So Debian Stretch froze packages today, by the time it's out everything will 4-5 months old

What's wrong with gnutls?

fucking LOL

Necessity is the mother of all invention

GnuTLS is just painfully mediocre, it's not a war crime like OpenSSL. So anything that uses it will be using it forever, they won't get the benefit of a god-tier drop-in replacement like LibreSSL :^)

I mean, google new oss-fuzz project found many serious issues in gnutls after a few days of fuzzing, it's like it's not even being tested. 1 minor bug in openssl was found.

bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q=status:Fixed,Verified Type:Bug-Security proj:openssl,gnutls&colspec=ID Type Component Status Proj Reported Owner Summary&cells=ids

github.com/google/oss-fuzz

If someone wrote a fuzz target for a project like Tox, do you think google you accept it?

No.

Testing is the worst place security-wise, because you won't get fixes as fast as unstable (from upstream) or stable (patched by debian team).

Packages from unstable are automatically moved to testing after 3 to 5 days (10 days during transiston freezes). They will sometimes make exceptions for critical security patches.

During the freeze, stretch security will be bad unless the security team starts patching the frozen packages.

Example:

tracker.debian.org/pkg/ntfs-3g

This has a public PoC out, allowing an unprivileged user to load custom kernel modules. openwall.com/lists/oss-security/2017/02/04/1 (i think this only works if fuse isn't already loaded in lsmod)

It is fixed in stable and unstable but won't be getting into stretch because of the freeze. When will the patching start?

...

Any good reads that you can recommend?

If you want something to question your sanity: GNU coreutils
If you want something interesting read glibc, especially its strlen() hack.
If you like very low level stuff KolibriOS is really interesting, especially the initialisation sequence.
I've also heard good things about ReactOS and Dolphin but I haven't had the time to do more than a few skim reads, though from what I can see I'd have to agree.

I don't understand, without knowing the length how can you read more than one byte at a time? Won't you read past the end of the string?

Most of glibc is really ugly and hard to follow

I said this once here but nobody gave a shit really, in a strict x86 segmentation glibc strlen won't work since you can allocate memory in bytes, like a 5 byte segment at 0x1000, when strlen tries to access an integer at 0x1004, it will segfault.
Today we use paging and have some alignment/allocation "guarantees" by most operating systems, so we know it is safe to access past the null character as long as we are accessing in aligned addresses.

You should read the thank you speech Ken Thompson's gave for his Turing Award.

[Speech attached]

Thanks, good read.

Nice reply to an award.

25% performance improvement in dictionaries
Now I'm also sad