httpd: mess with PATH_INFO (again)

2018-01-17 Thread Henrik Friedrichsen
Hello, I am running Flask apps with uWSGI as a middleware, communicating with httpd via FastCGI sockets. Ever since OpenBSD 6.1 I started running into problems with all of my Flask apps. They would get caught in a redirect loop for root paths (see [1]). I did some debugging, and it seems that

Re: Basic SHA3 support (cryptographic discussion)

2018-01-17 Thread Christian Weisgerber
Daniel Loebenberger: > - The construction of SHA3 differs considerably from the SHA2 > constructions > - SHA3's design principles are far better understood than the ones of > SHA2. I hear you, but you are missing the point. > - A possible migration away from SHA2 will be > faster when including

Re: malloc.c: correlation between random choices

2018-01-17 Thread Otto Moerbeek
On Wed, Jan 17, 2018 at 01:59:21PM +, kshe wrote: > Hi, > > In malloc_bytes(), the choice of the chunk_info list to use is > correlated with that of the offset at which the search for a free chunk > begins, because both use the same random source. This is easy to avoid, > for example by

Re: malloc.c: correlation between random choices

2018-01-17 Thread Marc Espie
On Wed, Jan 17, 2018 at 08:52:36AM -0700, Theo de Raadt wrote: > So the attacker has numerous small hurdles. There's a banana on the > road, but there's snare wire above it. Okay, now, I can't stop thinking of a Will.E. Coyote-shaped Theo unboxing his ACME ordered snare wire at xmas...

Re: malloc.c: correlation between random choices

2018-01-17 Thread Theo de Raadt
> On a related note, however, I have some doubts about the usefulness of > this "randomisation rotor". > > First, it currently does not really randomise anything, since on most > architectures the total number of chunks always divides 256, so that > using merely `r' as the random offset instead

Re: elf.h: define SHT_SYMTAB_SHNDX

2018-01-17 Thread Martin Pieuchot
On 16/01/18(Tue) 14:17, Karel Gardas wrote: > [...] > The patch looks good if you are OK with adding values which are no longer in > spec. IMHO I do not see value in those, What if somebody use them in their code? Removing them would break their app for free. That's why I see value in those ;)

Re: [patch] config(8) and KARL usage

2018-01-17 Thread Robert Nagy
On 17/01/18 11:40 +0100, Martin Pieuchot wrote: > Hello Sebastien, > > On 17/01/18(Wed) 10:19, Sebastien Marie wrote: > > [...] > > kernel modification is desirable in some cases, at least for disabling > > ulpt(4) when using cups with USB printer. > > Sorry to hijack your thread, but if

Re: [patch] config(8) and KARL usage

2018-01-17 Thread Martin Pieuchot
Hello Sebastien, On 17/01/18(Wed) 10:19, Sebastien Marie wrote: > [...] > kernel modification is desirable in some cases, at least for disabling > ulpt(4) when using cups with USB printer. Sorry to hijack your thread, but if somebody wants to fix this ulpt(4) problem permanently here's the

[patch] config(8) and KARL usage

2018-01-17 Thread Sebastien Marie
Hi, I would like to know if a patch for supporting kernel modification (using config(8)) along with KARL would be accepted ? Currently, both are incompatibles. kernel modification is desirable in some cases, at least for disabling ulpt(4) when using cups with USB printer. KARL is desirable

Re: Add "-c command" option to script(1)

2018-01-17 Thread Paul de Weerd
ping Anyone? Buehler? :) Paul On Mon, Dec 25, 2017 at 12:23:44PM +0100, Paul de Weerd wrote: | Hi all, | | Sorry to keep harping on this script stuff, but I'd really like to see | this committed. I've just upgraded my laptop while doing some | vlan-bridging debugging and suddenly script(1)