While most of the NTPsec team was off at Penguicon, the NTP Classic people shipped a release patched for eleven security vulnerabilities in their code. Which might have been pretty embarrassing, if those vulnerabilities were in our code, too. People would be right to wonder, given NTPsec’s security focus, why we didn’t catch all these… Continue reading NTPsec dodges 8 of 11 CVEs because we’d pre-hardened the code
Results for "ntp"
NTPsec’s beta is released
You’ve heard me uttering teasers about it for months. Now it’s here. The repository is available for cloning; we’re shipping the 0.9.0 beta of NTPsec. You can browse the web pages or clone the git repository by one of several methods. You can “wget https://github.com/NTPsec/ntpsec/archive/NTPsec_0_9_0.tar.gz” to get a tarball. This is an initial beta and… Continue reading NTPsec’s beta is released
NTPsec is not quite a full rewrite
In the wake of the Ars Technica article on NTP vulnerabilities, and Slashdot coverage, there has been sharply increased public interest in the work NTPsec is doing. A lot of people have gotten the idea that I’m engaged in a full rewrite of the code, however, and that’s not accurate. What’s actually going on is… Continue reading NTPsec is not quite a full rewrite
Major progress on the NTPsec front
I’ve been pretty quiet on what’s going on with NTPsec since posting Yes, NTPsec is real and I am involved just about a month ago. But it’s what I’m spending most of my time on, and I have some truly astonishing success to report. The fast version: in three and a half months of intensive… Continue reading Major progress on the NTPsec front
Yes, NTPsec is real and I am involved
A couple of stories by Charles Babcock and (my coincidentally old friend) Steven J. Vaughan-Nichols have mentioned the existence of an ‘NTPsec’ project being funded by the Core Infrastructure Initiative as an alternative and perhaps eventual replacement for the reference implementation of Network Time Protocol maintained by Harlan Stenn and the Network Time Foundation. I… Continue reading Yes, NTPsec is real and I am involved
My SubscribeStar account is live
I’ve finally gotten validated by SubscribeStar, which means I can get payouts through it, which means those of you who want nothing to do with Patreon can contribute through it: https://www.subscribestar.com/esr If you’re not contributing, and you’re a regular here, please chip in. While I’ve had some research grants in the past, right now nobody… Continue reading My SubscribeStar account is live
Build engines suck. Help GPSD select a new one.
One of the eternal mysteries of software is why build engines suck so badly.
Segfaults and Twitter monkeys: a tale of pointlessness
For a few years in the 1990s, when PNG was just getting established as a Web image format, I was a developer on the libpng team. One reason I got involved is that the compression patent on GIFs was a big deal at the time. I had been the maintainer of GIFLIB since 1989; it… Continue reading Segfaults and Twitter monkeys: a tale of pointlessness
While I was making other plans, pars tres
A day or so after the not-so-thrilling last installment of my medical troubles (previous post), I get my hands on a knee scooter. Rented from a local pharmacy. This is a big improvement over the wheelchair. I’m more mobile on it, and can pee standing up. If you think that last bit doesn’t matter, pray… Continue reading While I was making other plans, pars tres
Contributor agreements considered harmful
Yesterday I got email from a project asking me to wear my tribal-elder hat, looking for advice on how to re-invent its governance structure. I’m not going to name the project because they haven’t given me permission to air their problems in public, but I need to write about something that came up during the… Continue reading Contributor agreements considered harmful
Am I really shipper’s only deployment case?
I released shipper 1.14 just now. It takes advantage of the conventional asciidoc extension – .adoc – that GitHub and GitLab have established, to do a useful little step if it can detect that your project README and NEWS files are asciidoc. And I wondered, as I usually do when I cut a shipper release:… Continue reading Am I really shipper’s only deployment case?
Declarative is greater than imperative
Sometimes I’m a helpless victim of my urges. A while back -very late in 2016 – I started work on a program called loccount. This project originally had two purposes. One is that I wanted a better, faster replacement for David Wheeler’s sloccount tool, which I was using to collect statistics on the amount of… Continue reading Declarative is greater than imperative
How not to design a wire protocol
A wire protocol is a way to pass data structures or aggregates over a serial channel between different computing environments. At the very lowest level of networking there are bit-level wire protocols to pass around data structures called “bytes”; further up the stack streams of bytes are used to serialize more complex things, starting with… Continue reading How not to design a wire protocol
Announcing loccount 2.0 – now up to 74 languages
I just released the 2.0 version of loccount. This is a major release with many new features and upgrades. It’s gone well beyond just being a faster, cleaner, bug-fixed port of David A. Wheeler’s sloccount. The count of supported languages is now up to 74 from sloccount’s 30. But the bigger change is that for… Continue reading Announcing loccount 2.0 – now up to 74 languages
Announcing a new book: “The Programmer’s Way”
A decade and change after “The Art of Unix Programming”, I’ve decided to do another book. Actually, I have more than just an intention and some notes; I’ve been working hard on it over the last five days it and have 41 Kwords of rough-cut manuscript ready.
Reposurgeon’s Excellent Journey and the Waning of Python
Time to make it public and official. The entire reposurgeon suite (not just repocutter and repomapper, which have already been ported) is changing implementation languages from Python to Go. Reposurgeon itself is about 50% translated, with pretty good unit-test coverage. Three of my collaborators on the project (Daniel Brooks, Eric Sunshine, and Edward Cree) have… Continue reading Reposurgeon’s Excellent Journey and the Waning of Python
Rule-swarm attacks can outdo deep reasoning
It not news to readers of this blog that I like to find common tactics and traps in programming that don’t have names and name them. I don’t only do this because it’s fun. When you have named a thing you give your brain permission to reason about it as a conceptual unit. Bad jargon… Continue reading Rule-swarm attacks can outdo deep reasoning
You’re gonna need a bigger Beast
I’m taking a management-approved break from NTPsec to do a repository conversion that dwarfs any I’ve ever seen before. Yep, more history than Emacs – much much more. More backtrail than entire BSD distributions, in fact about an order of magnitude larger than any repo I’ve previously encountered. Over 255000 commits dating back to 1989… Continue reading You’re gonna need a bigger Beast
The big break in computer languages
My last post (The long goodbye to C) elicited a comment from a C++ expert I was friends with long ago, recommending C++ as the language to replace C. Which ain’t gonna happen; if that were a viable future, Go and Rust would never have been conceived. But my readers deserve more than a bald… Continue reading The big break in computer languages
The long goodbye to C
I was thinking a couple of days ago about the new wave of systems languages now challenging C for its place at the top of the systems-programming heap – Go and Rust, in particular. I reached a startling realization – I have 35 years of experience in C. I write C code pretty much every… Continue reading The long goodbye to C