Re: [d-security] Re: DSA-134-1

2002-06-27 Thread Phillip Hofmeister
On Thu, Jun 27, 2002 at 09:12:41AM +0100, Tim Haynes wrote: > I'm trying not to think how many Debian policies have been bent because of > "oh no! it's ssh!"-factor - porting a protocol-2-enabled *new feature* down > to Stable with the resultant paragraphs on `create a proto-2 keypair' and > `these

Re: [d-security] Re: DSA-134-1

2002-06-27 Thread Tim Haynes
Wichert Akkerman <[EMAIL PROTECTED]> writes: > Previously Christian Hammers wrote: > > > Don't be too hard to him, if he'd pointed out that only default BSD is > > vulnerable it would not have been too hard to find the exploit before > > everybody had updated. > > He could have mentioned ssh prot

Re: [d-security] Re: DSA-134-1

2002-06-27 Thread Wichert Akkerman
Previously Christian Hammers wrote: > Don't be too hard to him, if he'd pointed out that only default BSD is > vulnerable it would not have been too hard to find the exploit before > everybody had updated. He could have mentioned ssh protocol 1 wasn't vulnerable.. Wichert. -- _

Re: [d-security] Re: DSA-134-1

2002-06-26 Thread Christian Hammers
On Wed, Jun 26, 2002 at 07:23:49PM +0200, Florian Weimer wrote: > Well, it appears if OpenSSH 1.2.3 was *not* vulnerable, so the whole > exercise was rather pointless. But drill inspector Theo ("update and don't ask questions, soldier!"), showed at least how good our new security upload architectu