Feed digilinux.ru [copy] http://digilinux.ru/feed/ has loading error: cURL error 22: The requested URL returned error: 403 Forbidden
Feed freepost [copy] https://freepo.st/rss/new has loading error: cURL error 6: Could not resolve host: freepo.st
Rotating passwords in bulk in the wake of security events
I’ve been putting this post off for a while. Do you remember the CloudFlare security problem that happened a few months ago? This is the one that disclosed huge amounts of sensitive information for huge numbers websites. When this happened, your accounts on thousands of websites were potentially compromised.
Updating passwords for all of these services at once was a major source of frustration for users. Updating a single password can take 5 minutes, and changing dozens of them might take hours. I decided that I wanted to make this process easier.
$ ./pass-rotate github.com linode.com news.ycombinator.com twitter.com Rotating github.com... Enter your two factor (TOTP) code: OK Rotating linode.com... Enter...Drew DeVault's blog
Building a "real" Linux distro
I recently saw a post on Hacker News: “Build yourself a Linux”, a cool project that guides you through building a simple Linux system. It’s similar to Linux from Scratch in that it helps you build a simple Linux system for personal use. I’d like to supplement this with some insight into my experience with a more difficult task: building a full blown Linux distribution. The result is agunix, the “silver unix” system.
For many years I’ve been frustrated with every distribution I’ve tried. Many of them have compelling features and design, but there’s always a catch. The popular distros are stable and portable, but cons include bloat, frequent...
State of Sway April 2017
Development on Sway continues. I thought we would have slowed down a lot more by now, but every release still comes with new features - Sway 0.12 added redshift support and binary space partitioning layouts. Sway 0.13.0 is coming soon and includes, among other things, nvidia proprietary driver support. We already have some interesting features slated for Sway 0.14.0, too!
Today Sway has 21,446 lines of C (and 4,261 lines of header files) written by 81 authors across 2,263 commits. These were written through 653 pull requests and 529 issues. Sway packages are available today in the official repos of pretty much every distribution except for Debian derivatives,...
MSG_PEEK is pretty common, CVE-2016-10229 is worse than you think
I heard about CVE-2016-10229 earlier today. In a nutshell, it allows for arbitrary code execution via UDP traffic if userspace programs are using MSG_PEEK in their recv calls. I quickly updated my kernels and rebooted any boxes where necessary, but when I read the discussions on this matter I saw people downplaying this issue by claiming MSG_PEEK is an obscure feature.
I don’t want to be a fear monger and I’m by no means a security expert but I suspect that this is a deeply incorrect conclusion. If I understand this vulnerability right you need to drop everything and update any servers running a kernel <4.5 immediately. MSG_PEEK allows...
2017-03-28
surf now uses webkit2 by default. The webkit1 version is kept in the surf-webkit1 branch. The “master” branch doesn't exist anymore, HEAD is now surf-webkit2, so be sure to rebase your local master commits onto surf-webkit1.
Principles for C programming
In the words of Doug Gwyn, “Unix was not designed to stop you from doing stupid things, because that would also stop you from doing clever things”. C is a very powerful tool, but it is to be used with care and discipline. Learning this discipline is well worth the effort, because C is one of the best programming languages ever made. A disciplined C programmer will…
Prefer maintainability. Do not be clever where cleverness is not required. Instead, seek out the simplest and most understandable solution that meets the requirements. Most concerns, including performance, are secondary to maintainability. You should have a performance budget for your code,...
Compiler devnotes: Machine specs
I have a number of long-term projects that I plan for on long timelines, on the order of decades or more. One of these projects is cozy, a C toolchain. I haven’t talked about this project in public before, so I’ll start by introducing you to the project. The main C toolchains in the “actually usable” category are GNU and LLVM, but I’m satisfied with neither and I want to build my own toolchain. I see no reason why compilers should be deep magic. Here are my goals for cozy:
Self hosting and written in C An easy to grok codebase and internal design Focused on C. No built-in...