Hacker Newsnew | past | comments | ask | show | jobs | submit | more rdpintqogeogsaa's commentslogin

This is nearly beside the point, but why include SHA-1 as a default hash algorihtm in a greenfield project?


It's not exactly green-field: SPDX is over ten years old now, and browsers only started removing SHA-1 in the last five years.


As other commenters have said, it’s not greenfield, but is there a valid attack vector on a collision here?


Yet there are also large networks like QuakeNet or UnderNet with no TLS anywhere.


And you can choose not to be there.

My network forces TLS: https://darkscience.net

Forcing people to "do what you want" is against the spirit of open standards.


Key part here is "are finalizing". It's still possible for at least some of the deals to fall through. I guess NTRU is the backup plan just in case and/or a method to apply pressure by saying the public is now aware there's a plan B. I exüect this passage to imply at least one negotiation has been going poorly.

It would probably be interesting to look up who of these people also has patents outside of the USA. If there really is someone being particularly stubborn, one might reasonably expect them to enforce the non-US patent variant outside of the USA.


What's the impact on AES-NI specifically? If hardware AES is impacted and no microcode updates are coming, this would be bad news.

Assuming ChaPoly needs expensive masking mitigations and AES-NI is safe, ChaPoly just became a lot less attractive, too.


Neither AES-NI nor ChaPoly can be influenced by this vulnerability, because they do not use the secret key with different kinds of instructions, that might consume different powers. The secret key is used only in XOR operations. Other secret state of the ciphers is also used only in simple operations, e.g. XOR, additions and rotations, where there is very little variation of the power consumption depending on the operand values.

The cryptographic algorithms that have chances to be influenced are those based on public keys, which compute arithmetic operations with large numbers that can cause changes in the clock frequency.


They are not. You still have strings attached: the requirement of attribution and the disclaimer. With 3-clause and 4-clause BSD, there are even more strings attached.

You can't just take MIT-licensed code. You have to take the code and the full copyright notice and license grant with disclaimer.


Copyright law doesn't allow you to waive those rights without falling into Public Domain, which is considered grey area in some countries.


From what I can tell, at least it's historically inherited. 4.4BSD had a list of airports in the same location.

Its inclusion in 4.4BSD seems a mystery though. No other files on the 4.4BSD distribution seem to reference it. The atc(6) game involves airports, but it doesn't seem to actually open this file, both in 4.4BSD and in OpenBSD.


It goes back a bit further than that, to 4.3BSD-Reno https://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/sh...

The previous release, 4.3BSD-Tahoe, did not have /usr/share


This is actually specified in ISO 8601; they call it the ordinal date.


Ah, thank you.

https://en.wikipedia.org/wiki/ISO_8601#Ordinal_dates

Looks like I'm using the second format (YYYYDDD) with the first two year digits truncated.


> With CC0, you relinquish all rights to the work, including copyright.

With CC0, you relinquish your copyright only, but explicitly retain trademark and patent rights (!).

> 4. Limitations and Disclaimers.

> a. No trademark or patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document.

This makes it sort of iffy for software when software patents exist unless coupled with some kind of patent waiver or assertion of not holding and not being aware of patents. While you can argue with MIT-0/0BSD/whatever else there might be that there is an implied patent license, there is an explicit non-license for patents with CC0.


Yes. Patents were why CC0 was withdrawn from OSI consideration. Now lawyers have argued that the patent grant is implied as part being given rights to use the software. But it was sufficiently controversial that many were uncomfortable with it.


You seem to be looking for a lawyer. Asking concrete legal questions on a public forum is not a substitute.


A similarly brusque response could be written to many, many questions on a forum.

> You seem to be looking for a doctor/lawyer/teacher/statistician/psychologist/sysadmin/_____. Asking concrete _____ questions on a public forum is not a substitute.

Does that really have a positive effect, though? In my opinion, it's not a good thing for people, especially those who aren't wealthy to enough to pay every time there's something they want to learn.

They probably know that paying someone hundreds of dollars an hour is the surest way to get a good answer but lack either the ability or the will to pay it.


> They probably know that paying someone hundreds of dollars an hour is the surest way to get a good answer but lack either the ability or the will to pay it.

And getting a shit answer on an anonymous forum that is not remotely tailored to personal circumstances is an acceptable substitute ?

Especially as the answer will no doubt come from some John Doe who isn't even qualified in the topic at hand but is just regurgitating some heresy they read on the internet or heard from "a friend".

I mean, nobody here has said "I can't comment until I've seen your contract with your employer, can you email it to me ?" .

There are some things that require the services of a professional and tailoring to personal circumstances.

Sure you can go watch videos for free on YouTube that show you how to do open heart surgery, and you can probably buy medical scalpels cheaply on eBay.

But frankly I'd rather pay up and get an experienced surgeon to do it for me.


> But frankly I'd rather pay up and get an experienced surgeon to do it for me.

Most ailments don't require a surgeon and most people don't have access to one.

Medical advice is one of the most frustrating things to google for. Far too often, the only advice to be found is to "see a physician". This is often good advice but not everyone can and I'm pretty sure that the lack of additional advice results in people improperly treating injuries, misdiagnosing ailments more often than necessary and sometimes dying.

I don't say this out of a dislike of medicine! My mother is a doctor and spent years working in Kenya a couple of decades ago and saw many, many instances of suffering that could have been avoided with today's wireless internet and some good online medical advice.

It's not worth nerfing free online advice for the benefit of people can afford to spend on advice tailored perfectly for their own situation.


This seems to a case analogous to “I have this new, fast-growing, irregular-shaped mole on my forehead and I’m thinking of using Compound W on it. As long as I don’t get any in my eye, I should be OK, right?” and then someone suggesting “you really ought to see a doctor”.


Hundreds of dollars per hour over the course of 15 minutes isn’t too bad of a bill.


0BSD is actually incompatible with a desired pure CC0. Unlike CC0, 0BSD keeps copyright intact. It's just a license with no conditions except the usual disclaimer; CC0 attempts to cause a public domain dedication wherever possible. Consider the following:

1. Let there be a file F. F is released to the public under 0BSD.

2. Let there be a project P. P includes code from F. The license notice of F is scrubbed as part of the inclusion process.

3. P is released as CC0.

The author of P cannot release the project as CC0 because the author has no right dedicate another person's code (F) to the public domain. Because 0BSD doesn't cause a public domain dedication in jurisdictions that accept doing so, F would have to continue being separate and explicitly exempt from the effects of CC0 to be an accurate of its usage terms. Effectively, this makes 0BSD be a de-facto attribution license in a CC0 project. In practice, it makes no difference, but it's legally deeply inelegant.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: