Re: letsencrypt && https && openbsd.org = https://www.openbsd.org/

2015-12-11 Thread Thijs van Dijk
On 11 December 2015 at 14:16, Tati Chevron wrote: > But even if PKI were actively on fire at the moment (which it is not), >> what's wrong with doing both? >> > > Basically the gain verses the effort and resources expended. > > I agree that there is a value in distributing keys and source code in

Re: letsencrypt && https && openbsd.org = https://www.openbsd.org/

2015-12-11 Thread Thijs van Dijk
On 11 December 2015 at 13:51, Tati Chevron wrote: > ...and intercept the package being delivered to you? > > Yes, it's possible, but somebody who had the resources to go to that > extreme, and a motive to single you out as a target, would presumably > have other ways to invade your privacy and in

Re: letsencrypt && https && openbsd.org = https://www.openbsd.org/

2015-12-11 Thread Thijs van Dijk
On 11 December 2015 at 13:17, Tati Chevron wrote: > Would you really trust HTTPS more than a physical CD being mailed to > you??? Yes. Both provide some level of accountability, however with PKI you explicitly trust a limited (though big) numer of third parties to do their job properly, and in

Re: letsencrypt && https && openbsd.org = https://www.openbsd.org/

2015-12-11 Thread Thijs van Dijk
On 11 December 2015 at 13:10, Tati Chevron wrote: > In either case, I'd be willing to put my money where my mouth is. >> Whom do I contact about running a site mirror? >> > > Why would we trust your mirror? Touché.

Re: letsencrypt && https && openbsd.org = https://www.openbsd.org/

2015-12-11 Thread Thijs van Dijk
On 11 December 2015 at 12:28, Stefan Sperling wrote: > I would consider signify keys printed on CDs and copied across several > web sites safer than trusting the hundreds of CA certs shipped with a > standard web browser. On 11 December 2015 at 12:35, Tati Chevron wrote: > The official CD set

Re: letsencrypt && https && openbsd.org = https://www.openbsd.org/

2015-12-11 Thread Thijs van Dijk
On 11 December 2015 at 05:51, Andy Bradford wrote: > If one wants privacy on a website then more is required than just HTTPS. > Right. *I* just want a reasonable (256-bit) guarantee that the signify keys on my screen are the ones the OpenBSD authors intended me to see. I currently just assume t

Re: NFS umount stuck on client machine

2015-09-10 Thread Thijs van Dijk
In linux, umount has the -l option: Lazy unmount. Detach the filesystem from the filesystem hierarchy now, and > cleanup all references to the filesystem as soon as it is not busy anymore. > (Requires kernel 2.4.11 or later.) I've used this flag (in conjunction with -f) for this exact situation,