Hacker Newsnew | past | comments | ask | show | jobs | submit | jonaslejon's commentslogin

Memories! I was at the hacking conference HAL2001 and listening to Dug Song and Solar Designer, who were talking about their SSH timing analysis: https://download.openwall.net/pub/advisories/OW-003-ssh-traf...

Time flies


Nice tool! Will check it out. I have used jdam in the past to fuzz JSON: https://gitlab.com/michenriksen/jdam


Thanks for the link. I'm always looking for ways to extend and enrich it, so it's good to discover similar tools.


OpenSSH 9.8p1 was released July 1, 2024 according to https://www.openssh.com/releasenotes.html#9.8p1


This was quite funny:

if name == "boring_wozniak" /* Steve Wozniak is not boring */ { goto begin }


I personally use OSSEC for File Integrity Monitoring. And it has also actually caught an intruder that modified some PHP-code on a webserver. The attacker forgot to use the prefix @ in the PHP-code so a new error message was sent to the logfile and reported by OSSEC.


You need to have a really good relationship with your ISP and get their acknowledge prior to the scanning


I don't really understand the thread. This guy X writes about the harassments and then someone replies and asks about the release versions?


Being a Perl leader means doing things like releases; that is a key purpose of the role. Try reading what the author wrote at the end, where he raises the topic of organizational continuity in light of his departure:

"I am slated to release 5.34.0 in May, and I still intend to do so unless PSC and the Core object to it. Once I cut the release, I'll remove my permissions and commit bits to GitHub, CPAN, and mailing lists."


In late stage projects there's often a cabal of passive aggressive people in charge who basically use management tactics to stay in power.

One of the tactics is to never directly respond to actual issues and ignore everything that the cabal cannot be bothered with.

Which is what incites anger in honest people in the first place and leaves them vulnerable to being cancelled.

I don't if this is the case here, but this is the reality in other projects. Whether cabal members are the actual top contributors or have any valuable ideas is left as an exercise to the reader.


pretty much the opposite happened here

sawyer had decided some time ago that the p5p mailing list wasn't receptive to his ideas and moved things into secret decision making with like 2-3 others in the know, culminating in his announcing perl 7 as a complete surprise to the entire community. with only some people having been asked questions about topics related to it, without even being told that the questions were about a perl 7 plan.

this lack of communications then led to both massive amounts of criticism of the secret process (with some community members even being misrepresented by documents written by sawyer's colleagues in this) and MASSIVE amounts of technical issues being discovered directly after the announcement and people trying to educate about it. sawyer however basically went "i call the shots here", resulting in an election that upended the "pumpking" model, replacing it with a "3 person council" who still have private meetings, but now operate much more publicly


My interpretation would be they are glad to get rid of him OR they are a completely tone-deaf group. If someone rage-quits and cites harassment, you absolutely have to take this up, even if that person won't change their mind - but to prevent it in the future.

If you are asking in the most lame tone for the next release, you basically tell them to get lost.


OR... they are being respectful of author's experience, decision , life and feelings, and will discuss public things publicly and private things privately.

No matter in which venue my team members bring up their personal issues and difficulties, I will discuss project/work things publicly, and reach out to them on a personal level to support and inquire privately. Even when they choose to make some of their experience public, it is not necessarily my right, nor the appropriate / productive thing to do, to make it a free-for-all public debate.

I think it's the correct, professional, honorable, decent, respectful approach. What should they have done instead - started a flame work on whether the authors experience was real, decision was justified, start going into nitty gritties of each specific infarction... you know, exactly the stuff we're seeing develop in this thread - all of it indubitably further contributing to the author's stress? :-/


>What should they have done instead - started a flame work on whether the authors experience was real

Mention something like "OK, this is an issue we must discuss, are you free to have a call now or later about the issue?"

Like every organization would handle it if they have some crisis management skills. To give the person who felt mobbed a voice, things like that.


Yeah, you do not need a reason and you do not owe the community a lengthy conversation about whether your emotions are valid. You're a volunteer. It's great if other people there reach out for support, but ultimately it doesn't matter if anyone else thinks their experience was real or if their response is reasonable.

Explaining your emotional response when you've been dealing with this kind of thing for an extended period of time is harmful to yourself and I don't think it's remotely fair to complain about them not doing that first. Step one is to keep yourself safe and emotionally healthy. Usually when people get to this point they need at least months before they're even comfortable discussing it privately again, this sounds like it's been going on for a while.

If the organization wants to discuss things on their own they can feel free but including the person who basically says "I'm out" and insisting that they participate if they care about it changing is harassment too, and a recipe for people who have been seriously upset to just get ignored when they refuse to enumerate every instance of behavior that bothered them and have them picked apart by strangers.


They're not asking for a release. They're trying to organise the task ownership / transition after the stepping down, which needs to be done.


A telltale sign that they're siding with the bullies or not taking this seriously.


Or they're sending their personal regards in private, while publicly discussing the publicly relevant transition matters.

Just like what happens all the time when people quit things that happen offline. Not everyone feels comfortable or compelled to make such a statement in front of the team.


Yes, you're probably right.


The individual stepping down says there are no issues with either of the other two leaders for the release. I'd have to dig, but it's likely a team of three to avoid ties and a have the responsibility spread out.

"Siding with the bullies" and holding up a release are likely unrelated.


Great move for transparency



Since the vulnerability is in pdf.js, is the Tor Browser Bundle vulnerable?


the latest versions come with noscript, so not unless you explicitly enable javascript on that site


NoScript is installed but disabled by default. https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: