symtos

"GCA, a 501(c)3, was founded in September 2015 by the Manhattan District Attorney’s Office, the City of London Police and the Center for Internet Security."

Last time I explored the atrocious state of language-specific package managers, Maven Central was (and I'm guessing still is) the only language repo that requires that packages are signed [1][2].

Now, whether package signatures are verified on retrieval is another question... (they are not, unless you use a plugin such as pgpverify-maven-plugin [3]).

Obviously anybody with the private key can still introduce malicious code even if you verify your package signatures, but at least it's better than allowing any oppressive regime with a root CA trusted by Mozilla/Microsoft to MITM rust/python/npm/ruby/whatever packages downloaded by its residents.

> There is a gray area between hardware and software that contains firmware that can be upgraded or replaced, but is not meant ever to be upgraded or replaced once the product is sold.

As for OpenBSD and Linux without grsec/pax, one can bypass NX (whether the CPU has the NX-bit or not) by marking the region with the shellcode as executable, eg:

mprotect(shellcode & -pagesize, len, PROT_EXEC);

((void()()) shellcode)();

in an exploit this could be accomplished by ROPing

> FreeBSD lacks basic low-level exploit mitigation, such as Address Space Layout Randomization (ASLR)

the whitepaper you linked was published in 2014 by Shawn Webb, one of the people behind the hardenedbsd fork. that same year a submission for review was opened on phabricator[1] re. merging their aslr work in mainline fbsd.

it was closed on 2015-10-19:

> Closing this revision. FreeBSD is free to pull from HardenedBSD.

another aslr review request was then created on 2016-03-10 by Konstantin Belousov[2]:

> This revision needs review, but there are no reviewers specified.

that same day he sent a call for testing to freebsd-arch[3].

there is also a bugzilla ticket[4] for the people waiting for freebsd to catch up with 2001.