If they hadn't used their own allocator, then this bug would have been exposed on OpenBSD ages ago since it would lead to OpenSSL crashing over and over again. At first you migth think that this only helps OpenBSD users, but no: this would have led to research on the matter (the crashed), and the issue being found quite soon after it was introduced.
So it would not have been benefitial only to OpenBSD, but to everyone.
Looking at the diffs in tech@, is seems they're dropping DOS, WIN16 and WIN32. I've no idea if there was any WIN64 specific code, but yes, it seem's windows in general is being stripped.
Dropping support for these platforms means getting rid of a lot of files/code/ifs/etc. Less code is easier to review. Better reviewed code has more chances of bugs being caught in time.
You say you're a new Linux user, and it looks like you're carrying over you windows-way-of-thinking.
Most Linux distros don't have services running with lots of security holes. You don't generally need this.
Most malware out there is actually stuff like "click here for free money.exe". Even if you come across Ubuntu-targeted stuff, it does look like you're the kind of person who wouldn't click that.
Several people here have pointed out possible solutions, but think for a moment if you really need them.
Did you read the entire email? Several of the issues he's mentioning here are not mere "errors". Skiping exploit mitigations for the sake of performance (on some platforms!) on a security library/program isn't an error, it's awfully irresponsable!
Assuming it uses a version of openssl that supports the relevant TLS feature[...]
That's a pretty generic response and applies to absolutely every piece of software in existance.
It's a good think OpenSSH doesn't use any version of OpenSSL though.
It doesn't really matter which OS they pick, they still need to pay somebody for support (in the sense of fixing installs, etc. Updates will be provided from upstream).
XFCE may look superficially like XP but actually has all sorts of differences that make it irritating as hell to use. Just off the top of my head:
- No decent file explorer.
Why? What's wrong with thunar?
Thunar is abysmal compared to XP's.
- Window borders too small, like 1px. Resizing windows is a pain.
I haven't used XFCE is ages, but I belive lots of WMs out there use super+m2 to resize. Windows borders are useless, and having to aim at tiny stuff to resize windows is stupid.
- Window maximize behaviour is annoying, because you can still drag the window out of fullscreen after it's been maximized, yet dragging it to the top of the screen doesn't automatically fullscreen the window again.
Rather than "annoying", I'd say it's just "different from windows". Also, I belive this is configurable.
- The 2 clipboards, one of which is a "mouse buffer", is so unintuative I would classify it as a bug. Linux desperately needs a unified clipboard.
Use something like parcellite if you want to unify them. Getting rid of both clipboards to make life easier for people who don't know how to use a computer is a bad idea (see GNOME3).
Of course, instead of going bankrupt after spending all my money in 6TB hard drives, I could just enjoy myself for now, and got bankrupt later on when one of by four 3TB disks fail.
[url=http://lubuntu.net/]lubuntu[/url] is pretty lightweight, and looks pretty similar to windows as far as I can tell. Plus, it's all Ubuntu under the hood (for better or for worse). You know you'll have updates for a looong time coming.
Somebody notify mobile phone manufacturers, cause some (eg: Samsung's) just keep getting bigger!
freedns (freedns.afraid.org) offer free DNS hosting, including dynamic DNS. So just buy a domain, and use that. Still cheaper than $25/y.
Even if nobody cares about your data/nobody exploits it, the hole is still there.
you're under some kind of deadline pressure and you can't connect to them, don't turn off SSL validation.
OR: Always turn off SSL validation, because it's totally worthless.
The problem is CAs get suberted all the time into issuing certs they shouldn't issue.
You're asuming that they're using a third-party CA, and using the same pool of CAs browsers use to validate.
In truth, when developing applications, you don't need that. If I were to make an application and server right now, I'd use my own CA certificate. I'd then bundle it with my application, and sign the server certificate with it. TLS validation will mean TRUE security in this case.
"Engineering without management is art." -- Jeff Johnson
