Tobu

More interesting to me will be when one of the ACME CAs will implement RFC 8657, ACME-specific CAA parameters.

Currently privilege separation on a server or a TLS terminator doesn't do much for ACME privileges because an exploit anywhere on the request path can use an arbitrary account to obtain new certs.

Binding to a single ACME account in DNS (accounturi=…) would significantly reduce the attack surface, as would requiring non-http validation methods.

That was the explanation given for rigging medical school scores so 70% of doctors could be male:

- https://www.theguardian.com/world/2018/aug/08/tokyo-medical-...

- https://www.theguardian.com/world/2018/dec/12/two-more-japan...

- https://apjjf.org/2019/07/Schieder.html

glibc uses versioned symbols, symbols are visible in the blog post's `objdump -T` output if you scroll to the right.

Then you can use `objdump -d` to disassemble and see the callers. The fact that the binary is build from Rust isn't relevant at this point.

patchelf is passed a special string, '$ORIGIN', which references the same directory as the binary, and won't require modifications for the target system.

One disadvantage not mentioned in the blog post is that this facilitates something similar to the infamous DLL preloading attacks on Windows.

Interesting that Linus comes from a family of journalists!

(The same is true of Jon Corbet, who runs LWN)

It did seem to become useful as the job shifted again and again from coding to reviewing to maintaining and setting maintenance standards through communication.

Well, the university of Minnesota managed to escape responsibility after multiple suicides and coercion of subjects of psychiatric research. From one regent: “[this] has not risen to the level of our concern”.

https://www.startribune.com/markingson-case-university-of-mi...

As far as I can tell, the papers he co-authored on Wikipedia were unlike the abuse of the kernel contribution process that started last year in that they did not involve active experiment, but passive analysis of contribution history.

Doesn't mean there aren't ethical issues related to editors being human subjects, but you may want to be more specific.

That's still 10 thousand words you're linking to…

I had a look at section §46.104 https://www.hhs.gov/ohrp/regulations-and-policy/regulations/... since it mentioned exemptions, and at (d) (3) inside that. It still doesn't apply: there's no agreement to participate, it's not benign, it's not anonymous.

I've been doing this by implementing ResolvesServerCert, which has access to the ClientHello. It covers the acme alpn use case.

Though you can't use it to pick other properties, like making an ALPN protocol conditional on SNI.

There's a categorization here (I don't have access to the triage spreadsheet though):

https://github.com/ctz/rustls/issues/447#issuecomment-820719...

It seems like there's been the most effort on category 4, the ones that can't be reached but can often be proven away with refactoring and typestate. Removing these ensures that the APIs don't expose Result types to callers unnecessarily.

Category 1-3 have different severity, but they are all planned to be folded into Result error values.

There are two options at the moment [1]:

  - panic=abort (uncatchable)
  - panic=unwind.

With the latter, you would need a catch_unwind at the FFI boundary.

[1] https://doc.rust-lang.org/cargo/reference/profiles.html#pani...

mrustc for bootstrapping, rust_codegen_gcc (which doesn't seem like it would make stage1 much harder to compile) once the rest of the compiler has been brought up, isn't that the more realistic plan?

What a time suck.

Dereferencing null is UB; there is no guarantee that it will compile to something that segfaults or that it won't be exploitable. This is unlike None.unwrap(), which is a guaranteed panic.

Exploitable null dereference, for anyone who needs a reminder: https://lwn.net/Articles/342330/

git-absorb is another implementation:

- https://github.com/tummychow/git-absorb

- https://lib.rs/crates/git-absorb

In fact, Go is not even memory safe despite the GC. It has data races, which are exploitable.

  - https://blog.stalkr.net/2015/04/golang-data-races-to-break-memory-safety.html
  - https://golang.org/doc/articles/race_detector#Introduction

Buggy AAA releases are currently the norm, but that takes a reputational and financial toll and doesn't make for happy developers either. Cyberpunk 2077 is the latest example.

--depth=1 (shallow clone, and implies --single-branch)

I don't know what this is doing here.

ring is also hard to misuse, and more actively maintained by far.

Yes of course.

I've been into contact improvisation, some partner dances, and acro, and the scenes are structured by social circles that are much broader that most romantic relationships.

You become part of a scene by showing up regularly, practising, and occasionally making friends.

If some of these activities have sensual components (communication through touch, syncing together, sharing an understanding of the music…), there's no need to link that to romantic connections.

Inference works in all Romance languages, as well — it's a Latin word and this use is extremely close to its use in logic (going back to Aristotle).

Anyway, I'd consider simple english a tool for introducing new concepts.

Learning programming still means that the concepts must be introduced, and having a new word to bind the new concept seems good to me.

A char is a scalar value, rather: https://doc.rust-lang.org/std/primitive.char.html

Sweet and to the point, thanks!

Also of note, aside from finding the crate root and dependent crates (these are passed explicitly to the compiler, from Cargo most of the time), all of this is strictly part of the Rust language, and handled by the compiler. I find the language model really clear and explicit. I would not touch it, aside from discouraging the use of mod.rs.

I think there's room for an article that expands into Cargo's convention-based source model, which is a bit trickier. A package directory can contain multiple crates: at most one library crate rooted in `src/lib.rs`, but also the various executables that are discovered from the filesystem: src/bin/*.rs, src/main.rs, examples, the test binary, bench binaries… These are crates of their own, with examples and benches needing a library crate to be enabled to access files in the src/ folder (without ugly hacks).

Here's more about how this came about:

https://github.com/pippinbarr/itisasifyouweredoingwork/tree/...

HTTPS is a really huge scope to tackle, and requires a lot of policy which OpenSSL traditionally hasn't encoded (how to root trust, for example — possibly involving system stores or custom ones, stapling, pinning…). Also, OpenSSL generally is embedded in HTTP clients, and having distinct implementations of HTTP calling into each other from the same library seems terrible, with potential for security issues related to policy or implementation mismatches.

Of course, there's all the traditional bug surface of any code that talks to the network to consider as well.

Defining an interface for calling back into another HTTP library might be doable, but there's still a question of scope creep.

The motivation seems to be this fork and pull request:

- https://github.com/mpeylo/cmpossl

- https://github.com/openssl/openssl/issues/5926

The use case is far away from what most users of OpenSSL need, and could quite easily be tackled outside OpenSSL.

Rust has the concept of "interior unsafe".

The idea is that you build an abstraction and wrap away the unsafety. That abstraction has to be built defensively, which is enabled by the type system enforcing very powerful invariants across the program. You can safely encode the way your structures may or may not be used across threads, enforce exclusive vs shared access, control mutability.

Unsafe is not a "do whatever" card, you use it with the rest of the language as one more tool that helps build safe programs.

Indeed.

For anyone still believing a NULL dereference (or any of the other UB that is in the C spec) is just a segfault, "What Every C Programmer Should Know About Undefined Behavior" is still required reading:

http://blog.llvm.org/2011/05/what-every-c-programmer-should-...

Here's how triggering UB ends up as a vulnerability:

https://lwn.net/Articles/342330/

As far as I understand, that Branco guy has had a lot of short-sighted attempts at getting into high-profile roles, with no consistent thread beyond that. Plus some pointless and spiteful attempts at getting into the limelight for all the wrong reasons, as with the above backstabbing.

Our politicians generally turn once in their lives, often rightwards, but this guy is thirty and has already bounced between so many attempts at becoming "important" ASAP, within unrelated and ideologically incompatible currents, abandoning them or being forced out almost immediately. Clearly, he has a lot more ego than resolve, probably needs psychological help, and I hope he won't be another psychopath getting into meaningful power.

Here's the bug [1]; apparently someone made it so on purpose [2].

In related issues, I'd like switch to tab to be consistent so that ctrl-clicking on an awesomebar result always opens it in a new tab, instead of depending on whether it found a tab or not.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1479858

[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1287866

That's the shortcut I use for bookmarking, get off my lawn.

If this documentation is accurate, Darling doesn't support raw syscalls either:

https://wiki.darlinghq.org/documentation:system_call_emulati...

Their Linux kernel module does seem to be XNU based, but it feels like poor design / a rushed job to run it as a Linux kernel module instead of isolating it in userspace.