Yes, openssl is a piece of junk that is far too widely used. Polarssl looks nice and especially interesting is the version that was mathematically proven to be immune to a whole bunch of CWEs: http://trust-in-soft.com/polar...

But for OpenBSD they can't use polarssl since it's gnu licensed. The sad thing is polarssl was originally called xyssl and xyssl was originally BSD licensed. If only OpenBSD would start with the final xyssl codebase and replace OpenSSL with that...

while not official, there's a semi-live conversion of the cvs tree to git. This has what you need: http://anoncvs.estpak.ee/cgi-b...

See BinpatchNG from m:tier. They've solved what you're asking for.

Theo, you left South Africa at the age of 9. Do you have any connection to the country? Have you been back? Do you think of yourself as a South African or a Canadian? Do you speak any Afrikaans? Places like Cape Town are beautiful and hike-worthy. I believe you enjoy hiking so was wondering if you've ever been back there for hiking.

Also, it is interesting that there are so many South Africans in tech. Elon Musk (Tesla), Mark Shuttleworth (Ubuntu), etc. Do you feel any connections to them due to a common heritage?

I tried to do the math on this too. First of all, I'm not sure if the number is 20,000 USD or CAD (Since OpenBSD is based in Canada not the US). Next up is the fact that many of the machines are older non x86 machines that are not power efficient. For example when the SGI/AlphaStations/VAX/SparcStations were produced, focus was on MHz not power utilization. Finally, I think the project might use some type of uninterruptible power supply (UPS) as well as network switches, etc.

So by your math you're looking at CAD 20,000 = EUR 13,500 which at EUR 0.20 per kWh would buy you 67500 kWh = 7.7 kWh.

Now the project has supports about 20 architectures. And there are dedicated machines used to build the base system and dedicated machines used to build ports so at least 2 of each machine. On top of that there's probably an NFS server to host the source code, some UPS, network switches, etc, etc. So say about 50 machines total.

So 7.7kWh / 50 machines gets you to 154 watts per machine. I do believe they are on 24x7 as there are daily builds for many architectures, etc, etc. 150 watts is not unreasonable power consumption in my opinion.

That's not quite right. Netflix utilizes FreeBSD heavily. See: https://signup.netflix.com/openconnect/software

Take a closer look at the google trends data. If you click on the "qt" tab you actually see that most of the searches are related to "qt syndrome" or "long qt". these are medical conditions and have nothing to do with UI toolkits. if you click on the "gtk" or "gnome" tab, the search terms are all related to UI toolkits.

Perhaps it's not something specific to gtk/gnome, but maybe all the toolkits including qt are in decline. Either due to smartphones/mobile or ubunut's unity or something else.

So they're basically "reinventing" how BSD does things? They even blatantly copied an OpenBSD image for this presentation...

(Compare slide 13 from the presentation with OpenBSD 4.9 art)

In all seriousness though, it's a pretty good plan. Everyone knows that BSD means real engineering while Linux is "just a hobby, won't be big and professional"

Even if you have the source, it doesn't mean you can confirm what the binary is doing. See the classic "Trusting Trust" attack which is decades old. In my experience the most common reason for binaries that are not reproducible is due to build timestamps being embedded into the binary. For example, the ar command added the D flag in the past few years exactly for the purpose of being able to output reproducible results. (see the man page at http://linux.die.net/man/1/ar) It's true that reproducible binaries are probably a good thing from a security stand point, but in practice it can be a lot of work to make sure the build produces these. And even then, as Thompson showed, that doesn't always guarantee that what you see is what you get.

+1

answer all calls with a robo-answerer... no one uses phones anymore, all communication now happens on facebook/twitter.

This show is great, your complaints are silly.

So next you'll complain about having an American version of iron chef? Go back to watching reruns of Takeshi's Castle...