farawayea

Will FreeBSD start making releases like 10.1.1? Ubuntu and Debian always provide updates to fix bugs, including kernel bugs.

FreeBSD's approach to releases is stupid. Releases like 10.1.1, 10.1.2, 9.3.1 and 8.4.1 should be done.

Only big vendors have the resources to maintain their own patched systems they can use in production.

Please read again, I never said anything about any fedora.

Networks are easy to attack if you have control over the ISP. Mail can be easily replaced by one single person monitoring someone's mail.

A company where employees get their mail at work and only access the net from work could do both easily.

I don't have resources for something like this, but doing this isn't as difficult as it might seem. A big enough adversary with enough resources could compromise everything used in security sensitive environments.

I wanted to know if anything changed in how OpenBSD can be installed securely. It is easier to obtain other operating systems securely. They are less secure, but the authenticity of the iso files can be verified via signatures.

This uncertainty has stopped me from using OpenBSD in the past. I have the same questions now.

This is a question about obtaining an iso file to install OpenBSD knowing it's what the developers sent out, just like checking a sha256 signature for other operating systems when downloading. It's not a question about using it in a government agency.

Thanks for the replies. You probably have more useful things to do than discuss this.

This mailing of cds seems silly. An attacker could compromise the cds to be different and serve you another signature on the site.

This is easy for me to do. It must be the same for others.

What is the secure install process? Are there signatures for packages and for the iso file?

The system wants to be secure, but it's not teaching me how to install it securely.

Buying the CDs is risky. How can I know they're not backdoored?

Is installing openbsd securely possible using hash checks and signing?

or not, they're terrible.

It's been one developer for a very long time and the guy has been very unprofessional with the way he was handling support and bug fixes for Sublime Text 2.

That's correct, but bugs don't go away either.

The thing Atom has going for it is not being developed as someone's hobby project and being an open source project.

Sublime Text is still being developed by one guy. Sublime Text will cease to exist if that dude stops developing it.

They are using RAID 5 and probably cheap ssd storage. I'm not surprised. This is what they give you for your money.

Looks dead. Customer support is the worst. One year or more has passed since sending an email to customer support, but I haven't received any reply since.

Seeing some new builds of ST popping up less than infrequently doesn't qualify ST as being developed or maintained. That's like some open source projects which get a few small commits every few months or years.

They haven't responded to emails sent more than one year ago.

I don't think it will survive after Atom becomes popular and stable.

He had a lot of customers at some point. That's when he should have brought in more people to do things right. He chose to do it all on his own, get himself burnt out and completely stop communicating.

I don't see a future for this project if it doesn't get open sourced. The main problem is there's absolutely no support once he releases a stable ST version. You never have anything stable they support.

Sublime Text's support is horrible and so is the developer's policy regarding updates.

They're not going to get any more money from me.

When are we getting 32beta?

I respect the work you're doing on LibreSSL and OpenBSD. The release of this portable LibreSSL arrived much sooner than anyone expected and that's commendable. I think pretty much everyone expected it to be released in OpenBSD first and later as a portable version.

However, I really like to download code related to cryptography securely. Perhaps you didn't have the resources or the time to do this.

There were a few easy to do things: posting the hashes of the downloads in various places like GitHub, mailing lists, this HN thread and a few others. GitHub is useful for serving source releases, as long as you post the hashes in more places.

OpenSSL has been heavily criticized. That has been debated ad nauseam in countless places. The one thing I like about OpenSSL is that they're providing secure downloads. Their code might be bad, but at least you can download it from them via HTTPS.

Many would like to contribute, but the OpenBSD project isn't the friendliest (that's a mild way to put it).