News for hackers. Stuff that matters.
Re:SKS Keyserver Network Under Attack by libeclipse on Saturday June 29, 2019 @11:03AM (#20312977)
The new keys.openpgp.org service is a mitigation:

> keys.openpgp.org is a new experimental keyserver which is not part of the keyserver network and has some features which make it resistant to this sort of attack. It is not a drop-in replacement: it has some limitations (for instance, its search functionality is sharply constrained). However, once you make this change you will be able to run gpg --refresh-keys with confidence.

Re:SKS Keyserver Network Under Attack by paulfurley on Saturday June 29, 2019 @12:28PM (#20313414)
I know the folks behind this and I think they’ve approached it thoughtfully and realistically.

It’s using a modern OpenPGP implementation and language (Sequoia, Rust) which is a big win. Despite it being centralised, I’d encourage folks to have a look.

On that issue, SKS has become so troublesome to run that the number of peers has steadily decreased to the point where there are only 2 entities running the HKPS (“secure”) pool, so in reality SKS is centralised too, as well as unmaintained. Source: I run a key server and a key expiry reminder service.

Re:SKS Keyserver Network Under Attack by jlgaddis on Saturday June 29, 2019 @12:40PM (#20313478)
Out of curiosity, which is more obscure: OCaml or Rust?
Re:SKS Keyserver Network Under Attack by kchamplewski on Saturday June 29, 2019 @12:57PM (#20313571)
Probably OCaml. While it's been around much longer, it's never really reached mass acceptance (though does get used here and there). Rust is newer but I'd estimate it's already more used, and its adoption in industry is growing quite quickly.

This is probably to do with the fact that OCaml doesn't necessarily solve any problems that are apparent to businesses, whereas Rust solves the very apparent "manual memory management makes massive vulns trivial" problem.

I'm not sure which language is actually more approachable for someone trying to learn it from scratch though.

Re:SKS Keyserver Network Under Attack by AnaniasAnanas on Saturday June 29, 2019 @01:11PM (#20313633)
OCaml is very popular in academia though, especially in the field of theoretical computer science and formal verification. Coq, Frama-C, Flow, CompCert, etc are all written in OCaml. Heck, if you are running a graphical GNU distribution chances are that you have installed FFTW, which is written in OCaml. The "industry" is not the only thing that matters when considering the adoption of a language.
Re:SKS Keyserver Network Under Attack by xvilka on Saturday June 29, 2019 @01:35PM (#20313740)
Also a Mirage OS/unikernel, BAP and BinCat binary analysis frameworks, Facebook Infer source-level static analyzer, etc.
Re:SKS Keyserver Network Under Attack by ghuntley on Saturday June 29, 2019 @01:25PM (#20313693)
Reason (the frontend framework/language by Facebook) is OCaml.
Re:SKS Keyserver Network Under Attack by literallycancer on Saturday June 29, 2019 @07:22PM (#20315460)
Have you used Reason for anything serious? How was it?
Re:SKS Keyserver Network Under Attack by paulddraper on Saturday June 29, 2019 @09:06PM (#20315767)
Particularly if your talking about a quasi-adademic PGP community.
Re:SKS Keyserver Network Under Attack by steveklabnik on Saturday June 29, 2019 @07:37PM (#20315511)
Fun fact: Rust’s initial implementation was in OCaml.
Re:SKS Keyserver Network Under Attack by CameronNemo on Saturday June 29, 2019 @05:20PM (#20314842)
Right? I was reading about this and thinking "hey, maybe technically sound but less well-known languages like OCaml or Rust are not always a good choice".
Re:SKS Keyserver Network Under Attack by rurban on Saturday June 29, 2019 @05:26PM (#20314882)
The question is not obscurity, the question is security. And there ocaml wins by miles over rust.
Re:SKS Keyserver Network Under Attack by literallycancer on Saturday June 29, 2019 @07:26PM (#20315471)
Are you talking about the compiler itself? Or the tooling and the libraries that you have to deal with when you try to actually use the language?