<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Mon, Nov 24, 2014 at 12:09 PM, Dave Horsfall <span dir="ltr"><<a href="mailto:dave@horsfall.org" target="_blank">dave@horsfall.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Mon, 24 Nov 2014, Brandon Allbery wrote:<br>
> > <a href="http://prod.lists.apple.com/archives/darwin-kernel/2014/Nov/msg00015.html" target="_blank">http://prod.lists.apple.com/archives/darwin-kernel/2014/Nov/msg00015.html</a><br>
><br>
> Ooh. That's especially fun given that pacemaker checks the mod time on<br>
> ntp.drift... no wonder things get confused. <br>
<br>
</span>And is completely broken, from a computer-forensics point of view; in the<br>
past, I've nailed a few perps by using some of the more obscure flags on<br>
ls(1), such as "c", "u", and "U".</blockquote><div><br></div><div>mmap() and timestamps is hardly a new issue, though; Linux used to have terrible problems with it, I don't know offhand if/how well they fixed them.</div></div><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div>brandon s allbery kf8nh sine nomine associates</div><div><a href="mailto:allbery.b@gmail.com" target="_blank">allbery.b@gmail.com</a> <a href="mailto:ballbery@sinenomine.net" target="_blank">ballbery@sinenomine.net</a></div><div>unix, openafs, kerberos, infrastructure, xmonad <a href="http://sinenomine.net" target="_blank">http://sinenomine.net</a></div></div></div>
</div></div>