yegortimoshenko

It gets much worse than that on this blog: https://archive.is/RtoKS#selection-397.1-397.222

> Nitpicking is more excusable for women to do. That's ultimately because men talk to others

> exchange important information, while women only talk to others for social negotiation and

> to test the social standing of others.

Thank you, _why :3

I should have said "any disclosure": EFail was coordinated (6 months notice [1]) and yet GnuPG officially downplayed the risk [2], launched #effail counter-campaign and blamed researchers for bad disclosure [3].

With regards to any of the existing SKS exploits specifically: even if any of them were to undergo coordinated disclosure, it wouldn't have helped: trollwot has been available for 5 years, both keyserver-fs and sks-exploit -- for more than a year. Embargoes don't last that long. All three tools still work.

What GnuPG Project effectively tries to do is to stop people from writing about any security problems period, especially those that are hard to fix.

[1]: https://gist.github.com/tqbf/2ef6bce7d16e9d3e76d790fd99c9618...

[2]: https://twitter.com/gnupg/status/995936684213723136

[3]: https://twitter.com/gnupg/status/996856990818283521

Can confirm, I've reported a similar attack [1], along with a few other vulnerabilities, and also published exploit tools. I ended up getting legal threats from two people that I see frequently posting to sks-devel@ mailing list.

Additionally, Robert (GnuPG maintainer who wrote this Gist) has attacked [2] another person who wrote a proof-of-concept filesystem on top of SKS that was intended to highlight how broken the design is.

I have not seen a single open source community that would treat full disclosure with such contempt.

At this point SKS network continues to run exclusively on community goodwill. This attack seems to be specifically targeted on GnuPG maintainers, if attacker were to deliberately try to break SKS, they would target someone like Linus Torvalds.

Alternatively, there are other published vulnerabilities with exploits that allow to take the whole SKS network down within half an hour, which were published more than a year ago. And yet, those have not been used, so far.

[1]: https://bitbucket.org/skskeyserver/sks-keyserver/issues/57

[2]: https://twitter.com/robertjhansen/status/1017863443356020738

For reference, this concern has been addressed here: https://news.ycombinator.com/item?id=20149112

There are not that many phone manufacturers that even allow you to change the trust anchor (which makes any of this even remotely possible). For example, Samsung uses e-fuses to burn in their signing key, rewriting recovery will permanently trip their attestation (Knox); other manufacturers use similar practices. Pixels are one of the only currently available phones with user-controlled trusted boot in mind.

Chain of trust does protect you from evil maid attacks. And yes, there can be bugs in application layer, but at least half of all CVEs are memory corruption bugs.

These practices do offer a massive reduction in attack surface. You seem to argue it doesn't matter since it doesn't eliminate attack surface completely.

Librem 5 isn't going to be particularly security-focused: no attestation, no trusted boot, most userspace programs are written in memory unsafe languages like C, with no extra effort memory corruption mitigations. Also, Flatpak offers a permission system that's very limited compared to Android.

I saw both variants in both browsers.

Huh, 5 out of 15 interviewed developers referred to their desktop as "boring".

Relevant section of Debian upstream guide: https://wiki.debian.org/UpstreamGuide#SCons

As a Linux distribution maintainer, I second that. There are not that many packages that still use SCons, but ones that do often require boilerplate and/or patches to honor standard environment variables like CC, CFLAGS, LDFLAGS. Cross-compiling a SCons package is a nightmare.

If you like that SCons uses Python, I'd suggest to try Meson. It does everything right and exposes a subset of Python API: https://mesonbuild.com

This is not a valid DMCA claim, point one doesn't even mention copyright. I sent a counter-claim, then tried to republish the repo. GitLab said me I will only be able to republish in 10 days if I don't receive a response, and also that they might ban me if I try to republish it again without waiting for due process.

Repos have been moved to http://github.com/AndroidHardening.

I'm not sure what you expect from the developer, to just take it? He doesn't have power in the company because even though he's a 50% shareholder, he's not on the board of directors.

Mirror: https://github.com/yegortimoshenko/copperhead-takeover

CEO has sent DMCA takedown request on my GitLab repo, which clearly abuses copyright law. To use the mirrored pages, replace "yegortimoshenko.gitlab.io" in URLs with "yegortimoshenko.github.io".

Mirror: https://github.com/yegortimoshenko/copperhead-takeover

CEO has sent DMCA takedown request on my GitLab repo, which clearly abuses copyright law.

CEO also blocks everyone who supports Daniel on their IRC channel. I've been repeatedly asked to take down these links and documents, and CEO even told me "they would come after me" if not for the fact that I live in Russia. See IRC logs: https://view.matrix.org/room/!VxEwjfmZAypdXzZfUp:matrix.org/

CEO has removed all of their comments except one. Here are two archived states that should hopefully help future readers to understand the discussion:

https://yegortimoshenko.gitlab.io/copperhead-takeover/hacker...

https://yegortimoshenko.gitlab.io/copperhead-takeover/hacker...

Sales is means, not a goal in and of itself. What you're suggesting is a broken economic model that doesn't honor people that add to the world (i.e. authors).

I'm basing my gross over-simplification off this letter: https://gitlab.com/yegortimoshenko/copperhead-takeover/blob/...

It says quite clearly that you a) believe copyright belongs to the company, b) want him to give all access to infrastructure, c) revoke his access to Copperhead branding.

What exactly have I got wrong or over-simplified?

Daniel Micay is literally the guy behind Copperhead. He is the author of overwhelming majority of commits to CopperheadOS repos and almost single-handedly maintains hardened Linux kernel. Quite literally: open any repo in https://github.com/Copperhead or https://github.com/CopperheadOS and look how much thestinger (Daniel Micay) has been working on all of this.

What you're doing is despicable and unfair. Please resign.

It's under non-free license (Creative Commons non-commercial).

CEO of the company, James Donaldson, wants to boot off Daniel Micay, CTO of Copperhead and the main developer behind CopperheadOS project. Both have 50% shareholder stake. As of now, Daniel Micay can't use Copperhead branding anymore, and is locked out of his own work (because copyright has been assigned to the company), and can only use CopperheadOS under CC-BY-NC-SA.

I couldn't find archived links, but there are a few mentions: https://www.google.com/search?q="Copperhead+as+a+company+doe...

VM, inside a virtualization layer, inside an operating system, inside a VM, inside an operating system.

The single most important feature of Java is reverse compatibility. It is a temporal prerequisite of "write once, run everywhere".

Why do you continue to post this ad when you never reply to emails sent to the address hidden in that challenge?

Tarballs stored in Amazon Glacier.

There are multiple issues with this idea. First, I just don't think you can really tell that from this perspective. That's just thinking too far into the future. This sort of argument is likely to look like a Great Horse Manure Crisis of 1894 [1] to our descendants.

[1]: http://www.historic-uk.com/HistoryUK/HistoryofBritain/Great-...

Have you actually considered how many people it would take to use all energy that sun and future tech can provide? I'm sure no human being can give you even a rough estimate.

It's not like solving aging will break markets. There's a balance between supply & demand, which will indirectly regulate birth rate due to parenting costs.

Universe is really vast, if not infinite. And when we have more people, alive, and doing meaningful things while automation takes over menial tasks, it's really going to make us tackle other problems faster, like transportation.