Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-18 Thread Aaron Z
On Tue, Oct 17, 2017 at 10:28 PM, Stijn Tintel wrote: > On 18-10-17 01:40, Aaron Z wrote: >> On Tue, Oct 17, 2017 at 3:24 AM, Felix Fietkau wrote: >>> On 2017-10-17 01:53, Jim Gettys wrote: Will this require a upgrade of the base image, or can we just

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-18 Thread Stijn Tintel
On 18-10-17 14:20, Aaron Z wrote: > On Tue, Oct 17, 2017 at 10:28 PM, Stijn Tintel wrote: >> On 18-10-17 01:40, Aaron Z wrote: >>> On Tue, Oct 17, 2017 at 3:24 AM, Felix Fietkau wrote: On 2017-10-17 01:53, Jim Gettys wrote: > Will this require a

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-18 Thread Jo-Philipp Wich
Hi, > Why would that be? I don't see what the negative effects are if I update > just the hostapd and wpad* packages, other than using up some space, > instead of installing a new image with them included. Or am I missing > something? I think Stijn was referring to the idea of (silently)

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-18 Thread MagicSimon
On 10/18/2017 04:28 AM, Stijn Tintel wrote: > Updating release binaries is very bad practice and should never be done. > Please wait for 17.01.4, which will include the fixes. > Why would that be? I don't see what the negative effects are if I update just the hostapd and wpad* packages, other than

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-17 Thread Stijn Tintel
On 18-10-17 01:40, Aaron Z wrote: > On Tue, Oct 17, 2017 at 3:24 AM, Felix Fietkau wrote: >> On 2017-10-17 01:53, Jim Gettys wrote: >>> Will this require a upgrade of the base image, or can we just upgrade >>> packages? If so, >>> which ones? >>>

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-17 Thread Aaron Z
On Tue, Oct 17, 2017 at 3:24 AM, Felix Fietkau wrote: > On 2017-10-17 01:53, Jim Gettys wrote: > > Will this require a upgrade of the base image, or can we just upgrade > > packages? If so, > > which ones? > > - Jim > Updating wpad(-mini)

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-17 Thread Felix Fietkau
On 2017-10-17 01:53, Jim Gettys wrote: > On Mon, Oct 16, 2017 at 6:41 AM, Stijn Tintel wrote: >> On 16-10-17 13:15, Stijn Tintel wrote: >>> On 16-10-17 13:12, Koen Vandeputte wrote: On 2017-10-16 11:48, Nick Lowe wrote: > Referencing

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-16 Thread Jim Gettys
On Mon, Oct 16, 2017 at 6:41 AM, Stijn Tintel wrote: > On 16-10-17 13:15, Stijn Tintel wrote: >> On 16-10-17 13:12, Koen Vandeputte wrote: >>> >>> On 2017-10-16 11:48, Nick Lowe wrote: Referencing https://www.krackattacks.com/ Patches can be found at:

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-16 Thread Dave Taht
+10 on the rapid response! I lost a lot of sleep over this last night. ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-16 Thread Stijn Tintel
On 16-10-17 13:15, Stijn Tintel wrote: > On 16-10-17 13:12, Koen Vandeputte wrote: >> >> On 2017-10-16 11:48, Nick Lowe wrote: >>> Referencing https://www.krackattacks.com/ >>> >>> Patches can be found at: https://w1.fi/security/2017-1/ and an >>> advisory at http://seclists.org/oss-sec/2017/q4/83

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-16 Thread Felix Fietkau
On 2017-10-16 11:48, Nick Lowe wrote: > Referencing https://www.krackattacks.com/ > > Patches can be found at: https://w1.fi/security/2017-1/ and an > advisory at http://seclists.org/oss-sec/2017/q4/83 > > Patches can also be found committed at https://w1.fi/cgit/hostap/log/ > > I think we need

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-16 Thread Stijn Tintel
On 16-10-17 13:12, Koen Vandeputte wrote: > > > On 2017-10-16 11:48, Nick Lowe wrote: >> Referencing https://www.krackattacks.com/ >> >> Patches can be found at: https://w1.fi/security/2017-1/ and an >> advisory at http://seclists.org/oss-sec/2017/q4/83 >> >> Patches can also be found committed at

Re: [LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-16 Thread Koen Vandeputte
On 2017-10-16 11:48, Nick Lowe wrote: Referencing https://www.krackattacks.com/ Patches can be found at: https://w1.fi/security/2017-1/ and an advisory at http://seclists.org/oss-sec/2017/q4/83 Patches can also be found committed at https://w1.fi/cgit/hostap/log/ I think we need to get

[LEDE-DEV] KRACK (Key Reinstallation Attacks), now patched upstream in hostapd

2017-10-16 Thread Nick Lowe
Referencing https://www.krackattacks.com/ Patches can be found at: https://w1.fi/security/2017-1/ and an advisory at http://seclists.org/oss-sec/2017/q4/83 Patches can also be found committed at https://w1.fi/cgit/hostap/log/ I think we need to get these patches integrated in to LEDE asap, or