Bug#765632: ForwardX11Trusted set to yes over a decade ago, for release reasons?

2015-08-19 Thread Colin Watson
On Sun, Feb 22, 2015 at 10:31:08PM +, Philip Hands wrote: It seems to me it needs something along the lines of this near the -X and -Y options' documentation: ***WARNING*** -Y option is basically irrelevant as the result of Debian shipping a modified binary that treats -X

Bug#765632: ForwardX11Trusted set to yes over a decade ago, for release reasons?

2015-08-19 Thread Russ Allbery
Colin Watson cjwat...@debian.org writes: I tried some experiments with ForwardX11Trusted=no today, and frankly, it doesn't even pass the laugh test for usability. Run xterm and try to select something, bam, your xterm crashes with BadAccess. Now, sure, that's telling me that the X SECURITY

Bug#765632: ForwardX11Trusted set to yes over a decade ago, for release reasons?

2015-08-19 Thread Colin Watson
On Wed, Aug 19, 2015 at 11:51:36PM +0200, Christoph Anton Mitterer wrote: On Wed, 2015-08-19 at 20:59 +0100, Colin Watson wrote: Run xterm and try to select something, bam, your xterm crashes with BadAccess. Which means that people would typically note quite quickly that they need to open

Bug#785190: new upstream (6.8p1)

2015-08-19 Thread Colin Watson
On Wed, Aug 12, 2015 at 11:56:06AM +0200, Daniel Baumann wrote: retitle 785190 new upstream (7.0p1) thank we're at 7.0 now Indeed we are. Apologies for slacking on this: my main problem was rebasing the GSSAPI key exchange patch, since some code it depends on changed quite a bit in 6.8p1

Bug#793616: marked as done (openssh: CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices)

2015-08-19 Thread Colin Watson
On Fri, Aug 07, 2015 at 11:30:07AM +, Debian Bug Tracking System wrote: openssh (1:5.5p1-6+squeeze6) squeeze-lts; urgency=medium . * Non-maintainer upload by the Debian LTS team. * CVE-2015-5352: Reject X11 connections after hard-coded Xauth cookie expiration time of 1200

Bug#765632: ForwardX11Trusted set to yes over a decade ago, for release reasons?

2015-08-19 Thread Josselin Mouette
Le mercredi 19 août 2015 à 20:59 +0100, Colin Watson a écrit : debian-devel, debian-x, do you think that it's at all realistic to expect clients to be fixed to handle such failures rather more gracefully? Well, I guess it is possible, if we were to introduce appropriate error checking in