Re: [fossil-users] Misleading report that clone finished

2015-01-11 Thread Kelly Dean
Andy Bradford wrote: This explanation seems to fit the facts, but reproducing it is a pain. Let me see if I can cause what I've just stated above to happen. Just ask your ISP or network administrator to lower your quality of service, or try using wifi while a large number of microwave ovens

Re: [fossil-users] Misleading report that clone finished

2015-01-11 Thread Andy Bradford
Thus said Stephan Beal on Mon, 12 Jan 2015 02:06:30 +0100: Seems i can only set high and low priority, but some boxes may allow more details setup. I can set up all kind of QoS on my firewall, but most devices don't allow one to request random and routine packet loss and

Re: [fossil-users] Misleading report that clone finished

2015-01-11 Thread Andy Bradford
Thus said Kelly Dean on Sun, 11 Jan 2015 21:37:12 +: Just ask your ISP or network administrator to lower your quality of service, or try using wifi while a large number of microwave ovens are operating nearby. Wifi with a microwave would have been much easier than what I was doing! I

Re: [fossil-users] two questions abut git import

2015-01-11 Thread Roy Marples
On Monday 29 Dec 2014 06:30:58 Richard Hipp wrote: Unfortunately, there is no way to do this for every check-in all at once. You would have to go through and create separate tags for each check-in. There is probably a way to script this. But it would be better to change the names in git prior

Re: [fossil-users] Fossil appears vulnerable to transaction replay attack

2015-01-11 Thread Baruch Burstein
On Mon, Jan 12, 2015 at 7:50 AM, Kelly Dean ke...@prtime.org wrote: I haven't tried this, or looked at the code. I'm just going by the description at: https://www.fossil-scm.org/index.html/doc/tip/www/password.wiki In the ‟Sync Protocol Authentication” section, it calls the sha1 hash of the

[fossil-users] Fossil appears vulnerable to transaction replay attack

2015-01-11 Thread Kelly Dean
I haven't tried this, or looked at the code. I'm just going by the description at: https://www.fossil-scm.org/index.html/doc/tip/www/password.wiki In the ‟Sync Protocol Authentication” section, it calls the sha1 hash of the request content a ‟nonce”. But that isn't a nonce; if the client were