@miekg I get a statically linked "hello world" build when I run `RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --target x86_64-unknown-linux-gnu` but as soon as I pull in a crate dependency that dynamically links to a native library (e.g. openssl-sys), I necessarily end up with a dynamically linked binary.
Check your `cargo tree` output for "-sys" crate dependencies I guess?
@davidgerard
> For comparison, ProShares’ SPXT, which indexes the S&P minus all the tech stocks, is up about 40% in the past three years.
hmm check out the top 5 holdings of that fund, though
@adulau Oh, I remember when these mitigations came out. I believe this is the original paper: https://web.archive.org/web/20030708082653/http://www.remote.org/jochen/sec/hfpa/hfpa.pdf
The general problem is text based protocols that could be spoofed well enough by the HTTP request generated by something like an HTML form submission that it could be confused for that protocol. So like sending spam to an SMTP server or sending abusive messages to an IRC channel or something.
Modern SMTP servers will have defenses against these kinds of attacks, for instance delaying the server's initial 220 banner and detecting clients that speak before the 220 is sent, or detecting SMTP clients that are sending a sequence of commands before waiting for the server's response, etc.