News for hackers. Stuff that matters.

anjbe

Re:Why did the OpenSSL punycode vulnerability happen on Thursday November 03, 2022 @07:00AM (#33449307)
bool, true, and false as native keywords are on track to show up in C23. https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2393.pdf
> I'm pretty sure even OpenBSD packages OpenSSL in ports for third party software, since so many pieces of software basically require it and do not work with LibreSSL anymore.

Theo Buehler talked about the current status of LibreSSL compatibility at EuroBSDcon last week. To take some quotes:

“> 2000 OpenBSD ports link against libcrypto or libssl” [i.e., LibreSSL]

“< 100 of these need patches (< 5%)”

“6 ports link against OpenSSL”

https://www.youtube.com/watch?v=bF1d_aCSzS0

Good post! I must point out, though, the correct symbol for minutes and seconds is actually the prime. As in, 10° 33′ 19″.
I do the same, except instead of xmodmap I use “setxkbmap -option compose:ralt” (plus a few other options) as described in the xkeyboard-config(7) manpage. It has some useful features: https://man.openbsd.org/xkeyboard-config.7
That’s the Unicode way of doing things (which I heartily subscribe to), but in ASCII’s original conception what you describe as “abuse” was a feature. For instance, in RFC 20 which is dated 1969, 0x27 is named “Apostrophe (Closing Single Quotation Mark/Acute Accent)” and 0x60 is named “Grave Accent (Opening Single Quotation Mark)”. Additionally, double quote also served as a diaeresis, and comma as a cedilla.

Of course, your links are right: it makes no sense to overload these characters anymore now that we have character sets and software capable of providing typographic niceties. But it’s fun to know the history.

In the old days of ASCII several characters were heavily overloaded. On teletypes it was not unusual to create accented characters by typing ` or ' (which looked more like ´), then backspacing and typing a vowel, to get (e.g.) è or é. The same could be done with ~ to create ñ, if the tilde were high up like ˜, or with " to simulate an umlaut.

And of course there’s the overload of hyphen and minus, such that Unicode gave up and named U+002D “hyphen‐minus,” and created two separate characters U+2212 “minus” (−) and U+2010 “hyphen” (‐) to use in situations where the typography matters. Most fonts seem to use identical glyphs for hyphen‐minus and minus, but I’ve seen some that try to split the difference, giving hyphen‐minus a glyph with a height and width somewhere in between hyphen and minus.

If you find minus and hyphen‐minus hard to distinguish visually, just remember that a true minus sign looks just like a plus without the vertical part. Compare the alignments:

- example (U+002D hyphen‐minus)

+ example (plus)

− example (U+2212 minus)

Re:Security through obscurity is underrated on Monday October 24, 2022 @07:46AM (#33315486)
When that day comes, a machine running sshd on a high port will have to be wiped, because how can you trust that nobody’s scanned your ports, exploited your server, and eliminated the traces?

When an OpenSSH zero‐day gets released, you can bet your bottom dollar people will be scanning full port ranges for SSH servers. And only one of them has to find you.

If that’s the scenario you’re worried about, don’t rely on obscure ports. Run your sshd behind a VPN.

Re:Security through obscurity is underrated on Monday October 24, 2022 @05:33AM (#33314513)
If animals in nature had a defense against predators as effective as “PasswordAuthentication no”, they wouldn’t need camouflage.
Re:Security through obscurity is underrated on Sunday October 23, 2022 @07:07PM (#33311181)
> You can maintain a .ssh/config file with all the port that you used (and backup it)

Once you start distributing config files to all your clients you might as well switch to keypair authentication, which so completely reduces risk of intrusion that leaving sshd on 22 simply does not matter.

> that consumes resources (even if minimal)

I suspect practically immeasurable.

Re:Security through obscurity is underrated on Sunday October 23, 2022 @05:29PM (#33310456)
Do people using high ports actually check their logs enough for it to matter?
Re:Security through obscurity is underrated on Sunday October 23, 2022 @05:25PM (#33310418)
The thesis of the article, that security through obscurity is underrated, is “because it has a low implementation cost and it usually works well.”

But I contest both of those things. Common obscurity methods provide low benefit for the amount of work put in, relative to methods with a better foundation.

One of the best examples of this is port knocking, a resurging fad in self‐hosting circles, that is completely beaten both in simplicity and in actual protection by putting your SSH server behind WireGuard.

Even the example in the article seems ridiculous. I always advocate disabling SSH passwords and using FIDO‐backed SSH keys instead, but of course people will complain that they lose the ability to log in from arbitrary machines (well worth it in my opinion, but fine). So rather than using SSH with a weak password on a non‐default port, why not use SSH with a strong password on a default port, which provides more entropy and also some protection against attacks by a local user, without having to remember weird port numbers?

Re:The British Socialist Who Rewrote the World for Children on Friday October 07, 2022 @08:20PM (#33128582)
The article mentions that two of her books (The House of Arden and The Railway Children) are being republished this fall. That said, her copyrights have expired, so they’re also available now as open‐source, public domain ebooks at Standard Ebooks: https://standardebooks.org/ebooks/e-nesbit

I was a big fan of Nesbit’s Psammead trilogy as a child: Five Children and It, The Phoenix and the Carpet, and The Story of the Amulet.

Re:The deception of “buying” digital movies on Tuesday October 04, 2022 @01:24PM (#33083612)
Star Wars is a particularly salient example because the original cuts that made the films such cultural icons are completely unavailable from anyone other than third‐party sellers, due to the wishes of the (former) rights holder. After the Special Editions were released, the theatrical editions made it onto DVD one time, and never did again. J.J. Abrams has indicated that there are difficulties behind the scenes (perhaps some clause in the Disney purchase) that prevent the originals from being made available for sale. So people who want to avoid the CGI and bad redubs of the Special Editions are stuck scrounging eBay, or more likely, grabbing an “unofficial” scan of the theatrical editions.
Re:The deception of “buying” digital movies on Tuesday October 04, 2022 @01:02PM (#33083272)
The article mentions GOG’s movie selection (which is indeed extremely limited: https://www.gog.com/en/movies). It’s worth pointing out that Vimeo also provides some DRM‐free digital downloads through its “On Demand” imprint (https://vimeo.com/ondemand/oxyana). Like GOG, though, it mostly contains works of a particular niche (in this case, documentaries and short films).

I’ve been hard‐pressed to find any other way to purchase DRM‐free movies.

Re:An old Encyclopaedia Britannica is a work to cherish on Saturday October 01, 2022 @09:34PM (#33051880)
Complete scans of Harvard Classics, a notable predecessor to Britannica’s Great Books collection, are available on the Archive: https://archive.org/details/harvardclassics?tab=about

Standard Ebooks also has a growing collection of formatted epubs of the Great Books—necessarily incomplete, as much of the full set is still copyrighted. https://standardebooks.org/collections/encyclopaedia-britann...

Another commenter posted a source that mentions in passing that ISO 8601 was the result of a 1978 UN declaration that Monday should be the first day of the week. Now I wonder where that came from!
You’re not wrong that “the Sabbath day” has sometimes been used by Christians to refer to Sunday, but the context of this thread is that a comment claimed that calling Sunday the first day of the week is inconsistent with the Bible, and that’s plainly not true.
Thanks for the link. It had another interesting fact:

> In 1978, the UN recommended that Monday be made the first day of the week in most countries. It was established in 1988, according to ISO 8601, an international standard for exchange and communication of date and time-related data.

I’m really curious about why the UN made that decision. Is this the primary reason so many countries now consider Monday the first day?

I’m actually really interested in this. Clearly in Jesus’s time the Hebrew week went Sunday–Saturday. That definition remained at least for long enough to make into Ecclesiastical Latin and further into, e.g., Portuguese (segunda-feira, etc.). So why does ISO 8601 go Monday–Sunday? Was it codifying existing practice in Europe? When did that practice begin? Was America colonized before Europe switched to Monday–Sunday, or is America’s Sunday–Saturday a fundamentalist reversion to something more Biblically accurate?
> > What is agreed upon by near universal scholarly consensus is instead that Jesus was baptized and crucified.

> You're going to need an awful lot of citations there.

> Firstly, define the scholars you're referring to.

Not being OP, I’ll list at least John Dominic Crossan and James Dunn, who has said that the baptism and crucifixion of Jesus “command almost universal assent.”

Of course, I got those names from five minutes speed reading Wikipedia. But that’s two more scholars’ opinions of the scholarly consensus than you’ve provided.

> Also, what sources are they working from?

Surely this is the very definition of moving the goalposts. OP stated the scholarly consensus is that Jesus’s baptism and crucifixion are true (this, incidentally, was my existing impression of the scholarly consensus). Now you’re no longer just arguing that OP was wrong about that, but have moved on to claiming that any scholars and historians who believe in Jesus’s baptism are wrong because they have no reliable sources.

I have to admit, I’m not inclined to throw out my understanding of the scholarly consensus or which sources are reliable to argue the historicity of Jesus based on an unsourced Hacker News comment.

What’s unlikely about that? The Jewish seventh‐day Sabbath is literally the founding principle of the seven‐day week.
I’ve seen this theory proposed, but is it actually widely accepted by historians? Wikipedia says that a connection “has been suggested”[0], which doesn’t seem like very strong wording.

[0] https://en.wikipedia.org/wiki/Shabbat

> Moreover, most of European countries where workweek starts on Monday already consider it the 1st day of the week, why can't US do the same and be done with it?

What benefit would we get from doing so? Metric I can understand the benefits of, though I also see why Americans are resistant implementing such a disruptive change in daily life. But shifting our definition of the week by one day provides no benefit that I can see, nor does keeping it the way it is cause any harm. The primary argument I’ve seen in these threads is “because the word ‘weekend’ doesn’t make sense,” but that’s not very convincing to me since I and every other American I know find the phrasing perfectly natural—and if we want to make the English vocabulary perfectly ‘logical’ and ‘consistent,’ there are far more disturbing malapropisms in common use to tackle first.

There’s a good exchange in the classic video game Star Control 2 (now open source, available in most package managers as “uqm”), when the player encounters a species of plant‐like alien:

>> I am Captain Zelnick from Earth. We come in peace.

> I am Captain Ala‐la’la. We come in peace.

>> Our starship is called Vindicator.

> Our starship is called the Tender Shoot.

>> We are the New Alliance of Free Stars from Earth.

> We are the Supox Utricularia from Earth.

>> You’re from Earth??? Hey! Are you just copying whatever I say?

> Oh yes, we apologize for the confusion, our homeworld is also called ‘Earth’, or more properly ‘Vlik’, which means ‘Perfectly Good and Nutritious Dirt’. ‘Earth’ is pretty close, is it not?

Then why does the US, a very young culture compared to Europe, universally consider Sunday the first day of the week? Calling Sunday the seventh day must be a very recent development.
While the majority of Christians meet on Sunday and consider it the “new” Sabbath or the fulfillment of the Sabbath, in commemoration of Jesus’s resurrection, how does that relate to restructuring the week so Sunday is the last day? The Bible is clear that Jesus was resurrected on the first day of the week, the day after the Sabbath.

Matthew 28:1 (NIV): “After the Sabbath, at dawn on the first day of the week, Mary Magdalene and the other Mary went to look at the tomb.”

Mark 16:1–2 (NIV): “When the Sabbath was over, Mary Magdalene, Mary the mother of James, and Salome bought spices so that they might go to anoint Jesus’ body. 2 Very early on the first day of the week, just after sunrise, they were on their way to the tomb…”

Luke 24:1 (NIV): “On the first day of the week, very early in the morning, the women took the spices they had prepared and went to the tomb.”

John 20:1 (NIV): “Early on the first day of the week, while it was still dark, Mary Magdalene went to the tomb…”

Seventh‐day Adventists are definitely the most prolific Christian keepers of a Saturday sabbath, but they are not totally alone. The next most prominent groups I can think of are Seventh Day Baptists and Messianic Jews. SDAs are in the tens of millions worldwide, Messianics in perhaps the hundreds of thousands, and SDBs under one hundred thousand.

Although they’re fairly distinct traditions, in my experience each places great importance on religious liberty and separation of church and state, because historically all three groups have faced governmental persecution from blue laws. SDAs go so far as to believe Revelation’s mark of the Beast refers to a blue law to come in the future.

Messianics also have been known to face religious persecution in Israel. To the extent Christianity is viewed with mistrust by Judaism due to Christendom’s history of persecuting Jews, Messianic Judaism is further seen as an attempt by Christians to co‐opt or corrupt Jewish practices.

(Another fun fact: Seventh‐day Adventists hyphenate their name, but Seventh Day Baptists don’t.)

The Quakers numbered their weekdays and also their months, to avoid referencing foreign gods in their calendar. https://www.swarthmore.edu/friends-historical-library/quaker...
Re:Google wants to take on Dolby with new open media formats on Friday September 23, 2022 @08:09PM (#32958557)
An incredibly limited subset for sure. WebM with VP8/VP9/AV1 is a far cry from how Matroska is typically used, with supported codecs like h.264/h.265 and chapters, subtitles, multiple audio tracks, and linked external files.
Re:Gen Z never learned to read cursive on Sunday September 18, 2022 @03:03PM (#32890415)
I was taught D’Nealian in elementary school. I took to it fine, but within a few years decided it looked dumb, and dropped the tails and loops that looked out of place compared to the letter forms I saw in print. I learned cursive easily in third grade, and have used it in most handwriting ever since. Looking back, I have wondered whether D’Nealian had a positive effect there or not.

It’s pretty weird reading all these other comments about how useless cursive is. Certainly I think it’s more important to type well than to write in cursive. But while the vast majority of my life’s text output has been via computer, I still use handwriting in plenty of places—postcards, birthday cards, thank‐you notes, and so on. Am I just anachronistic

Older »