Brief items

Some day, perhaps, if the universe is less than maximally cruel, we'll have the option of server-class RISC-V systems with fully-documented, formally-verified designs. But that day is not yet here.

So far as I can tell, about the only thing that seems to correlate with being less likely to have side-channel attacks is less sophisticated scheduling pipelines and processor architecture (read: simpler, slower processors). And this area of security research is changing very rapidly. I would expect several more novel attacks to surface.

Processors that don't have a bunch of non-free, unauditable bullshit as a proprietary control plane would obviously be better, but you'd be paying a prohibitive performance price (not to mention other issues). There just aren't any good options right now. Buy (or accept donations of) whatever makes sense for other reasons, and expect there to be mandatory microcode updates, kernel and virtualization workarounds, and security bugs.

For the longest time, the distributed nature of email was what made it possible for Linux development to remain truly decentralized, but email in 2019 is radically different from email in 2009. Running an independent email server that reliably sends and receives email is becoming more and more difficult now that most of email traffic goes through 5-6 major companies -- you must do SPF, DKIM, ARC/DMARC, TLS, and who knows what next, just to be reliably accepted by Gmail (maybe). And even if someone uses one of those major email providers doesn't mean the patches won't end up in someone's spam folder, show up a week late, or arrive mangled.

It's a real problem for the project that we don't have a better way of allocating resources, and it hampers us in some ways compared to, say, Ubuntu or Red Hat, where there is a single, stable funding stream to maintain the distribution and set firm priorities. There are some things we don't do as well as those distributions because of it. But, for instance, while I know a lot of people volunteer work for Ubuntu, I personally have very little desire to do anything with Ubuntu because people get paid to do that. Particularly now that my free time is rarer and more precious to me, doing unpaid work for an organization that also has paid staff is hugely demotivating. It's entirely plausible that paying for resources would mean that Debian would end up with *less* resources than we have now, if other volunteers feel the same way.