Package: irssi-plugin-otr
Version: 0.2-1
Severity: normal
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I just tried out irssi-plugin-otr for the first time. Very nice. I'm
a little concerned about the behavior when using the plugin on
multiple networks, though, given that i've seen irssi itself crash in
the past. In particular, i'm worried about the possibility of irssi
completely destroying the OTR private keystore.
Here's what i observed:
* on first network where i tried to use OTR, there was a long lag
during key generation (this is expected).
* when the key was finally created, it populated ~/.irssi/otr/otr.key
with the raw key material. (the ~/.irssi/otr directory should
probably be created with mode 0700, btw).
* When i tried to connect to a new network and to use OTR there, a
new genkey operation started.
* while this new genkey operation is underway, ~/.irssi/otr/otr.key
is truncated to 0 length.
* when the genkey completes, both keys get written back to
~/.irssi/otr/otr.key
If irssi crashes during this (lengthy) window, or if there's a power
failure, or whatever, it looks like all the previous private key
material will be destroyed permanently. Since these are potentially
important credentials, it seems like it would be better for the OTR
plugin to modify the keyfile only *after* it completes the keygen.
And ideally, the operation would be an atomic one (create a new file,
and mv it into place?), to eliminate the window of possible failure.
Thanks for packaging this useful tool for debian!
Regards,
--dkg
- -- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (500, 'testing'), (200, 'unstable'), (101, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.26-1-686 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages irssi-plugin-otr depends on:
ii irssi 0.8.12-4 terminal based IRC client
ii libc6 2.7-13 GNU C Library: Shared libraries
ii libglib2.0-0 2.16.4-2 The GLib library of C routines
ii libotr2 3.2.0-1 Off-the-Record Messaging library
irssi-plugin-otr recommends no packages.
irssi-plugin-otr suggests no packages.
- -- no debconf information
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iQIVAwUBSMbIHszS7ZTSFznpAQJnkA//dt2tfO9ZlZAfp/udNEfHiYb15mK/DuJ2
Y18QDdDsuUuF0T/fxGdXq8iglOJTyYqdNj4Xcxa+lRwRe+TccZpJ9bv3fvooWxXs
vJxn3uOUhGPAOGRncYq/pxbO/e9BUvRM6XBHyeAXK0Op/G4qnvWb3QgMG7YfhqZX
ryChhoSeUPBMRKsNSCx7X7vkSRxg+Ha4YwtkM8YiAsK8sIb38pJb/+NxpnP+tZLG
R6ckhkPNVUoFNdVR+i4DWpl8v9y8Xr2y66UdKyshUuh6JrekZdBBNx5DwrJqF4Gq
KLcLfHubRLq4FyrHzh33+0CYxM/OXPkkgFuCwAysM0pgkglbGCFexSMR4/korju3
HV6PC9JaTPTIfmLYWUZEEjcn9s7aFQeR3/ib/z3WUPRGwtiMdJER4XcLV1+gMlZk
56aLgAuspWFDDJ0OfxUEosJqmTYZ2ClavB2Hw8VUIflR9q0wPbInrg8Vi73DJ4iS
CqH+sHTvkRB6WYDV/qNgw37VmHyOp6LR9RKSrZXX1jXKdvQJc9skOG/4J+ubK+5b
GXz7OO3SJ2pWE+tlyR4wMXaiYmFuYFImdGHtcFtCVarv2JPqcoCn3EvTb2NTeQkD
1eqmX3FKeInBc3mOUkMkcKVQrnKPUYiqjz8+UkCWe+xnVzwalbojaIJf7DpiqWFG
JSL1bhutg7Y=
=Um7m
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
