It's standard autoconf stuff, BUT... the right thing to do for a security option should be to throw an error at the configure stage If the Option is requested but can't be supported, And not to silently turn it off.…
It's worrisome for sure.. the original maintainer mentions longterm mental health issues, "but also due to some other things" My worry would be "other things" they didn't mention can include deliberate acts of sabotage…
The other thing besides the autoconf soup is the XZ project contains incomprehensible binaries as "test data"; the "bad-3-corrupt_lzma2.xz" part of the backdoor that they even put in the repo. It's entirely possible…
Still.. At this point the default assumption should be every commit is a vulnerability or facilitating a potential vulnerability. For example, change from safe_fprintf to fprintf. It would be appropriate that every…
Consider the possibility those type of submissions were part of the adversary's strategy in order to make their account appear more legitimate rather than appearing out of nowhere wanting to become the maintainer of…
Lasership, Inc. v. Watson. Found a NDA unenforceable because the term was indefinite that the court deemed to be an unreasonable term for the agreement - It is important that contracts have a well-defined start date and…
If you rent the backhoe... make sure you call before you dig and don't cut one of my fibers, please.
You can use financing arrangements to avoid dropping the money all at once -- for example: A service provider offers you a monthly subscription or "lease-to-own deal" where you sign a contract to buy the software or…
The thing is the AHCI interface is native to Intel chipset, so they had to do some sort of extra work to block access to enable it...... They provided a new proprietary storage interface, because it's purported to be…
Perhaps he didn't deliver the point... but BASH is not a good or safe language to write to. Writing to '/bin/sh' is understandable due to its ubiquitousness. Bash is a superset that is not so ubiquitous, so it doesn't…
It's standard autoconf stuff, BUT... the right thing to do for a security option should be to throw an error at the configure stage If the Option is requested but can't be supported, And not to silently turn it off.…
It's worrisome for sure.. the original maintainer mentions longterm mental health issues, "but also due to some other things" My worry would be "other things" they didn't mention can include deliberate acts of sabotage…
The other thing besides the autoconf soup is the XZ project contains incomprehensible binaries as "test data"; the "bad-3-corrupt_lzma2.xz" part of the backdoor that they even put in the repo. It's entirely possible…
Still.. At this point the default assumption should be every commit is a vulnerability or facilitating a potential vulnerability. For example, change from safe_fprintf to fprintf. It would be appropriate that every…
Consider the possibility those type of submissions were part of the adversary's strategy in order to make their account appear more legitimate rather than appearing out of nowhere wanting to become the maintainer of…
Lasership, Inc. v. Watson. Found a NDA unenforceable because the term was indefinite that the court deemed to be an unreasonable term for the agreement - It is important that contracts have a well-defined start date and…
If you rent the backhoe... make sure you call before you dig and don't cut one of my fibers, please.
You can use financing arrangements to avoid dropping the money all at once -- for example: A service provider offers you a monthly subscription or "lease-to-own deal" where you sign a contract to buy the software or…
The thing is the AHCI interface is native to Intel chipset, so they had to do some sort of extra work to block access to enable it...... They provided a new proprietary storage interface, because it's purported to be…
Perhaps he didn't deliver the point... but BASH is not a good or safe language to write to. Writing to '/bin/sh' is understandable due to its ubiquitousness. Bash is a superset that is not so ubiquitous, so it doesn't…