nbsd4lyfe

Yes, I have a noisy fan and if the browser makes it turn on it's distracting.

it's not bad because of misguided intentions, it's bad because it lacks resources. really badly, even.

Cairo is currently desperately asking for development help, so uhh... https://people.gnome.org/~federico/blog/helping-cairo.html

Mad respect to sales guy. I'm doing the same and avoiding arms companies (my background is very useful for military research).

I acknowledge some warfare may be legitimate (having been bombed myself), but arms companies don't stop at selling to your personal favorite army which you consider morally right, they keep looking for more business abroad.

I don't want to be the one realizing I'm sitting in a cozy air-conditioned office and having made money from the messed up warfare in some distant far-away country, having a large financial incentive to cause more conflict there.

I've been reading stories about a corruption case and apparently there's a lot of easy money to be had doing that.

I have an awful ISP - having a local mirror is a massive improvement.

It almost seems like the web is unusable aside from companies large enough to have a mirror here.

I think in this hypothetical scenario the uid 0 attacker can create its own node for /dev/rwd0 and use raw disk accesses to get around filesystem limits.

Why do you need ACLs to run a few services on their own server?

Breaking dords into bytes and vice-versa involves long sequences of shifts and logical operations

modern MIPS has "ext" and "ins", which are probably an improvement in that regard.

plentiful-yet-unhelpfully-named registers

what's wrong with MIPS register names? my only comparison is x86 and that has been awful. I'm constantly looking up which registers are what.

I'm still putting off contributions because the CLA signing mechanism asked me for my phone number.

I'm assuming you're talking about the reviewer and long term contributor side of it. personally I found initial setup as a drive-by contributor to be very tedious. GitHub is the lowest friction because I already have an account with SSH key etc.

I agree, it's a hella questionable language choice, and not limited to C.

I found out about it through https://github.com/rohe/pysaml2/issues/451

asserts are for diagnostic-enabled code, don't use them for security checks.

tnftp does HTTP and HTTPS. the command name is a misnomer.

Libarchive (sometimes known as bsdtar) supports 7z with an independent implementation.

As for NetBSD, there's hundreds of people with commit access and a small group of respected developers to resolve disputes, with some extra democracy / laws restricting it. FreeBSD is similar but I never bothered to check the details.

I think we generate less hackernews-worthy drama posts overall because when someone is repeatedly abusive, they're asked privately to stop/apologize, and if they keep at it, they risk being kicked from the project.

With hundreds of contributors and a weak hierarchy, no one person is too important to be kicked.

Linus Torvalds again uses abusive wording when he could've made his point just as clearly without it. As the leader of a project he should avoid that - it's massively detrimental that contributors fear being the target of his next rant.

I don't think you necessarily have to miss it on a threaded CPU, but that isn't as optimal.

Notify groups who have to develop fixes (in this case: OS, compiler developers). Especially when they have a record of not violating embargoes and good faith in fixing issues.

When the longer time for fixes is done, post an announcement in private pre-disclosure lists.

For a very complicated change, give a few days of private testing and provide patches and details to groups that must apply the patches (oss-sec distro list, etc.)

For a simple one with existing backports, notify that <DATE> is publication date for a type of vulnerability to <PROGRAM>.

Wait 2-4 weeks to publish a working exploit.

Don't notify bodies who don't have their own custom code that must be fixed, but happen to pay you enough money.

The latter is actually what happened in this case and it's immensely frustrating.

Our git repository went down when crawlers decided to index it

Those captchas are the worst. Google asks me to answer one whenever I make search queries in the middle of the night.

just a heads up, skia doesn't work on big endian.

the first gulf war was in 1990 and the US was a party to it

Below the surface there's an abnormally high rate of PTSD and a small percentage of people who fail to function.

Visiting my family on the weekends, not giving myself a hard time for failing to do things that are optional, making sure I don't accidentally skip meals.

You should blame whoever gave advance notice to Apple and allowed them to patch the issue, but didn't do the same for FreeBSD.

You can block access to rdtsc right now by setting CR4.TSD

I'm a netbsd developer and run netbsd. I think most active netbsd developers do.

a lot of former netbsd developers are still hanging around and contributing to pkgsrc while using it on OS X or linux, I don't think that's a thing to be ashamed of.

netbsd hasn't dropped the ball wrt backporting the changes, they are all in there, even for netbsd-6. here's one of the requests for the old stable netbsd-6 branches: http://releng.netbsd.org/cgi-bin/req-6.cgi?show=1482

it does have an issue with making advisories, though.