Re: Disclosed backdoor in xz releases - FreeBSD not affected

2024-04-11 Thread Cy Schubert
inked against liblsma (because libsystemd requires it). OpenSSH doesn't use liblzma by default. liblzma is a systemd requirement. BTW, Lasse Collin's GH account and the xz repo have been re-enabled. It was pointed out to me at $JOB yesterday that he's been busy repairing xz. Looking at his com

Re: securelevel 1

2023-10-24 Thread Cy Schubert
little challenging as one must keep a lot of information in mind when working with multiple machines. But with logs sent to a single server a person can use software designed to correlate logs. -- Cheers, Cy Schubert FreeBSD UNIX: Web: https://FreeBSD.org NTP: Web: https://nwtime.org e^(i*pi)+1=0 

Re: securelevel 1

2023-10-24 Thread Cy Schubert
when done properly would present similar challenges. -- Cheers, Cy Schubert FreeBSD UNIX: Web: https://FreeBSD.org NTP: Web: https://nwtime.org e^(i*pi)+1=0 In message <663fd243-94ec-40c1-ac66-ca8e3d5f2...@quip.cz>, Miroslav Lachman w

Re: help regarding IP address spoofing (when using nmap)

2023-02-03 Thread Cy Schubert
fine without the source spoofing but doesn't when I use > it. I can however use my own machine's source IP address with > the '-S' option. As you can see from above it worked fine here. Were you running it under root or some other account? Was there something else bound to

Re: FreeBSD Security Advisory FreeBSD-SA-22:15.ping

2022-12-08 Thread Cy Schubert
ave their CEO an account on the OSF/1 machine with the account name of ceo and a password of, you guessed it, ceo. The CEO never logged in once -- as if the CEO would log into some random UNIX box on the raised floor. I was surprised they didn't get broken into more often than the number of times they did. -- Cheers, Cy Schubert FreeBSD UNIX: Web: https://FreeBSD.org NTP: Web: https://nwtime.org e^(i*pi)+1=0

Re: vuxml entry error for krb5

2022-11-17 Thread Cy Schubert
is no longer supported by MIT and is also vulnerable its expiry date has been accelerated to the end of this month. MIT supports only N and N-1. I'm currently considering reducing this from a year to six months when 1.21 is released. > > -GAWollman > > -- Cheers, Cy Schubert Fr

Re: Critical PPP Daemon Flaw

2020-03-09 Thread Cy Schubert
from NetBSD. I haven't looked at what Red Hat has, no comment about theirs. However it would be prudent to verify our pppd isn't also vulnerable. -- Pardon the typos and autocorrect, small keyboard in use. Cy Schubert FreeBSD UNIX: Web: https://www.FreeBSD.org The need of the many outwei

795-bit RSA Factored

2019-12-02 Thread Cy Schubert
To spice up a slow news day. https://lists.gforge.inria.fr/pipermail/cado-nfs-discuss/2019-December/001139.html -- Pardon the typos and autocorrect, small keyboard in use. Cy Schubert FreeBSD UNIX: Web: https://www.FreeBSD.org The need of the many outweighs the greed of the few. Sent

Re: libarchive issue ?

2019-11-12 Thread Cy Schubert
rable to this particular issue ? I think as fix was > > __FBSDID("$FreeBSD: > stable/12/contrib/libarchive/libarchive/archive_read_support_filter_lz4.c > 353375 2019-10-09 22:18:01Z mm $"); > > but just wanted to make sure Parsing the commit log messages, we're beyond 3.4.

Re: Old Stuff

2019-07-24 Thread Cy Schubert
In message , Cy Schubert wr ites: > On July 24, 2019 10:29:12 AM PDT, Luke Crooks wrot > e: > >Clearly you underestimate the technical debt for both hardware and > >software > >technologies, still very much in use today. > > > > > > > >Luke Croo

Re: Old Stuff

2019-07-24 Thread Cy Schubert
>freebsd-security@freebsd.org mailing list >https://lists.freebsd.org/mailman/listinfo/freebsd-security >To unsubscribe, send any mail to >"freebsd-security-unsubscr...@freebsd.org" Ahh, the latest rowhammer attack, rambled. Avoid th

Re: Old Stuff

2019-07-24 Thread Cy Schubert
d-security >>> To unsubscribe, send any mail to " >>> freebsd-security-unsubscr...@freebsd.org" >>> >> >___ >freebsd-security@freebsd.org mailing list >https://lists.freebsd.org/mailman/listinfo/fre

Re: TCP SACK (CVE-2019-5599)

2019-06-18 Thread Cy Schubert
>Cheers, >Hiren They post a workaround patch in their advisory. As RACK is their contribution, I suppose one of their people who are committers might want to commit it. -- Pardon the typos and autocorrect, small keyboard in use. Cheers, Cy Schubert FreeBSD UNIX: Web: http://www.FreeBSD.org

Re: Spoiler Alert

2019-03-06 Thread Cy Schubert
so the hardware vendor is much more free > to change the implementation without maintaining hardware-level (or > even ISA-level) compatibility. And a lot more hardware explicit > fetch/store to different levels of the memory hierarchy. Kind of like the Cray's of old front ended by an I

Re: Spoiler Alert

2019-03-06 Thread Cy Schubert
fun and prof= > it many years ago. > >=20 > > Weird machines are weird. > Not-weird machines are dead-slow :-( Picking a random email in this thread to reply. The problem is that there are so many of these Spectre class of exploits that we collectively roll our eyes. Yet another o

Spoiler Alert

2019-03-05 Thread Cy Schubert
This came over my phone's news feed. Another example that Colin Percival was right when he wrote his paper on exploiting cache for fun and profit many years ago. https://arxiv.org/pdf/1903.00446.pdf -- Pardon the typos and autocorrect, small keyboard in use. Cheers, Cy Schubert FreeBSD UNIX

RE: SQLite vulnerability

2018-12-17 Thread Cy Schubert
Base needs updating. --- Sent using a tiny phone keyboard. Apologies for any typos and autocorrect. Also, this old phone only supports top post. Apologies. Cy Schubert or The need of the many outweighs the greed of the few. --- -Original Message- From: Roger Marquis Sent: 17/12/2018

VMware pulling Intel specter patches

2018-01-16 Thread Cy Schubert
Might we be jumping the gun with updated firmware in devcpu-data? https://www.reddit.com/r/sysadmin/comments/7qjnfx/vmware_pulled_spectre_patches_on_friday/ --- Sent using a tiny phone keyboard. Apologies for any typos and autocorrect. Also, this old phone only supports top post. Apologies. Cy

RE: Intel hardware bug

2018-01-05 Thread Cy Schubert
https://access.redhat.com/security/vulnerabilities/speculativeexecution?sc_cid=701f200tsLNAAY; --- Sent using a tiny phone keyboard. Apologies for any typos and autocorrect. Also, this old phone only supports top post. Apologies. Cy Schubert <cy.schub...@cschubert.com> or <c...@fr

RE: Intel hardware bug

2018-01-05 Thread Cy Schubert
SPARC definitely does out of order execution. --- Sent using a tiny phone keyboard. Apologies for any typos and autocorrect. Also, this old phone only supports top post. Apologies. Cy Schubert <cy.schub...@cschubert.com> or <c...@freebsd.org> The need of the many outweighs the gree

RE: Intel hardware bug

2018-01-05 Thread Cy Schubert
According to a Red Hat announcement, Power and Series z are also vulnerable. --- Sent using a tiny phone keyboard. Apologies for any typos and autocorrect. Also, this old phone only supports top post. Apologies. Cy Schubert <cy.schub...@cschubert.com> or <c...@freebsd.org> The need

Re: http subversion URLs should be discontinued in favor of https URLs

2017-12-15 Thread Cy Schubert
org -> https://svn.freebsd.org. For > > Blimey! You're either very brave, or haven't read the thread fully! :-) This discussion reminds me of some of my clients in which telnet, telnetd, ftp, and ftpd are not installed without departmental SO and CIO approval. -- Cheers, Cy Schubert <cy

RE: http subversion URLs should be discontinued in favor of https URLs

2017-12-06 Thread Cy Schubert
No worries, telnet and ftp are in my sights. --- Sent using a tiny phone keyboard. Apologies for any typos and autocorrect. This old phone only supports top post. Apologies. Cy Schubert <cy.schub...@cschubert.com> or <c...@freebsd.org> The need of the many outweighs the gree

Re: New Security Officer

2017-11-14 Thread Cy Schubert
hers in a timely manner. > > Thank you for all the support and bug reports you've provided over the > years, and please join me in welcoming Gordon to his new role. Hi Xin: Thank you for your dedicated service. Congrats Gordon and thank you for stepping in. --

CVE-2016-5696 - Interesting Read

2016-08-17 Thread Cy Schubert
Hi, Though this is not related to FreeBSD (Linux actually), the URL http://www.cs.ucr.edu/~zhiyunq/pub/sec16_TCP_pure_offpath.pdf is an interesting read. -- Cheers, Cy Schubert <cy.schub...@cschubert.com> FreeBSD UNIX: <c...@freebsd.org> Web: http://www.FreeBSD.org

Re: HEADS UP: Krb5-1.5

2006-07-06 Thread Cy Schubert
In message [EMAIL PROTECTED], Cy Schubert writes: There is an issue with the new Kerberos 1.5. It does not currently support building static libraries. I'm willing to leave the port at 1.4.3 until MIT fixes the static library build. OTOH, if folks want 1.5, without static library support

HEADS UP: Krb5-1.5

2006-07-05 Thread Cy Schubert
to build 1.5 if static libraries are not wanted and build 1.4.3 if they are wanted. Static libraries are not a high priority for the Kerberos project at the moment. -- Cheers, Cy Schubert [EMAIL PROTECTED] FreeBSD UNIX: [EMAIL PROTECTED] Web: http://www.FreeBSD.org

(no subject)

2006-07-05 Thread Cy Schubert
PROTECTED] X-Mailer: exmh version 2.7.2 01/07/2005 with nmh-1.2 From: Cy Schubert [EMAIL PROTECTED] X-os: FreeBSD X-Sender: [EMAIL PROTECTED] X-URL: http://www.komquats.com/ To: freebsd-ports@freebsd.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Wed, 05 Jul 2006 08:39:27 -0700

Re: FreeBSD Security Advisory FreeBSD-SA-06:13.sendmail

2006-03-23 Thread Cy Schubert
: Mon Feb 13 17:36:36 EST 2006 I had no problems building on my 4.11 ports build testbed at home nor any of the 4.11 systems we still have here at work. I did a CVSup though. -- Regards, Phone: (250)387-8437 Cy SchubertFax: (250)387-5231 Team