Re: OpenBSD Foundation 2014 Fundraising Campaign.

2014-04-11 Thread nobody
Hi all, - 1) If I search for openbsdfoundation on: - Facebook - Twitter - Youtube - Instagram - Flickr - Slideshare - etc.. I get ZERO results regarding the topic. We are writing 2014. The people are on social sites.. More could be reached if these mentioned sites

Re: OpenSSH hole, April 9

2014-04-11 Thread Sascha Mester
There is no really good reason why security-relating problems should be a secret - acceptable reasons for this behaviour never existed. The most harmful behaviour I have ever seen since I browse the web.

Re: OpenSSH hole, April 9

2014-04-11 Thread Craig R. Skinner
On 2014-04-11 Fri 08:58 AM |, Bob Beck wrote: sponsors having privileged access to the information (in other words they aren't donors, they are paying for early access.) Benefits with strings attached are not donations, ... more like bribes. Respect for freedom fighting and staying open!

Re: OpenSSH hole, April 9

2014-04-11 Thread Theo de Raadt
There is no really good reason why security-relating problems should be a secret - acceptable reasons for this behaviour never existed. Then you should work very very hard to go find the bugs and publish them. The most harmful behaviour I have ever seen since I browse the web. The nastiest

Re: OpenSSH hole, April 9

2014-04-11 Thread Sascha Mester
Exactly as I said - no real good reasons. Security through Obscurity is a reason for me for never trying out the related Operating System - so I have a reason to never install a *BSD ;)

Re: OpenSSH hole, April 9

2014-04-11 Thread Bob Beck
Wonderful - so why are you on this mailing list. Go troll somewhere else. On Fri, Apr 11, 2014 at 12:21 PM, Sascha Mester sascha.mes...@gmx.de wrote: Exactly as I said - no real good reasons. Security through Obscurity is a reason for me for never trying out the related Operating System - so I

Re: rs, jot: missing headers

2014-04-11 Thread Ralph Siegler
On Thu, 10 Apr 2014 21:55:13 -0700, Philip Guenther wrote: On Thu, Apr 10, 2014 at 7:14 PM, Ralph Siegler rsieg...@rsiegler.org wrote: On Thu, 14 Nov 2013 23:17:24 -0500, Eitan Adler wrote: I was looking through some OpenBSD code and noticed that rs and jot are both missing #include unistd.h

Re: rs, jot: missing headers

2014-04-11 Thread Andres Perera
On Fri, Apr 11, 2014 at 7:02 PM, Ralph Siegler rsieg...@rsiegler.org wrote: On Thu, 10 Apr 2014 21:55:13 -0700, Philip Guenther wrote: On Thu, Apr 10, 2014 at 7:14 PM, Ralph Siegler rsieg...@rsiegler.org wrote: On Thu, 14 Nov 2013 23:17:24 -0500, Eitan Adler wrote: I was looking through some

Re: relayd SSL/TLS keep RSA private keys in separate process

2014-04-11 Thread Reyk Floeter
On Wed, Apr 09, 2014 at 04:20:23PM +0200, Reyk Floeter wrote: relayd uses privsep to mitigate the risk of potential attacks. OpenSSL's SSL code wasn't designed with privsep in mind. We already have a hack to load the keys and certificates in the parent process and to send them via imsg to the

Re: relayd SSL/TLS keep RSA private keys in separate process

2014-04-11 Thread Bob Beck
On Fri, Apr 11, 2014 at 6:09 PM, Reyk Floeter r...@openbsd.org wrote: I did some testing with apache bench (ab) and it shows a negative performance impact when running with multiple preforked relays and concurrent requests. But this is expected because all processes have to wait for the

Re: rs, jot: missing headers

2014-04-11 Thread Ralph Siegler
On Fri, 11 Apr 2014 19:27:03 -0430, Andres Perera wrote: On Fri, Apr 11, 2014 at 7:02 PM, Ralph Siegler rsieg...@rsiegler.org wrote: On Thu, 10 Apr 2014 21:55:13 -0700, Philip Guenther wrote: On Thu, Apr 10, 2014 at 7:14 PM, Ralph Siegler rsieg...@rsiegler.org wrote: On Thu, 14 Nov 2013

Re: rs, jot: missing headers

2014-04-11 Thread Andres Perera
On Fri, Apr 11, 2014 at 10:27 PM, Ralph Siegler rsieg...@rsiegler.org wrote: On Fri, 11 Apr 2014 19:27:03 -0430, Andres Perera wrote: On Fri, Apr 11, 2014 at 7:02 PM, Ralph Siegler rsieg...@rsiegler.org wrote: On Thu, 10 Apr 2014 21:55:13 -0700, Philip Guenther wrote: On Thu, Apr 10, 2014

Re: rs, jot: missing headers

2014-04-11 Thread Ralph Siegler
Well, starting with r1.54 [0], stdlib.h never declares getopt(). However, I think the conversation could continue in spite of that. I would expect motivation to be aggregated cost in the form: * a significant amount of patched ports; * a significant amount of affected port prospects;

Re: rs, jot: missing headers

2014-04-11 Thread Philip Guenther
On Sat, 12 Apr 2014, Ralph Siegler wrote: Well, starting with r1.54 [0], stdlib.h never declares getopt(). However, I think the conversation could continue in spite of that. I would expect motivation to be aggregated cost in the form: * a significant amount of patched ports; * a

Re: rs, jot: missing headers

2014-04-11 Thread Philip Guenther
On Fri, 11 Apr 2014, Ralph Siegler wrote: Well Philip, had we mentioned any POSIX 2008.1 certified or compliant OS in this thread that would be an interesting point to bring up. But neither GNU/Linux, OpenBSD, nor FreeBSD is fully compliant. On the other hand, Mac OSX Mavericks is 100%