Damien Miller / is on Nostr

debugging, v: the process of inserting printf statements into code until one's errors reveal themselves

Last Notes

2024-09-20 00:12:51

OpenSSH 9.9 has just been released. New features include support for hybrid ML-KEM X25519 post-quantum key exchange (using a formally-verified ML-KEM implementation), improved controls to drop and penalise unwanted connections, faster NTRUPrime key exchange code and more.
https://www.openssh.com/releasenotes.html#9.9

2024-09-15 08:37:08

Please help us test OpenSSH ahead of the 9.9 release, due in a few weeks.
New features include a new post-quantum key exchange based on ML-KEM, improved controls to disallow unwanted connections and better performance for the existing PQ key exchange.
Full details at: https://marc.info/?l=openssh-unix-dev&m=172638834815257&w=2

2024-08-27 00:54:42

- reply

@npub14fs…qegk I'm not talking about the other charges, Durov's relationship to the Russian state. I deliberately restricted my comments to something with IMO significantly wider implications for privacy-preserving technology.

2024-08-12 11:59:34

Whom amongst us _hasn't_ added an unsafe function to a sshd signal handler?
https://www.freebsd.org/security/advisories/FreeBSD-SA-24:08.openssh.asc

2024-08-12 11:59:34

Whom amongst us _hasn't_ added an unsafe function to a sshd signal handler?
https://www.freebsd.org/security/advisories/FreeBSD-SA-24:08.openssh.asc

2024-07-19 08:17:01

Happy Crowdstrike outage day to all who celebrate

2024-07-19 08:17:01

Happy Crowdstrike outage day to all who celebrate

2024-07-18 22:44:40

I don't post a lot of politics on here, but this seems like a terrifying turn for the USA. These people want to ethnically cleanse America. I know it's been building for a while, but to see it so bluntly and enthusiastically supported by a mainstream political party is horrifying.
As if this alone isn't evil enough, history tells us that once they've built an apparatus to do this, it will be used on other groups that they don't like.
It must be stopped.
https://assets.cybervillains.com/media_attachments/files/112/809/878/120/406/482/original/8d31016458a19f79.jpg

2024-07-15 04:10:57

- reply

@npub1zdp…vqv8 how does the black hole keep pace with the accelerating craft? If they are relatively moving away from each other, then I'd have thought that the harvestable energy would be quickly limited by diffraction?

2024-07-01 11:15:09

I'm extremely grateful that there are excellent security researchers like the Qualys person/team and Google Project Zero who are putting their work into the public domain.
An unfortunately large chunk of vulnerability research has "gone dark" and sells their findings to buyers that include intelligence agencies in repressive regimes and organised crime groups.
OSS attracting top-tier adversarial research is IMO necessary for its survival. IDK what would happen if it dried up...

2024-07-01 08:43:56

- reply

Lots more details on exploitation of the critical vulnerability in Qualys' report: https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt

2024-07-01 08:11:12

OpenSSH 9.8 has just been released. This release includes a fix for a critical race condition in sshd that could be exploited for remote code execution so you should definitely patch or upgrade. It also contains a fix for a minor issue in ssh that saw the recently-added ObscureKeystrokeTiming feature work the opposite way as intended.
There are some new features too. Please see the release notes at https://openssh.com/releasenotes.html for more details

2024-06-06 17:45:27

I'm pretty excited by this change coming in the next version of OpenSSH sshd: https://marc.info/?l=openbsd-cvs&m=171769392207688&w=2
sshd will now be able to automatically penalise clients that repeatedly fail authentication (e.g. password guessing) or cause sshd to crash (e.g. exploit attempts).

2024-05-09 10:00:54

- reply

@npub1eqg…fncn DISPLAY is the type bound used for the display member of DisplayAt. It seems fairly common for these to be all-caps, e.g. https://github.com/stm32-rs/stm32f4xx-hal/blob/master/src/i2s.rs#L471

2024-05-09 09:27:58

- reply

@npub1eqg…fncn maybe not, this is all still very much in-progress and probably could be simplified

2024-05-09 01:26:22

Still trying to learn #RustLang and had my first real fail with the borrow checker last night. How can you return a temporary reference to `self` from a method?
https://gist.github.com/djmdjm/9c717fc294e68b4da563077d9469ec99
any clues appreciated