dlitz

I don't believe rms is seriously in favor of child sexual exploitation, but that's a red herring.

The concern for me is has been the accounts of far more directly-relevant behaviour, such as (iirc):

  * repeated phone calls to someone from different phone numbers

  * leering

  * breaking the ground rules for an event, and justifying it on the basis that he's personally exempt from any rules

  * singling out a teenage girl attending one of his talks (as in "oh wow, a GIRL")

  * single her out again while telling his questionable 'EMACS virgins' joke

  * saying in an interview that he didn't know any women who have contributed to GCC, when there had been at least 4

It all adds up to several accounts of people saying they've left the free software movement (or avoided it entirely) because of his behaviour combined with his stature. As a community leader who supposedly leads by example, he needs to do better, and if he doesn't, the community needs to hold him accountable. That's happening now.

Personally, I think this is a good thing, and I'm glad that he's made the decision to step aside (even if under pressure) rather than fight bitterly and see the community divide along these lines.

It also seems like a good opportunity for him to pass the torch and see what happens, or at least take a long hiatus to get some caring advice and to sort himself out, like Linus did last year. The FSF will eventually need to become an institution that can carry on its mission without him, and this will be a good test of that. If things go off the rails, he can pen another manifesto and I'm sure a bunch of us will read it.

Well, a compromised google.com main page could return malicious search results for certain queries. How many Windows sysadmins install PuTTY by googling "putty", and then installing an executable from whatever site shows up in the first couple of results?...

The important thing is that tags are signed and up-to-date, like how git tags work or how Debian signs its entire repository as a unit (via the Release file) rather than having developers just sign individual packages. Otherwise, even if it's signed, it's subject to downgrade attacks.

Installing known-vulnerable old versions of legitimate software can be just as bad as installing custom malware.

I think yall are using the terminology differently from each other in this thread. "Checksum" historically did not imply resilience against intentional modifications.

Nowadays, it's arguably a best-practice when designing a new protocol or storage format to simply make all checksums cryptographically strong unless there's a reason not to. I think that might be where the confusion is coming from.

Just fix it in the parser. ;)

It'll be great precedent for when Iran, China, Russia, etc. want to do the same thing.

Foreign journalists? Glenn Greenwald and Laura Poitras are both American.

The "auto" in "autopilot" stands for automatic, not autonomous. Autopilot systems have existed for decades, and they've always referred to systems that automate the most tedious parts of operating a vehicle, while still requiring a human operator to handle new/unexpected situations.