Re: mod_lua in 2.4 CHANGES

2013-06-28 Thread Rainer Jung
On 28.06.2013 03:59, Guenter Knauf wrote: On 28.06.2013 01:03, Rainer Jung wrote: Hi Daniel and/or Günter, can you have a look at the trunk CHANGES file and move the lua items that should now be in 2.4 to the 2.4 CHANGES file? We forgot that when we synced 2.4 with trunk and it would be nice

Diffie-Hellman group parameters 1024 bit and Perfect Forward Secrecy

2013-06-28 Thread Hanno Böck
Hi, There has been lately some attention to perfect forward secrecy in TLS, mainly due to an article on netcraft: http://news.netcraft.com/archives/2013/06/25/ssl-intercepted-today-decrypted-tomorrow.html What worries me is that apache still fixes the DH group size to 1024 bit. If one uses an

Re: Diffie-Hellman group parameters 1024 bit and Perfect Forward Secrecy

2013-06-28 Thread MikeM
Hi, I agree that the configuration of DH parameters should be possible from within Apache. Ideally the configuration should allow the size of random DH Parameters to be chosen and also allow the user to provide a preconfigured DH Parameter file. This patch should be included into 2.2 and

Re: Diffie-Hellman group parameters 1024 bit and Perfect Forward Secrecy

2013-06-28 Thread Rob Stradling
How about making ECDH parameters configurable from within Apache too? On 28/06/13 09:57, MikeM wrote: Hi, I agree that the configuration of DH parameters should be possible from within Apache. Ideally the configuration should allow the size of random DH Parameters to be chosen and also allow

Re: Diffie-Hellman group parameters 1024 bit and Perfect Forward Secrecy

2013-06-28 Thread Erwann ABALEA
It could be done, yes. However, it's slightly less necessary, as right now prime256v1 curve is the default one, and it's a secure one (until Dan Bernstein publishes his paper about NIST curves). On high-volume websites, some may be tempted to switch to prime224v1 if it was possible; it's twice as

Re: Diffie-Hellman group parameters 1024 bit and Perfect Forward Secrecy

2013-06-28 Thread Dr Stephen Henson
On 28/06/2013 10:31, Rob Stradling wrote: How about making ECDH parameters configurable from within Apache too? The current technique of hard coding the ECDH parameters isn't correct but it's the best release versions of OpenSSL can do. The unreleased OpenSSL 1.0.2 can be configured to use

Re: mod_lua in 2.4 CHANGES

2013-06-28 Thread Jim Jagielski
On Jun 28, 2013, at 2:18 AM, Rainer Jung rainer.j...@kippdata.de wrote: On 28.06.2013 03:59, Guenter Knauf wrote: On 28.06.2013 01:03, Rainer Jung wrote: Hi Daniel and/or Günter, can you have a look at the trunk CHANGES file and move the lua items that should now be in 2.4 to the 2.4

[quickpoll] bundle apr-util 1.4.1 or 1.5.2 with httpd 2.2.25?

2013-06-28 Thread William A. Rowe Jr.
Just wanted to know the opinion of some of you who are on email today. [ ] stay at apr-util 1.4.1 (last 1.4 release) [ ] jump up to apr-util 1.5.2 (now that it is more stable)

Re: [quickpoll] bundle apr-util 1.4.1 or 1.5.2 with httpd 2.2.25?

2013-06-28 Thread Ruediger Pluem
William A. Rowe Jr. wrote: Just wanted to know the opinion of some of you who are on email today. [ ] stay at apr-util 1.4.1 (last 1.4 release) [ X ] jump up to apr-util 1.5.2 (now that it is more stable) Regards Rüdiger

Re: [quickpoll] bundle apr-util 1.4.1 or 1.5.2 with httpd 2.2.25?

2013-06-28 Thread Jeff Trawick
On Fri, Jun 28, 2013 at 1:55 PM, William A. Rowe Jr. wr...@rowe-clan.netwrote: Just wanted to know the opinion of some of you who are on email today. [ ] stay at apr-util 1.4.1 (last 1.4 release) [ ] jump up to apr-util 1.5.2 (now that it is more stable) [X] jump up to apr-util 1.5.2 (now

Re: [quickpoll] bundle apr-util 1.4.1 or 1.5.2 with httpd 2.2.25?

2013-06-28 Thread Rainer Jung
On 28.06.2013 19:55, William A. Rowe Jr. wrote: Just wanted to know the opinion of some of you who are on email today. [ ] stay at apr-util 1.4.1 (last 1.4 release) [X] jump up to apr-util 1.5.2 (now that it is more stable) Rainer

[VOTE] Release 2.0.65 [the final frontier]

2013-06-28 Thread William A. Rowe Jr.
Candidates are in http://httpd.apache.org/dev/dist/ +/-1 [ ] Release 2.0.65 as the final 2.0 series package TIA!

[VOTE] Release 2.2.25

2013-06-28 Thread William A. Rowe Jr.
Candidates are in http://httpd.apache.org/dev/dist/ +/-1 [ ] Release 2.2.25 (apr 1.4.8, apr-util 1.5.2) TIA!