d
>https://salsa.debian.org/kernel-team/linux/-/merge_requests/502#note_315464
>
>The proposed patch felt probably trough the cracks.
Nod.
--
Steve McIntyre, Cambridge, UK.st...@einval.com
The two hard things in computing:
* naming things
* cache invalidation
* off-by-one errors -- Stig Sandbeck Mathisen
On Mon, Mar 04, 2019 at 04:30:46PM +, Steve McIntyre wrote:
>>
>>3. Upload new version of the shim-signed source package and a
>> (lightly) bodged binary package
>>3a. Use versions:
>> - source: 1.28+nmu2
>> - binary
I've had a reply from Mark (ftpteam) in IRC:
On Sun, Mar 03, 2019 at 11:35:45PM +0000, Steve McIntyre wrote:
...
>So, we're looking at three hacky options options here to work our way
>out of this hole. In (probably?) descending order of hackitude:
>
>1. Ask the ni
shim binary package to pull
in the helper binaries for installation. We are very much
planning on fixing this, but this is the historical setup.
4. As requested, Steve Langasek uploaded a new upstream version of
shim to unstable (15+1533136590.3beb971-2, which is there
ilable
architectures, even if the changes are not useful / relevant for them.
Typically security updates apply to all architectures. In this
case just be glad you got "lucky" - and you don't have to schedule
reboot(s) of all your server(s).
Steve
--
https://steve.fi/
et it permanently (i.e. across reboots).
Take a look at /etc/sysctl.conf, and the comments at the top of that
file pointing to the man-page and other locations.
Steve
--
Git-based DNS hosting
https://dns-api.com/
--
To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org
with a sub
as got to
be "What is your budget?"..
Steve
--
http://www.steve.org.uk/
of the
approach taken for apparmor is that all software *does* continue to work out
of the box. If you found it otherwise, I think you should be filing a bug
report against apparmor.
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer
My guess is libpfhttphook is not vulnerable. I'd like to hear from someone else
tho.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=679280
-Steve
Sent from my phone
On Aug 4, 2012, at 12:31, "Moritz Muehlenhoff" wrote:
> CVE-2012-2807
--
To UNSUBSCRIBE, email to de
, or so I've gathered.
Steve
http://www.braingia.org/
On Tue, Jun 28, 2011 at 01:13:31PM -0300, OLCESE, Marcelo Oscar. wrote:
> Good morning people
> Since I upgraded to BIND 9.7.3 Debian 6, I'm having a lot of logs as
> I've outlined.
>
>error (network unreachab
to the release occurring
during the middle of the preparation and release of the update.
I'm uploading for lenny/old-security now.
Steve
--
Debian GNU/Linux System Administration
http://www.debian-administration.org/
--
To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.or
eed.
I started doing the same thing a few years ago, and it was very
useful.
However to make your reports more thorough it is important to look
at the source of the code to see if the crash is an exploitable one
or not. Ideally you'd include that information in any bug
reports you sub
On Tue Jan 18, 2011 at 13:49:23 +1100, Silvio Cesare wrote:
>lbreakout2 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608980
That could well be a duplicate of CAN-2004-0158, which was fixed
in Woody:
http://lists.debian.org/debian-changes/2004/02/msg00029.html
Steve
--
h
; send out a request for new volunteers soon.
If there were a need for it I'd be happy to make myself available
again for team work.
I don't expect I'm going to suffer from being busy in the way
that I was previously again.
Steve
--
http://www.steve.org.uk/
--
To UNSUBSCRIBE, em
time: 1255005510
> Stored file modification time : 1220829421
You've applied a security update, which has changed
the binary /usr/bin/wget.
The alert is telling you that the binary has changed,
and since this is expected (because you've applied the security update)
the alert is i
eir skills, or develop stronger auditing skills!
I think if there is no such response then it is definitely time to
call it a day and cease pretending we have auditors on hand.
Steve
--
Managed Anti-Spam Service
http://mail-scanning.com/
--
To UNSUBSCRIBE, email to debian-security-req
should not be considered vulnerable
> the same way?
Because su does not attempt to control what commands are being run; if you
can su to another user, you can run arbitrary commands as that user, which
means there's no sense in trying to filter the environment.
--
Steve Langasek
On Mon Oct 06, 2008 at 20:40:36 +0200, Gerfried Fuchs wrote:
> From reading the changelog these issues have all three been addressed
> in the 1.4.19-5 upload which was done a week ago already. Was this
> missed, or are the patches therein considered incomplete?
This was misse
uldn't need to check the auth log for user errors but
> could just trace the login process, crack shadow, write a
> custom pam module or something similar to get your login
> credentials.
No, that's not true. The only added permission the 'adm' group has on
Debi
On Tue Aug 26, 2008 at 20:13:58 +0200, Christoph Auer wrote:
> > Debian Security Advisory DSA-1631-_2_ [EMAIL PROTECTED]
>
> minor error in the subject
My apologises, I managed to miss that.
Steve
--
Managed Anti-Spam Service
http://mail-scanning.com/
--
To
er it I'm not
sure if the problem is the same. On my personal Debian Unstable
machine I'm not seeing any breakage - nor on my Etch system.
It is possible it is soley broken on Lenny, but I don't have any
systems to look at.
I see you've reported a bug, so I guess we'
for any clients attempting to connect to you. This is
especially bad if you have things like rsync over ssh in a cron job.
Moral of the story is to remember to update your known_hosts and let
your users know that their ssh client of choice may bark at them.
Steve
http://www.braingia.org
-
nging
the default ports number will just postpone the moment the attacks will
really start.
>you are smart, you should have known all this.
Just tried to pinpoint an issue.
Best regards
--
Steve
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
of security related issues, I guess this is
totally useless since any (good) port scanner will defeat this without
any problem. Remember, security by obscurity is a bad idea.
--
Steve
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
On Thu Apr 24, 2008 at 14:13:14 -0700, Brad Dondale wrote:
> I have started 2 weeks holidays. If you have any technical support
> requests, please create a ticket with your online ticket system. Thanks!
Please fix your broken auto-responding system.
Steve
--
Debian GNU/Linux
ody else agrees or not.
As has already been hashed out on the debian-www list.
Steve
--
http://www.steve.org.uk/
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
is helpful to make sure
we get mails if it looks like there is no visible progress.)
I hope that doesn't make you feel any worse!
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
This looks normal to me. I believe 'ps' cuts off the USER column after
a certain number of characters. To test, I just added a user
'stevesuehring' to a local Debian etch box and then logged in as that
user. The ps output shows 1002 in the USER column rather than the
On Thu Jan 17, 2008 at 16:35:47 +0100, Philipp Kern wrote:
> Still that breaks because os is not imported. Please fix. Quickly.
Done.
Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject
On Sat Jan 05, 2008 at 15:11:22 +, Steve Kemp wrote:
> -
> Debian Security Advisory DSA-1448-1 [EMAIL PROTECTED]
> http://www.debian.org/security/ Steve Kemp
>
mon/examples).
Steve
--
http://www.steve.org.uk/
pgpiQG2VvWmON.pgp
Description: PGP signature
on using for Sid/Ubuntu.
If there are missing bits then we'll need to reissue the update,
but right now I believed the patch was as complete as it needed
to be.
> Sorry, this mail was originally only addressed to Steve but
> since I also got this mail through the debian-security
ffected by this vulnerability? or has sarge been archived and i
> missed the announcement?
Sarge is affected, but I don't yet have a working patch for that.
There should be an update shortly, but this is pretty low-risk and
it seemed sensible to release now, rather than waiting.
Steve
-
On Tue Nov 27, 2007 at 12:00:05 +1300, Ewen McNeill wrote:
> In message <[EMAIL PROTECTED]>, Steve Kemp writes:
> >Package: samba
> >Vulnerability : several
> >Problem type : remote
> >Debian-specific: no
> >CVE Id(s) : CVE-2007-4572, C
ble to be security-relevant bugs
present in your host(s).
> Do I have to upgrade the version any time a new one is release?
You don't need to. We can't force you. But you should strongly
consider the benefits of running a stable supported version of
Debian which receives sec
On Thu Oct 04, 2007 at 09:49:27 +0200, Etienne Favey wrote:
> In what respect is the quagga problem related to the openssl problem,
> that it gets the same DSA ID number?
It was a mistake, the number was reused by accident.
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
On Fri Sep 21, 2007 at 19:18:38 +0300, Riku Valli wrote:
> fetchmailconf have similar problem too.
That should be fixed now. I'm just going to send out the mail ...
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
27;t
> and there aren't any i386 binary packages for it available.
Noah has kindly volunteered to build complete packages for i386,
so I'd expect this situation to be resolved in the next few hours.
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of &q
On Fri Sep 21, 2007 at 11:45:37 -0400, Noah Meyerhans wrote:
> Check i386. The security archive does not seem to have a complete set
> of i386 binary packages...
Stupid buildds ..
I'll find a spare i386 machine and build for that over the weekend
all being well.
Steve
-
On Fri Sep 21, 2007 at 17:06:32 +0200, Georg Mainik wrote:
> there are missing dependencies for this new version of kdebase. People
> running
> cron-apt with authomatic installation will get KDE completely removed!
>
> I already wrote to Steve Kemp. Who else should be infor
I'm being dense the kdebase package provides all the
correct versions to satisfy itself:
eg.
kappfinder_3.5.5a.dfsg.1-6etch1_amd64.deb
kate_3.5.5a.dfsg.1-6etch1_amd64.deb
(Same thing for fetchmail/fetchmailconf.)
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED
didn't need to.
I'll check for the future to make sure that I only claim to
provide those archs which have built.
>
Steve
--
pgpcjuOKwUjAG.pgp
Description: PGP signature
k and is a bug which should be fixed
with an update.
I've checked the build-logs I've got access to (all except i386) and
they seem fine. is it just i386 you see this behavior upon?
Do other people see this too, or is it a potentially broken system
you're installing upon (I have
sources lists you have would only receive new updates for
point releases of Etch.
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
fact that the security team made this statement means they
were aware 1.4.6-2 was a candidate for inclusion in etch.
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
[EMAIL PROTECTED]
ack of
all of them can be difficult; especially if we don't know about it
in advance.)
Steve
--
signature.asc
Description: Digital signature
omate this task a little more?
cfengine.
I'm interested in puppet, but it wasn't (isn't yet?) stable at
the time I started automation on a decent sized farm.
Steve
--
Debian GNU/Linux System Administration
http://www.debian-administration.org/
signature.asc
Description: Digital signature
nsport agent, could be tricked
> > [...]
>
> Funny, bias in errata reports.
All DSA notices have a description like that. These descriptions
come from the package itself.
eg:
[EMAIL PROTECTED]:~$ apt-cache show sendmail | grep Desc
Description: powerful, efficient, and scalable Mail Transpor
st.
> How can I "decrypt" the known_hosts file?
You can't decrypt them, but you can delete all entries for a given
host with:
ssh-keygen -R host.name
See the manpage for ssh-keygen for details. (Search for "hash" to
see the relevent options.)
Steve
--
Debi
On Fri, Jun 30, 2006 at 10:33:55AM +0200, martin f krafft wrote:
> also sprach Steve Kemp <[EMAIL PROTECTED]> [2006.06.30.1004 +0200]:
> > This is a known issue, relating to some of the infrastructure
> > changes. Hopefully it will be resolved shortly.
>
> Thanks
> following signatures were invalid: BADSIG 010908312D230C5F Debian
> Archive Automatic Signing Key (2006) <[EMAIL PROTECTED]>
This is a known issue, relating to some of the infrastructure
changes. Hopefully it will be resolved shortly.
Currently each of the release files are e
> other way to create a log for all commands run on a system?
Use the 'snoopy' package, as described here:
http://www.debian-administration.org/articles/88
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
there is a lot of demand, it
may be possible to continue supporting it for a little longer.
Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit
signature.asc
Description: Digital signature
help in some situations, but blocking 'wget', 'perl'
etc in requests via mod_security is a much more useful thing to
do.
Steve
--
Debian GNU/Linux System Administration
http://www.debian-administration.org/
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
problem will be fixed shortly - new packages are
already in the queue.
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
the sense that you may receive a .tar file
from a remote source.
Steve
--
Debian GNU/Linux System Administration
http://www.debian-administration.org/
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
On Thu, Mar 02, 2006 at 10:36:16PM +0100, Marc Haber wrote:
> How would you implement the automatism to trigger the update on the
> incoming e-mail?
procmail, matching on new mails to the debian-security-announce
mailing list ..
Steve
--
Debian GNU/Linux System Administratio
fixed.
Steve
--
Debian GNU/Linux System Administration
http://www.debian-administration.org/
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Thanks for that. Obvious once you said it too!
I've revoked the obsolete email addresses and uploaded again now.
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
e keyserver at debian.org:
After removing some identities:
[EMAIL PROTECTED]:~$ gpg --list-key CD4C0D9D
pub 1024D/CD4C0D9D 2002-05-29
uid Steve Kemp <[EMAIL PROTECTED]>
uid Steve Kemp <[EMAIL PROTECTED]>
uid Steve Kemp <[
#x27;sargeN' to the string, but for
some reason I've updated the minor too.
Definitely something I'll be careful to avoid in the future.
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
e package migration, so it
is only sid users who are at risk; and we don't offer explicit
security support there. (Though obviously it should be fixed ASAP.)
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Le Mercredi, 21 Décembre 2005 12.40, Johannes Wiedersich a écrit :
> steve wrote:
> > Le Mardi, 20 Décembre 2005 16.18, Michelle Konzack a écrit :
> >>But in ALL Internet Cafes I can use my own (selfmade) Debian Live-System
> >>with my prefered Desktop. In all Internet
you have to give
an ID (they do a photocopy of it; she couldn't tell me how long they keep
it..) to be able to use a computer in an Internet Café (terrorism you
know...).
Sorry ;-)
> Greetings
> Michelle
Have a nice day
--
steve
jabber : [EMAIL PROTECTED]
cess to port 22 from externally so
that the internal-use daemon can't be accessed.
Hope that helps. I'm sure others will have ideas too.
Steve
On Thu, Nov 24, 2005 at 10:14:11PM -0800, Patrick wrote:
> I have an server running sshd on Sarge. I want all users to be able to
> acce
n some badly formed input HTML.
They were not treated as security bugs which suprised me at
the time.
Steve
--
signature.asc
Description: Digital signature
> This feature is disabled in Debian package by default so I doubt if this is
> serious problem. I'd like to ask if I should prepare the new package for
> sarge or not?
I think an upload would be justified.
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject
ies come
into play with more members. Not to mention waiting for other vendors,
upstream etc, is not something that will be helped by more members).
Steve
--
signature.asc
Description: Digital signature
that you can do when reporting problems is:
a) Be detailed.
b) Ideally have a patch, or a pointer to one.
c) Be patient.
d) Don't file reports which are already in the BTS.
e) Be patient.
f) Be patient.
All reports are read and responded to *in
005/dsa-860
http://www.us.debian.org/security/2005/dsa-862
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Hi,
Just a quick note to point people at this news annoucement:
http://lists.debian.org/debian-news/debian-news-2005/msg00047.html
Steve
--
signature.asc
Description: Digital signature
ed
A DSA is pending, and should be available shortly.
Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
On Mon, Sep 19, 2005 at 09:18:29PM +0200, No?l K?the wrote:
> anybody knows what's the problem with klecker/security.d.o?
http://lists.debian.org/debian-curiosa/2005/09/msg00018.html
There is an advisory pending ...
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED
On Wed, Sep 14, 2005 at 10:51:19AM +0200, Mathieu JANIN wrote:
> I was updating my system at that time, but klecker.debian.org is not in my
> sources (or perharps with an other name).
klecker.debian.org is security.debian.org, which might explain it?
Steve
--
--
To UNSUBSCRIBE, em
Florian Weimer wrote:
> * Steve Wray:
>
>
>>>>I view this as a security problem because what if you *think* you've
>>>>made changes to your firewall and are now protected only... you arn't
>>>>and the firewall hasn't been updated?
>
Florian Weimer wrote:
> * Steve Wray:
>
>
>>Another example is fwbuilder which *silently* fails to overwrite its
>>generated script at compile time if the user doesn't have write
>>permissions on the existing script.
>
>
> Most bugs in security tools a
Florian Weimer wrote:
> * Michael Stone:
>
>
>>Contact the security team. Describe the bug in such a way that the
>>security team understands its severity and impact. It is not sufficient
>>to say "just trust me and issue an advisory". From what I've seen so far
>>this is not the obvious buffer o
On Mon, Aug 29, 2005 at 11:46:24AM -0500, Branden Robinson / Debian Project
Leader wrote:
> As far as I know, the stable/oldstable security team was never (recently)
> down to Joey S. alone. Mike Stone and Steve Kemp have been active members
> for some time (Steve was, as I unde
interest in supply patches which
*only* fix security holes to distributors. Their line is more
"upgrade to the newest version". Whilst the new versions do
fix the holes, they traditionally also break things built against
them, such as extensions, galeon, etc.
Which is why we
(). Also look for weird signs in /tmp.
Both of these attacks could be prevented by the use of mod_security,
which I'd recommend you look into using in the future if you have
potentially untrusted scripts running.
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
re/aide/checksumming
installation in place you can use that to detect binary modifications
by booting from a known-good media.
If not your best option is to try to determine what route the attacker
used to get in, make sure you're comfortable you can close it, and then
reinstall.
Steve
e
> with both these packages can describe some of the pros and cons of
> each?
Simple introduction to both aide, and integrit:
http://www.debian-administration.org/articles/49
It doesn't mention tripwire, which is a shame. But I'll try to
update it later.
Steve
--
# The
s a more important bug.
Still even less popular tools are supported, all packages should
receive updates eventually.
Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Hallo,
Ik ben op vakantie tot 20 juli.
Voor support vragen kunt u contact opnemen met onze supportdesk.
Voor sales en andere vragen kunt u mailen naar [EMAIL PROTECTED]
Met vriendelijke groet,
Steve Karnadi
Hello,
I am on vacation until the 20th of July.
You can contact our supportdesk
; And where do I find this key?
gpg --keyserver some.key.server --recv-keys 07DC563D1F41B907
(For keyservers I use:
keyring.debian.org
pgp.mit.edu
pgpkeys.pgp.net
wwwkeys.uk.pgp.net
or wwwkeys.pgp.net )
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with
be well.
> Is this a bug or how do I solve this problem?
Not a bug with the *Debian* archive, but a missing key on your
side from the look of things..
Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Hallo,
Ik ben op vakantie tot 20 juli.
Voor support vragen kunt u contact opnemen met onze supportdesk.
Voor sales en andere vragen kunt u mailen naar [EMAIL PROTECTED]
Met vriendelijke groet,
Steve Karnadi
Hello,
I am on vacation until the 20th of July.
You can contact our supportdesk
's an additional complication
which doesn't gain you much.
(Sure if you had a trojan which phoned home, or tried to compromise
other hosts .. it would help. But .. in general it less useful than
it appears).
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
I wrote a small introduction to how it works,
none of it is suprising, and none of it is sensitive in any
way that I can see:
http://people.debian.org/~skx/team.html
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
urrently seeing isn't that the job is
hard, but that only a very small number of people have the
authority/ability to push the update out.
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
is what I've tried
to do - whether that is the intended job of a secretary is largely
irrelevent.
Other jobs like answering mails from people who say "Help my
server is hacked" seem more "secreatrial" in nature, so I've tried
to answer those as time and det
0:0A:E6:F6:A3:F4
If it's a remote host then you cannot
Steve
--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
SAs since then,
though they may have done uploads that haven't yet been published (I
wouldn't know, not having access to look on klecker).
--
Steve Langasek
postmodern programmer
signature.asc
Description: Digital signature
On Fri, Jun 03, 2005 at 08:19:22AM +0200, Martin Schulze wrote:
> Steve Langasek wrote:
> > On Wed, Jun 01, 2005 at 07:16:00PM -0700, Ian Eure wrote:
> > > On Wednesday 01 June 2005 04:54 pm, Hilko Bengen wrote:
> > > > Just a few hours ago, the Drupal project
ase team...
He did contact the release team; unfortunately, the diff between 4.5.2 and
4.5.3 is rather large and I don't believe it's all security-related, so I
think this will have to be left for the security team after all.
Thanks,
--
Steve Langasek
postmodern programmer
signature.asc
Description: Digital signature
g addressed by
the version currently in unstable.
Thanks,
--
Steve Langasek
postmodern programmer
signature.asc
Description: Digital signature
I've had good luck with nullmailer for just this situation. It's simple
and lightweight, works well in chroot.
Steve
===
= Home Page: http://www.br
est you look at mod-security,
you can find it in Sarge.
The homepage has lots of documentation, and it includes chroot
functionality:
http://www.modsecurity.org/
There's a brief introduction here:
http://www.debian-administration.org/?article=65
Steve
--
--
To UNS
On Wed, Mar 09, 2005 at 08:05:40PM +0100, David Schmitt wrote:
> On Wednesday 09 March 2005 19:13, Steve Kemp wrote:
> > A simple script I wrote did that for me already - although there are
> > some fixups required as we seem to have a few different spellings
> > for
the simple output here along with input and output.
http://people.debian.org/~skx/2005/
I'd be interested in average advisories per week, as well as
classification on the actual output. (Seems like buffer overflows
are still the biggest reported thing for this year - although you've
done a
1 - 100 of 388 matches
Mail list logo
