with a garbage collector have finalizers, which will clean that sort of thing up. Using finalizers for cleanup of non-memory resources is bad because they will only be called when there's memory pressure. If you hav
678.
by cesarb 3y ago
> ...while I agree, for many C++ and Rust coders statements like this are pure heresy ;) It's a matter of definitions. For many people, "garbage collection" refers only to tracing GC, and reference counting is a separate c
679.
by cesarb 3y ago
> and certainly languages with a reference-counting GC, like Rust It's a mistake to say that the Rust language has reference counting. There's a pair of reference-counting wrapper types in its standard library (Rc and Arc), o
680.
by cesarb 3y ago
> National ID How are you going to verify a national ID? By taking a photo of it? What if the photo is edited? By somehow going to the maintainer in person and looking for anti-counterfeiting features in the paper? What if the ID is ol
681.
by cesarb 3y ago
That's ridiculous. Adding the dependency to libsystemd in no way created any vulnerability. Even the indirect dependency on liblzma didn't add any vulnerability. It took a separate malicious maintainer doing a later change to libl
682.
by cesarb 3y ago
The connection is that sshd calls code in libsystemd when running as a systemd service, to notify systemd that it finished starting. An unrelated functionality in libsystemd (my guess is that it's related to parsing journald logs, sinc
683.
by cesarb 3y ago
That happened because the code changes from ext2 to ext3, and later from ext3 to ext4, were very invasive, and filesystems is one place where stability and reliability is very important. So instead of risking introducing data-loss bugs, the
684.
by cesarb 3y ago
> but a perfectly plausible scenario would be the NSA putting the backdoor in with an ostensibly Chinese login and then activating on machines hosted and controlled by people outside of the US. There's a term for that: NOBUS ( https
685.
by cesarb 3y ago
> Why are they part of the release if they are supposedly test fixtures rather than part of the application code? Test fixtures should be distributed together with the application code, so that the actually built application can be teste
686.
by cesarb 3y ago
> I think we should seriously consider something like a ts clearance as mandatory for work on core technologies. Was xz/lzma a core technology when it was created? Is my tiny "constant time equality" Rust crate a core tech
687.
by cesarb 3y ago
> I suppose that you could execute systemd-notify but that's a solution that I would not like. What I did was to use JNA to call sd_notify() in libsystemd.so.0 (when that library exists), which works but obviously does not avoid usi
688.
by cesarb 3y ago
It should be trivial in any language which has AF_UNIX . Last time I looked, Java didn't have it, so the only way was to call into non-Java code.
689.
by cesarb 3y ago
> Why do we distribute tarballs at all? A git hash should be all thats needed... A git hash means nothing without the repository it came from, so you'd need to distribute both. A tarball is a self-contained artifact. If I store a ta
690.
by cesarb 3y ago
The test code generated by older autoconf is not going to be work correctly with newer GCC releases due to the deprecation of implicit int and implicit function declarations (see https://fedoraproject.org/wiki/Changes&#

More ›