Comment Re:I agree with TFA (Zug) (Score 1) 628
But that's not what the image is. Have you actually bothered to look at the image?
But that's not what the image is. Have you actually bothered to look at the image?
I've been using Gentoo on all my personal machines for the last decade or so.
Works fine as long as you pay attention.
--dost
Hopefully this means I won't have to drive as far to get my Arc refills.
Gentoo cotinues to work fine for me. If there's a systemd transition coming, I haven't seen any indications of it.
The weak decline in the last decade does not make up for the total increase over the last 2 decades.
I've updated your URL to show the trend for the last 20 years. It shows a very different picture than the link you posted.
So now that someone has identified ugliness in the Bash code, is an effort being made to clean things up?
Anyone that dares to challenge the status quo is attacked and ostracized. If they have arguments that are really good, they are ignored and black listed from media. Society has gone through many phases just like this one previously, as a true Philosophy I study everything including History.
Can you give any examples of the bolded statement?
So get a booster.
I was under the impression that OpenBSD did not enable heartbeats by default and, as such, was not vulnerable to Heartbleed by default.
Am I wrong?
Scaring the prey away from the hunters is interferring with the hunt.
How do they know the code they've been given is the actual code used to generate the shipped binaries?
Can those Enterprise partners compile the code they've been given in order to compare the binaries with the binaries that MS ships?
I pay my taxes because I benefit from things like roads and schools and fire departments and such.
Do you get zero benefit from the things your taxes pay for?
Some Linux distributors, instead of providing a new kernel that may break old applications or devices, instead backport security fixes to an old kernel.
Why does Linus allow kernel updates that break applications and drivers?
Because he has decided that those updates improve the kernel somehow. That's his job: to improve the kernel.
If some applications get broken when the kernel is improved, it's the application developer's job to fix them.
This is as it should be. Any other model ties the hands of the kernel developers and then they can't do their job.
We have to assume everything up to this point is compromised and start pretty much from scratch. Replace AES with TwoFish, re-design all the lower level protocols, increase all key lengths, remove any ability to downgrade security and mercilessly cut off clients that don't upgrade when an issue is found.
I don't think any of that is strictly necessary. Verify the math and inspect the implementations, but there's no need to throw it all away. Some amount of paranoia is justified, but throwing it all away goes too far.
The whole trusted certificate system has to be replaced as well, which is going to be hard.
I agree there are serious issues with the current system, but I am at a loss to come up with what would replace it.
Because the designers of the Linux random number generator code designed things such that if RdRand is compromised, it doesn't reduce the strength of the random number generated. However, if it is not compromised, then the randomness is stronger.
Why should we give up a potential benefit if there is no possible harm?
Arithmetic is being able to count up to twenty without taking off your shoes. -- Mickey Mouse
