Flameeyes, a Gentoo developer, writes about Linux packaging, build systems, security, and hardware such as chip-and-PIN cards.
HN links it for GPG agent forwarding guides and for debunking ccache myths; commenters treat it as practical sysadmin reference.
I'd say ssh keys generally don't have 2fa.
A passphrase doesn't really turn a ssh-key into 2fa. It's still really only "something you have (access to)": the plaintext of the private half of the key. Granted, you can use ssh-keys with tokens -- my recommendation is to use encrypted ssh-keys paired with a recent[1] openssh server that allows stacking OTP on top, for 2fa with the RequiredAuthentication-directive (well, OTP is generally code for: can demonstrate access to OTP secret) -- but at least it is rather easy to store the two on separate devices (say a phone, and on the filesystem of your workstation/laptop). Not really maximum security, but quite a lot better than traditional passwords.
Until you store both the key and the authenticator on your phone, in order to use ssh from your phone. At which point you end up with "rather convoluted 1fa" -- which might still be marginally better than traditional passwords (along with a warm fuzzy feeling of false security :-).
Other than that I've been looking into using openssh certificates with openssh, but it still looks like it's rather complicated -- and for a single-/few-user setup it's questionable if the expiration etc really adds much actual security.
Maybe the best would be to apply some of the kerberos design lessons to openssh with certificates, issuing short-lived certs much like kerberos ticket-granting tickets (so have an easy way to get a user certificate that's valid for 8 hours or so...). Not sure the added…
> There are a few walled gardens with great payment experiences (the App Store, Amazon)
I'm of a different opinion: Amazon is much stricter than other online merchants, and they don't give you meaningful errors when something goes wrong with your billing. When I was back in europe, I had to rely on a relative's credit card to make a payment, since my debit card was being refused.
Now that I'm travelling in the US, the situation is even worse: they locked my account 2 times already, and they request information that (due to the privacy laws in my home country) can't be easily accessed and returned by my bank.
Apparently there're differences with credit cards, debit cards and atm cards... but as long as you have enough money/credit on your account, I cannot see how the payment process should be different, and no one has been able to explain it to me yet (an interesting blog post about how things can go wrong when paying in person with a card is this one btw: https://blog.flameeyes.eu/2014/04/my-time-abroad-chip-n-pin it deals with "Cardholder Verification Method" which I never even heard of before reading it)
Trying to pay for an order on Lenovo is even worse: they don't accept non-US issued cards (unless it's an american express) and my bank doesn't let me do a wire transfer to the US online (you have to phisically go to their desks and ask for the wire transfer to be sent)
It's mind boggling the amount of manual work and custom e-mails sent back & forth needed for…
> All this for the possibility of interposition? Yes, it seems so. The impact is there for this little-known and little-used feature. Instead of optimising for the common-case scenario where the symbols are not overridden, the ABI optimises for the corner case.
It also looks like PIE+PIC is required if you want a secure system with ASLR: <http://blog.flameeyes.eu/2009/11/02/the-pie-is-not-exactly-a-lie>.
Flameeyes (Gentoo dev) has sent patches to all the main library developer that make sure only the necessary number of symbols is exposed and as much data as possible is marked as read-only. I think this effort is more valuable than proposing a very unlikely ABI change.
That interesting question was asked on Stack Overflow, and closed as off topic. (http://stackoverflow.com/questions/13170334/reading-entropy-avail-file-appears-to-consume-entropy)
A comment says that cat is consuming the entropy, not reading the file.
An answer links to (https://blog.flameeyes.eu/2011/03/entropy-broken) which says "starting a process consumes entropy" but otherwise didn't seem to have an answer. (But I only skimmed.)
This thread (http://www.standalone-sysadmin.com/blog/2013/07/monitoring-entropy-but-but-but/) says that you're just using cat while entropy is being used, and if you keep using cat you see the numbers go down and up.
> Joe GNU/Linux User has just downloaded and untared this package.
Regular users are not supposed to install software like this. The only sane way to administer a distribution is to make sure everything passes through the official package manager. This leaves the developers and package maintainers to deal with autotools and I don't hear them complaining (very loud[1]).
Autotools is simply good enough for the job and instead of being some sort of hated legacy it's being sometimes preferred for new projects (cough [2] cough).
[1]: https://blog.flameeyes.eu/tag/autotoolsmythbuster/
[2]: https://github.com/stefantalpalaru/vala-skeleton-autotools
Really good article, but if you're going to bundle libraries, PLEASE provide a way to make configuration fail if you can't get to the system copy.
A lot of projects (libgroove included) will try the system copy and then fall back to the bundled copy if the system one wasn't found. That's nice for users (maybe), but it's a pain for packagers. If the packager just happens to have one of the dependencies installed, the package will automagically find it but it will have incorrect deps.
Further reading: https://blog.flameeyes.eu/2009/01/bundling-libraries-for-despair-and-insecurity