Notices by Poul-Henning Kamp (bsdphk@fosstodon.org), page 2

Hello #varnish_cache users!

A multi-vendor HTTP2 DoS for your enjoyment: https://www.cve.org/CVERecord?id=CVE-2025-8671

Fixes are in our repos, and making their way though the pipeline:

https://varnish-cache.org/security/VSV00017.html#vsv00017

Big thanks to Martin for doing the work!

I am a sucker for opto-electronics, so got this discarded kit (ex CNN's London studio?)

Each button has a 36x24 LCD display and red+green LEDS.

Well-designed hardware: ColdFire (=68k) CPU, plenty of RAM, plenty of FLASH, serial port, ethernet etc.

Firmware ? Not so impressive, but very easy to get rid of:

Anybody can flash new firmware from ethernet: No userid, no password, all you need to know is the IP# and how they botched their CRC-16 implementation.

Now it runs #MicroPython :-)

@simon_brooke @catgirlQueer @vashti

Also:

Until we ditch leap-seconds, we cannot predict how many seconds there will be until some timestamp in the future, since that depends on what the director of the Paris Observatory decides twice a year.

And on top of that, time-zones are political decisions, so even without leap-seconds, it is anyone's guess how long time there is to 2026-01-01 09:00 in Mississippi.

@simon_brooke @catgirlQueer @vashti

Fun fact:

Until 1972-01-01Z we used rubber-time, because astrometry is not nearly as constant as most people seem to think.

But it is worse than that.

We literally have no idea how long nanoseconds took before 1958-01-01Z

If you go back before observations of solar eclipses, we even barely know how long days took.

Any epoch before 1972-01-01Z by defintion causes wrong timekeeping.

@bert_hubert @joyofcoding

Deja-vu there....

When #Varnish-Cache were young, many years ago, we got a lot of reports of people reducing servers a factor of 3 to 10 because it was so much more efficient code.

@chrisvest

Yes, not a bad one either.

But "alternative" malloc implementations need people to actively decide to use them, which is reactive to some specific problem.

phkmalloc, by being OS default, meant the 10K+ ports collection got exposed to it.

I remember only one or two "Bah!, FreeBSD is broken watch me not care!" upstream reactions, everybody else went "Ohh, I guess everybody but FreeBSD are unsafe!" and fixed the reported bugs.

Some even said thanks :-)

@pitrh

Wait, I know the answer to this one:

Lennart Poettering.

Right ?

@chrisvest

I guess I have to send him a laminated membership card to the Retired FreeBSD malloc Maintainers Association now ?

https://phk.freebsd.dk/sagas/phkmalloc/

@david_chisnall

I thought "maybe later" is what the creep say right after he has slipped the drug into her drink ?

#FreeBSD 14.3 is out, and first system already upgraded (painlessly).

https://www.freebsd.org/releases/14.3R/announce/

Tip o' the hat to @cperciva

Dont use DNS over HTTPS:

https://www.bsdhowto.ch/doh.html

Couldn't agree more.

I am somewhat torn on bug-bounties, but we'll leave that for another day.

The combination of bug-bounties and AI generates a "make-money-fast" economic opportunity, at the cost of FOSS maintainers.

https://www.theregister.com/2025/05/07/curl_ai_bug_reports/

For the record: #VarnishCache does not pay out bug-bounties (even if we wanted to, we have no money) and this shit-show will certainly not make us start.

@SteveBellovin @hpk

Not to #bikeshed but...

In my experience asking "whom?" only works if the person you ask have a competent(-ish) threat-model, which no normal people do.

The implicit focus on intentionality also downplays the much more frequent accidental loss of control.

At least for me, it works better to ask what outcomes we are trying to avoid, and work through both the intentional, incidental and accidental scenarios that lead there.

Now is the time to throw away the prototype and implement changes which will work.

1. Full and unconditional product liability for all software.
2. Mandatory recalls of unsafe software products.
3. Mandatory open sourcing of all systemically important software. ("OS", not "FOSS")
4. Mandatory independent 3rd party review of all systemically important software.
5. Mandatory reporting to independent accident investigation authority, with law-given full access to all aspects.

2/2

@philpem

I think all connected software/hardware needs to have a timer and detach themselves from the net, if it is not reset by periodic software updates.

Mind you: "Detach from the net" not "stop functioning".

I understand why the "security industry" which feeds of the CVE register is upset about it's potential demise.

But let's face it: MITRE's CVE register was a prototype, built in a world where there were (only!) 231 known security vulnerabilities in total.

We have learned a lot from that prototype.

It has shown us how big the problem is, that the IT-industry will not and can not solve the problem, and how to accidentally create fertile ground for organized crime with good intentions.

1/2

@fivetonsflax @rfc1036

And to society it doesn't matter if the technologist doesn't use the right tool, right procedure or just doesn't bother.

The way society fixes that is: "You do this, you are liable for the consequences."

Check out EU's revised Product Liability Directive: The only reason they revised it, was to explicitly include software and cloud services.

After 2026, religion will be the only product without product liability.

@fivetonsflax @rfc1036

The reason we have what you call sneer of as "gatekeeping" in trades where people can get hurt, is because competence saves lives.

Do you also think passenger air transport has too much gatekeeping in who flies planes ?

Brain surgery ?

Running an oil refinery or nuclear reactor ?

Every country has "gatekeeping" on who can drive a motor vehicle on public roads.

And yes, the IT industry BADLY need more "gatekeeping".

Trump's tariffs on the rest of the world are not about money, imports or exports, and therefore economist can make no sense of them.

The tariffs are plain and simply bullying, no more, no less.

Their only purpose is to make everybody important come begging, hat in hand, forced to recognize the "power" of the bully.

"Nice business/country you have there, too bad if anything happened to it..."

The correct response is to take your business elsewhere.

@graydon @cstross

I am increasingly convinced we need a tax on stored data.

Even a little as 1$/MB/year would seriously change decisions about what is stored and how long it is stored.

It would also bring into light who holds how much data.