cdilld

the more i read about this, the more i'm convinced, contrary to what seems to be the prevailing opinion here, that this is primarily an OpenSSH logic bug.

which is not to say that crypt() is well designed or specified - it's clearly deficient. but I can't fathom how the OpenSSH maintainers could come to the conclusion that the root cause is "outside OpenSSH itself" when the root cause is that OpenSSH's mitigation of timing attacks rested on faulty assumptions about the return value of crypt().

given Britain's entire history wrt Ireland, I'd say defending Ireland is the least they could do.

I think Ireland's commitment to pacifism and neutrality is laudable. Too few people live here to be able to defend against attacks from a larger power, and Ireland's strong suit has always been diplomacy, anyway. That obviously annoys people who either (for some unfathomable reason) like war or stand to gain personally from increased defence spending. Fortunately, there is little appetite for the kind of militarisation that the author of this article is hoping for. I'll add, too, that societies organised around the sort of violence, hostility, aggression, and cynicism that go hand in hand with powerful militaries don't seem to be very nice places to live.

I'm not sure I'd want something I cared about to depend on a codebase that included anything as amateurish as that "safe_sleep" script mentioned in the post. It's honestly astonishing that it took GitHub as long is it did to fix that bug.