shakedown.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A community for live music fans with roots in the jam scene. Shakedown Social is run by a team of volunteers (led by @clifff and @sethadam1) and funded by donations.

Administered by:

Server stats:

257
active users

#dual_ec_drbg

0 posts0 participants0 posts today
Replied in thread

@wchr solcher shice gehört als die verbotene #Stalkerware & #Spyware verboten die es ist.

Allein das Feilbieten jener Lösung sollte strafrechtlich verfolgt werden.

Replied in thread

@TimWardCam @bert_hubert

Also you're overexaggregating cuz if customers of ANY kind would take #ITsec seriously, then participation in programs like #PRISM and integrating #Govware like #DUAL_EC_DRBG would not only be considered #felonies [which they are: it's called #espionage] but be entirely banned from selling their products at all.

c.im/@TimWardCam/1100504731380

C.IMTim Ward ⭐🇪🇺🔶 #FBPE (@TimWardCam@c.im)@kkarhan@mstdn.social @bert_hubert@fosstodon.org The problem is that version 3.x of the open source package, the one you're using, is out of support, and the vulnerability fix is only in 4.x and 5.x. So it obviously makes sense to upgrade to 5.x. But of course the buggers have added lots of new features between 3.x and 5.x, and have had to make breaking changes to accommodate them. So you have to find all the breaking changes, and fix your code, and do a complete set of regression tests, and just to be sure do a complete set of performance tests, in case they've accidentally made your particular old-style use case worse whilst adding their shiny new features ... ... and do it all again in a year or two's time when your customers take objection to the long list of vulnerabilities that's now been found in 5.x ... and of course 5.x is no longer supported, so you have to start all over again... And that's just one of the dozens of open source components you're using. It would be lovely if "manufacturers" could "be obligated to provide long-term support", but open source suppliers can't be *obligated* to do *anything*.