Poul-Henning Kamp

Author of Vinyl-Cache (The FOSS project formerly known as Varnish-Cache), a lot of FreeBSD and various other stuff.

Homepage: https://phk.freebsd.dk/
FreeBSD home: https://people.freebsd.org/~phk
Vinyl Cache: https://vinyl-cache.org

Public Key

npub132nkgsmv5dh3jh8tj93szhs6u88d84k97v3g5xj8a9ycy6waq7wsen34zs

NIP-05 Address

bsdphk_at_fosstodon.org@momostr.pink

Profile Code

nprofile1qqsg4fmygdk2xmcetn4ezccptcdwrnkn6mzlxg52rfr7jjvzd8ws08gprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt68mj43

Publishing to

relay.momostr.pink

Author Public Key

npub132nkgsmv5dh3jh8tj93szhs6u88d84k97v3g5xj8a9ycy6waq7wsen34zs

Show more details

Last Notes

2026-05-19 14:41:46 UTC

- reply

A lot of "security researchers" would be sad that they couldn't pad their resumes with more CVE numbers ?

2026-05-19 09:08:21 UTC

Damn, Peter Salus is also dead 😠
(Source TUHS)
If you have not read his "Casting the Net" and "Quater Centry of UNIX" books, you should.
Rest in peace Peter!

2026-04-17 11:14:58 UTC

If you program, you should read this piece.
"Ada's successes — the aircraft that have not crashed, the railway signalling systems that have not failed, the missile guidance software that has not misguided — are invisible precisely because they are successes. The languages that failed visibly, in buffer overflows and null pointer exceptions and data races and security vulnerabilities, generated the discourse. [Ada did not]"
https://www.iqiipi.com/the-quiet-colossus.html

2025-12-20 20:54:31 UTC

- reply

Løsningen er et eller andet kompromis, der tillader retssystemet at gøre sit arbejde, men stadig gør det muligt at bruge kryptering til alle de ting vi har brug for.
Præcis hvordan det kompromis kommer til at se ud, er en politisk process og det jeg prøve at banke ind i hovedet på IT branchen, er at de konsekvent korslagte arme er en garanti for ingen indflydelse og at der ikke existerer nogen "absolut menneskeret" til kryptering (eller noget andet).

2025-12-20 05:31:13 UTC

- reply

Så du forventer at alle andre i hele verden bare lægger sig om på ryggen og siger "skidt, vi havde alligevel ikke brug for straffeloven og domstolene" bare fordi nogen har opfundet kryptering ?
(Overvej evt: Våbenloven, Kemikalieloven, Trafikloven)
Lovgiverne vil med garanti lovgive om retten til kryptering - samfundet har brug for både kryptering og straffeloven.
Det eneste åbne spørgsmål er hvem der kommer med konstruktivt input og hvem der lægger armene over kors.

2025-12-18 06:56:11 UTC

- reply

"Jeg bruger kryptering" ikke er og må aldrig blive et "straffeloven gælder ikke for mig" kort.
Derfor kan der per definition ikke være en absolut ret til at bruge ubrydelig kryptering. (ligesom der heller ikke er nogen andre absolutte menneskerettigheder !)
Omvendt skal kriminelle selvfølgelig ikke kunne bryde vores (og dette "vores" omfatter både myndighederne, virksomhederne og borgerne) kryptering.
Derfor bliver resultatet, per definition et kompromis. 1/2

2025-12-15 07:48:10 UTC

- reply

Pierre,
Du kan læse hvad jeg mener om lovforslaget her:
https://www.version2.dk/holdning/lovsikret-enshitification
(Jeg vil generelt anbefale, at du overlader det til mig at udtrykke mine holdninger, for du rammer så langt ved siden af at det er decideret pinligt at høre på...)

2025-11-18 12:43:59 UTC

It's almost as if putting all your eggs in one basket is a bad idea ?

2025-10-27 11:51:14 UTC

How to tell that somebody was not competent enough for the job they held:
https://www.theregister.com/2025/10/27/jen_easterly_ai_cybersecurity/

2025-06-08 10:19:08 UTC

Dont use DNS over HTTPS:
https://www.bsdhowto.ch/doh.html
Couldn't agree more.

2025-05-30 06:31:00 UTC

This is probably the worst piece of news I have read this entire year:
https://thenextwavefutures.wordpress.com/2025/05/20/limits-to-growth-was-right-about-overshoot-and-collapse-new-data/

2025-05-29 18:24:39 UTC

- reply

In that trade it is not uncommon to use a unique product name for each customer, so that leaks about one customer does not implikate other customers.

2025-04-16 08:20:01 UTC

I understand why the "security industry" which feeds of the CVE register is upset about it's potential demise.
But let's face it: MITRE's CVE register was a prototype, built in a world where there were (only!) 231 known security vulnerabilities in total.
We have learned a lot from that prototype.
It has shown us how big the problem is, that the IT-industry will not and can not solve the problem, and how to accidentally create fertile ground for organized crime with good intentions.
1/2

2025-03-18 14:48:48 UTC

- reply

Jeg synes du skal holde dig til at udtrykke dine egne meninger og lade mig om at udtrykke mine.
(Mest fordi du gør det ufatteligt dårligt.)

2025-01-15 16:47:14 UTC

This website asks what happened in 1971, showing a lot of graphs:
https://wtfhappenedin1971.com/
The answer is: Rich people started treating other people as things and focused only on money.

2025-01-10 09:38:58 UTC

Your periodic reminder that #microsoft is not a competent or serious company:
https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/
(@npub1cm0…enqe is remarkably restrained in the quoted responses. I would have gone off the rails, but do not need to, because we decided on day one that #varnishcache would not run on Windows).
If you think that is not bad enough, read the Cyber Safety Review Board's report about the Microsoft Exchange clowncar:
https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf

2024-12-17 14:40:21 UTC

- reply

And speaking of intelligent use of money:
The smartest thing Denmark could do for the climate, is a high-speed rail from Ringsted to Århus and from Helsingør til Ringsted, with a new H-H tunnel built by Sweden.
That would reduce road-traffic a LOT.

2024-12-17 14:26:53 UTC

- reply

So what are we going to do the next three decades while we wait to tind out IF SMR's become a realistic option ?

2024-12-17 14:20:09 UTC

- reply

So you are suddenly 'green' enough to spend tax-money on climate ?
Cool!
But why nuclear, when there are so many better investments ?

2024-12-17 14:18:04 UTC

- reply

But that number hides a couple of important "details"
When nuclear trips offline, you loose a GW in one go, so you need to have some version of N+1 backup power running to cope with that.
In a big well connected grid, you can do that with a handful of nuclear reactors, all running around 90% so that if one drops, the rest can gear up.
Now, try that with the flimsy & tiny danish grid ?

2024-12-17 14:15:13 UTC

- reply

Why should our energy system be built for tax money in the shape of "interest free loans", loans which will be outstanding for decades before the first electron leaves the site, when independent actors want to invest in sun, wind and batteries with their own money, right now ?
If any private actor wants to invest in nuclear, let them, but I see no reason to involve any tax-money ?

2024-10-16 14:55:01 UTC

- reply

What surprises me is that there has been virtually /no/ coverage of this anywhere, even though it has been hurling down the EU-rails for two years.
I have not even spotted one single attempt at astroturfing by any of the big companies.
But friends in BXL tell me that the political will behind this one is so impressive that the lobbyists have all but given up.
Still: Surprised.

2024-10-16 14:48:36 UTC

- reply

I expect it will be uphill to argue that millions or even billions in turnover is "not commercial activity" ?
Heck, I'm not even sure my one-man company will be able to claim that exemption ?
But if I make a living from FOSS, that's fair, isn't it ?

2024-10-16 14:45:06 UTC

- reply

And yes, I'm they guy who has been calling for product liability on software for more than a decade, so even though EU didn't adopt my suggestion, I'm cutting notch in my keyboard for winning this one.
https://queue.acm.org/detail.cfm?id=2030258

2024-10-16 14:17:45 UTC

I'm amazed that there has been zero coverage of this:
EU's new Product Liability Directive got voted through last thursday.
No later than two years from now, software, stand-alone, cloud or embedded are subject to "no-fault liability" (ie: doesn't matter how or why, only that it is defective.)
Here's the directive:
https://data.consilium.europa.eu/doc/document/PE-7-2024-INIT/en/pdf
Gentlemen, start your panic…
PS: Yes, there is a FOSS exemption, but only "outside commercial activity". (Ie: The guy in Nebraska but not RedHat)

2024-08-31 16:07:12 UTC

- reply

»All that just goes away with Rust. Poof. Gone.«
In 40+ years of kernel-coding, all the silver bullets I have seen shot, melted before they hit anything of significance.
(I /might/ take a claim like that seriously, if it came directly from Brian or Ken.)