teacup50

82 ms·

751.
by teacup50 13y ago
> Fine you get Apache->SSLLib->PKCS#11. Now you need to write a PKCS#11 compliant library to talk to your HSM, and a custom serialization protocol for that communication anyway. HSM modules already have PKCS#11 drivers, because i
752.
by teacup50 13y ago
OpenSSL isn't last week's security problem: The code didn't magically get better in a week, and all signs indicate that there are likely more serious issues in the library. Looking past OpenSSL, C didn't magically become
753.
by teacup50 13y ago
> It's apparently not supported by Apache/nginx nor does a suitable software-HSM exist to use it, so you're basically writing both ends of the communication. Apache/nginx don't have to support pkcs11, they just
754.
by teacup50 13y ago
The value, in theory, is that PKCS#11 already exists, is already supported by software and hardware vendors, and is already comprehensive enough and has seen sufficient review to cover the gamut of use cases that such a solution would need
755.
by teacup50 13y ago
Intel SGX would allow implementing this efficiently in-process: https://software.intel.com/en-us/blogs/2013/09/26/protecting...
756.
by teacup50 13y ago
> You just described why the OPW has no reason to invest money in helping you out. You don't fit the criteria. Yes, that's the problem with discrimination.
757.
by teacup50 13y ago
> I'd entirely support them running an outreach program aimed at welcoming women into the GNOME community, though teacup50 might disagree. I'd argue that they should modify the program to target all underrepresented individua
758.
by teacup50 13y ago
> Whoa, whoa. That's a rather strong accusation; you are accusing them of willfully harming the foundation against its charter? If I understand what happened here correctly, yes. The OPW program was questionable within the chart
759.
by teacup50 13y ago
The Gnome Foundation exists for a very specific reason, documented by their charter. It was not remotely within the purview of the Gnome Foundation's charter to administer the OPW program for external organizations , and it's is
760.
by teacup50 13y ago
> Second, Typesafe is a tiny company, and the most prolific committer to the Scala compiler just quit - not just Typesafe, but Scala altogether. Doesn't seem rock solid to me. Paul Phillips did NOT quit Scala altogether: https:
761.
by teacup50 13y ago
> One of the Gnome Foundations primary missions is "Fund Receipt and Disbursement": "The foundation will be in charge of disbursing these funds to the benefit of GNOME and, to the extent possible, in accordance with the w
762.
by teacup50 13y ago
Some more background: https://wiki.gnome.org/FoundationBoard/CurrentBudgetFAQ https://gnome.org/opw/ Reading this, I don't understand: * Why was "The Outreach Program for Women" all
763.
by teacup50 13y ago
Seeing as only people who use the GPL would be affected in this hypothetical, no.
764.
by teacup50 13y ago
mprotect() simply returns EPERM. The kernel enforces W^X; once a page has gone writable, it can never be executable, and vis versa.
765.
by teacup50 13y ago
It used to. They changed it, fortunately.
766.
by teacup50 13y ago
Scala already works as-is. I'm sure clojure does as well.
767.
by teacup50 13y ago
Who cares? The GPL's compatibility clauses are a pain for everyone, and in return the GPL provides nothing to anyone not already using it. Maybe we should intentionally poison-pill our open source licenses to be GPLv3-incompatible; aft
768.
by teacup50 13y ago
PolarSSL forked from BSD-licensed XySSL (no longer maintained) in 2008. It would make some sense to backtrack to the last BSD-licensed PolarSSL release and work from there. There are some projects attempting to do so: https://git
769.
by teacup50 13y ago
The other side of the license is commercial.
770.
by teacup50 13y ago
Yes. Hosting your own code is hardly difficult. It's also not just the provider you have to worry about, but the entire internet that has access to that provider.
771.
by teacup50 13y ago
Bingo Card Creator. Let's just keep the scale in mind here.
772.
by teacup50 13y ago
> The moment it was made public information, there was absolutely no reason whatsoever to hold back on marketing it. There's a lot of different kinds of public. "Possibly in the wild" is very different than "avail
773.
by teacup50 13y ago
> Both his PSAs and his material on marketing and business are a real service to everyone. That's why they've been so popular on HN for years. HN loves startup porn, but how is this any different than how self-help books are
774.
by teacup50 13y ago
This isn't about inconvenience, it's about having patches in user's hands the moment the vulnerability hits the public. > I also think it is a radically borked threat model which suggests that attackers only find out abou
775.
by teacup50 13y ago
> Why should package maintainers be hearing about this any sooner than me? Because they vend updates to the vast majority of users. It's about maximizing people's ability to get the fix quickly upon public disclosure. > .
776.
by teacup50 13y ago
No, it's a good way to get half-broken fixes rushed out the door while users are left blowing in the wind due to premature grandstanding public release.
777.
by teacup50 13y ago
You're demonstrating no understanding of how these things work. For updates to be deployed, the patches need to be integrated, tested, packages/updates build, and the update mechanisms tested. For complex systems -- like, say, emb
778.
by teacup50 13y ago
> That's an enormous win. Compared to what? Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. A problem we used to have, however, is people engaging in grandst
779.
by teacup50 13y ago
My apologies, I accidentally downvoted this. I strongly agree -- this should have NOT been publicly marketed in this way until vendors had some to assembly updates, and possibly not even then. Serious security vulnerabilities do their o
780.
by teacup50 13y ago
> The announcement isn't for technical folks. It's not for non-technical folks, either, because there's nothing they can possibly do other than be confused. It's empty self-promoting marketing that sent the entire i

More ›