Re: Why is portmap installed by default?

2006-08-20 Thread Jim Popovitch
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 kevin bailey wrote: > Why is portmap installed by default on a vanilla basic Debian Sarge install? Because someone thinks that *every* Debian uses NFS. Granted, it's not worth going back to change Sarge's installer, however if Sid or Etch have this s

Re: GPG errors from apt update

2006-09-01 Thread Jim Popovitch
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Robert Dobbs wrote: > I'm surprised more people haven't reported these problems. Maybe they > were ignored because they did resemble the older problem with the > signing key so closely. I do recall seeing something similar to what you describe, but i

kernel.panic (was: Re: DD machine mysterious reboot)

2006-10-29 Thread Jim Popovitch
On Sun, 2006-10-29 at 23:54 +0100, martin f krafft wrote: > Do you set kernel.panic in /etc/sysctl.conf? I'm curious, what does that do? Tia, -Jim P. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: ProFTPD still vulnerable (Sarge)

2006-11-30 Thread Jim Popovitch
On Thu, 2006-11-30 at 15:10 +0100, Francesco P. Lovergine wrote: > This is unfortunately an effect of an issue with the old mod_delay patch. > It's not an exploiting of the known issue. You have to either disable > mod_delay or use > 1.2.10-20sarge1 which is available at > http://people.debian.o

Re: ProFTPD still vulnerable (Sarge)

2006-12-06 Thread Jim Popovitch
On Thu, 2006-11-30 at 12:28 -0500, Jim Popovitch wrote: > On Thu, 2006-11-30 at 15:10 +0100, Francesco P. Lovergine wrote: > > This is unfortunately an effect of an issue with the old mod_delay patch. > > It's not an exploiting of the known issue. You have to either disable

Re: ProFTPD still vulnerable (Sarge)

2007-01-07 Thread Jim Popovitch
On Thu, 2006-12-07 at 10:26 +0100, Francesco P. Lovergine wrote: > On Wed, Dec 06, 2006 at 09:21:34PM -0500, Jim Popovitch wrote: > > On Thu, 2006-11-30 at 12:28 -0500, Jim Popovitch wrote: > > > On Thu, 2006-11-30 at 15:10 +0100, Francesco P. Lovergine wrote: > > >

Re: tripwire's default policy

2007-03-04 Thread Jim Popovitch
On Sun, 2007-03-04 at 21:56 -0300, Felipe Figueiredo wrote: > Hello all, > > tripwire's default policy includes /proc. Why, what's the point? At least in > my systems, its files change more often than my logs rotate (which despite my > efforts insist on rotating on a daily basis). > > So, is i

Re: Security Debian Questions

2007-04-21 Thread Jim Popovitch
On Fri, 2007-04-20 at 20:30 -0500, George P Boutwell wrote: > I don't remember the exact details, but the problem I think revolved > around not being able to properly boot-up since the /tmp and/or the > /var/tmp where needed during the boot, but not being mounted yet. Actually in order for /tm

Re: Undelivered Mail Returned to Sender

2007-04-22 Thread Jim Popovitch
On Mon, 2007-04-23 at 00:42 +0200, David Martínez Moreno wrote: > This is getting slightly annoying... > > This time murphy.debian.org said NO to relaying. > > Best regards, Even worse... murphy is still passing on spam. The latest one I got has a received header of:

Re: Security Debian Questions

2007-04-23 Thread Jim Popovitch
On Mon, 2007-04-23 at 19:15 +1100, Russell Coker wrote: > On Sunday 22 April 2007 01:58, Jim Popovitch <[EMAIL PROTECTED]> wrote: > > On Fri, 2007-04-20 at 20:30 -0500, George P Boutwell wrote: > > > I don't remember the exact details, but the problem I think revolve

Re: security mirror out of date: 128.101.240.212

2007-05-14 Thread Jim Popovitch
On Tue, 2007-05-15 at 00:14 +0300, Tomas Nykung wrote: > What I don't understand is why I always got the bad mirror, regardless > how many times I tried to rerun aptitude/apt-get update both yesterday > and today (and on two computers while the first one I upgraded did get > the upgrade without any

Re: PERSONAL LOAN - KTA

2007-06-02 Thread Jim Popovitch
On Sat, 2007-06-02 at 11:23 -0400, Roberto C. Sánchez wrote: > In any case, I really would be interested in hearing from people who > have managed to get a spam filtering setup going that allows only a > 0.66% false negative rate. I think you will have better success discussing that over on SPAM-L

Re: PERSONAL LOAN - KTA

2007-06-02 Thread Jim Popovitch
On Sun, 2007-06-03 at 03:41 +, Pascal Hakim wrote: > The spam email you're complaining about was sent by a subscriber. Does > that mean it's not spam? No, it still is spam. It's not requested by any other list members. The solution is to auto-mod new subscribers. Do that and all this mess e

where'd security.debian.org go?

2007-06-13 Thread Jim Popovitch
What's up with security.debian.org? Apt is missing it. ;-) -Jim P. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: where'd security.debian.org go?

2007-06-13 Thread Jim Popovitch
On Thu, 2007-06-14 at 00:32 -0400, Jim Popovitch wrote: > What's up with security.debian.org? Apt is missing it. ;-) Of course, as soon as I send the email disregard previous email, apologies. -Jim P. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of &quo

Re: kernel-image-2.6.8-4-386 (2.6.8-16sarge7)

2007-06-15 Thread Jim Popovitch
On Fri, 2007-06-15 at 18:08 +0200, Willi Mann wrote: > Hi! > > Since yesterday, a new kernel for sarge seems to be available. However, > the kernel-image meta package 101sarge2 was only available yesterday. > Today, it's no longer available. > > What has happened here? Something strange is certa

Re: [SECURITY] [DSA 1304-1] New Linux kernel 2.6.8 packages fix several vulnerabilities

2007-06-16 Thread Jim Popovitch
On Sat, 2007-06-16 at 10:26 -0700, Thomas Bushnell BSG wrote: > This release was quite confusing, because it applies only to sarge, I'm still not seeing this release on security.debian.org using deb http://security.debian.org/ sarge/updates main Any ideas why? -Jim P. -- To UNSUBSC

Re: [SECURITY] [DSA 1304-1] New Linux kernel 2.6.8 packages fix several vulnerabilities

2007-06-17 Thread Jim Popovitch
On Sun, 2007-06-17 at 03:43 -0600, dann frazier wrote: > On Sat, Jun 16, 2007 at 03:49:16PM -0400, Jim Popovitch wrote: > > On Sat, 2007-06-16 at 10:26 -0700, Thomas Bushnell BSG wrote: > > > This release was quite confusing, because it applies only to sarge, > > >

Re: security idea - bootable CD to check your system

2007-06-24 Thread Jim Popovitch
On Sun, 2007-06-24 at 16:50 +0100, andy baxter wrote: > The difference is that: > > a) These all run on the live system they are trying to protect, Unless you configure them to only write to an offline mount point that is normally ro and only rw through external effort which is in Tripwire's

On Distro to rule them all (was: secure installation)

2007-08-16 Thread Jim Popovitch
Why not add 3 deb packages (deb-user, deb-workstation, deb-server) and prompt the user during install for which "style" box they are setting up. Then the selected package could have (or not have) necessary dependencies for the system "style". For instance, deb-user could depend on lokkit as well

Re: [SECURITY] [DSA 1435-1] New clamav packages fix several vulnerabilities

2007-12-19 Thread Jim Popovitch
On Thu, 2007-12-20 at 01:12 +, Stephen Gran wrote: > This one time, at band camp, Dominic Hargreaves said: > > > > Are there any updates planned for sarge in volatile.debian.org? > > Yes, and they're uploaded. Where? -Jim P. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of

Re: [SECURITY] [DSA 1435-1] New clamav packages fix several vulnerabilities

2007-12-20 Thread Jim Popovitch
On Thu, 2007-12-20 at 20:07 +, J. Santos wrote: > So, i would like to thank all those who toke the time to clarify this > matter. > Thank you all. I would also like to add my Thanks to everyone involved. Thank you, -Jim P. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "u

new updates, no recent DSAs.... Hmmmm

2007-12-27 Thread Jim Popovitch
I've got one etch box complaining, for 18 hours now, about new pending updates. Specifically: apache2-mpm-worker apache2-utils apache2.2-common debconf debconf-i18n findutils klibc-utils libc6 libc6-i686 libkli

Re: new updates, no recent DSAs.... Hmmmm

2007-12-27 Thread Jim Popovitch
On Thu, 2007-12-27 at 22:42 +, Alexander Wirt wrote: > Yes :-) > http://www.us.debian.org/News/2007/20071227 Actually I didn't miss that, or rather I did get that email today but in the past I seem to recall the process was individual DSAs and releases, followed by a bundled new release

Re: new updates, no recent DSAs.... Hmmmm

2007-12-27 Thread Jim Popovitch
On Thu, 2007-12-27 at 17:55 -0500, Jim Popovitch wrote: > On Thu, 2007-12-27 at 22:42 +, Alexander Wirt wrote: > > Yes > > :-) > > > http://www.us.debian.org/News/2007/20071227 > > Actually I didn't miss that, or rather I did get that email today >

Re: [SECURITY] [DSA 1438-1] New tar packages fix several vulnerabilities

2007-12-28 Thread Jim Popovitch
On Fri, 2007-12-28 at 22:36 +0100, Martin Zobel-Helas wrote: > On Fri Dec 28, 2007 at 22:10:08 +0100, Wolfgang Jeltsch wrote: > > However, I cannot see any security announcement for most of these. Were > > they > > updated because of the security fix for tar? If yes, why doesn’t the > > securi

Re: www.juniorguide.com

2007-12-31 Thread Jim Popovitch
On Mon, 2007-12-31 at 16:38 -0500, Pls check this new site wrote: > Please see this site in Subject SO... is someone at d.o doing something constructive about all these The risk is that d.o might eventually start getting blocked elsewhere. For instance, if I people telling gmail/yahoo/aol/eli

Re: help

2008-02-15 Thread Jim Popovitch
On Tue, Feb 12, 2008 at 6:10 PM, Robert Shadowen <[EMAIL PROTECTED]> wrote: > help > > == > Robert Shadowen > Simulation/Verification Tools [EMAIL PROTECTED] > IBM Austin

Recent updates

2008-02-16 Thread Jim Popovitch
I haven't seen any other news about this, I show 7 pending updates for which no DSA or notices have gone out. Given that d.o servers have been hacked in the past, are these updates valid and where can I find official info about them? apache2-mpm-worker: Installed: 2.2.3-4+etch3 Candidate: 2.2

Re: Recent updates

2008-02-17 Thread Jim Popovitch
On Feb 17, 2008 8:18 AM, Alexander Schmehl <[EMAIL PROTECTED]> wrote: > http://lists.debian.org/debian-announce/debian-announce-2008/msg0.html One additional thing that is not clear to me is that I see pending updates for libc6 and libc6-dev that are NOT mentioned in that announcement. -Jim P

Re: Recent updates

2008-02-17 Thread Jim Popovitch
On Feb 17, 2008 8:18 AM, Alexander Schmehl <[EMAIL PROTECTED]> wrote: > * Jim Popovitch <[EMAIL PROTECTED]> [080217 06:46]: > > I haven't seen any other news about this, I show 7 pending updates for > > which no DSA or notices have gone out. Given that d.o servers

Re: Recent updates

2008-02-17 Thread Jim Popovitch
On Feb 17, 2008 3:17 PM, Noah Meyerhans <[EMAIL PROTECTED]> wrote: >glibc Fix sunrpc memory leak Ahhh, glibc and libc6 are the same thing. I forgot about that. (why is that?) Thx, -Jim P. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Tr

Re: Recent updates

2008-02-17 Thread Jim Popovitch
On Feb 17, 2008 3:48 PM, Alexander Schmehl <[EMAIL PROTECTED]> wrote: > Yes, as the last couple of announcement did. The problem is, that if we > announce a new release before it is send to the mirrors, mirrors are hit > very hard hindering the sync of our mirror network. > > So in general we firs

Re: Is oldstable security support duration something to be proud of?

2008-03-10 Thread Jim Popovitch
On Mon, Mar 10, 2008 at 2:36 PM, Filipus Klutiero <[EMAIL PROTECTED]> wrote: > This statement is in a security announcement. Martin Schulze confirmed that > he > wrote the statement. Does the security team think that oldstable security > support duration is something to be proud of? Yes. This

Re: Is oldstable security support duration something to be proud of?

2008-03-10 Thread Jim Popovitch
On Mon, Mar 10, 2008 at 3:01 PM, Filipus Klutiero <[EMAIL PROTECTED]> wrote: > Le March 10, 2008 02:57:56 pm Jim Popovitch, vous avez écrit : > > > On Mon, Mar 10, 2008 at 2:36 PM, Filipus Klutiero <[EMAIL PROTECTED]> wrote: > > > This statement is in a secu

Re: Is oldstable security support duration something to be proud of?

2008-03-10 Thread Jim Popovitch
On Mon, Mar 10, 2008 at 4:14 PM, Filipus Klutiero <[EMAIL PROTECTED]> wrote: > Le March 10, 2008 03:15:04 pm Jim Popovitch, vous avez écrit : > > > On Mon, Mar 10, 2008 at 3:01 PM, Filipus Klutiero <[EMAIL PROTECTED]> wrote: > > > Le March 10, 2008 02:57:56

Re: Is oldstable security support duration something to be proud of?

2008-03-10 Thread Jim Popovitch
On Mon, Mar 10, 2008 at 4:13 PM, Filipus Klutiero <[EMAIL PROTECTED]> wrote: > Debian is somewhat better than openSUSE, equal or slightly worst than Ubuntu > and definitely worst than RHEL and derivatives. So on average, Debian is > somewhat worst than its main alternatives in this aspect. On w

Re: openssh remote upgrade procedure?

2008-05-20 Thread Jim Popovitch
On Tue, May 20, 2008 at 6:38 PM, Kim N. Lesmer <[EMAIL PROTECTED]> wrote: > On Tue, 20 May 2008 20:45:20 +0100 > "Alexandros Papadopoulos" <[EMAIL PROTECTED]> wrote: > >> 3. Testing to see if you can still get on to a server is exactly what >> I would have done, if my connection had not been killed

Re: clamav.* package versions (etch)

2008-05-29 Thread Jim Popovitch
NOTE: adding debian-security to the mix... On Thu, May 29, 2008 at 6:04 PM, Mike Dornberger <[EMAIL PROTECTED]> wrote: > maybe there are build issues. If you count the binary versions, you'll see > there are 7 archs on which e. g. clamav-daemon 0.93 got built, but 10 for > 0.92-something. Perhaps

Microsoft-IIS/6.0 serves up Debian... WTF!

2008-06-07 Thread Jim Popovitch
Well, I thought I had seen it all... but this takes the cake. http://ike.egr.msu.edu/debian/pool/ -Jim P. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Microsoft-IIS/6.0 serves up Debian... WTF!

2008-06-07 Thread Jim Popovitch
On Sun, Jun 8, 2008 at 2:05 AM, <[EMAIL PROTECTED]> wrote: > this is weird. but, somehow it is hard to believe. it is possible to change > the identification string to anything right? maybe it is apache but trying > to be IIS??? That would be nice if true... but I seriously doubt that to be the c

Re: Microsoft-IIS/6.0 serves up Debian... WTF!

2008-06-08 Thread Jim Popovitch
On Sun, Jun 8, 2008 at 12:30 PM, Bernd Eckenfels <[EMAIL PROTECTED]> wrote: > In article <[EMAIL PROTECTED]> you wrote: >> It's mirror's like that, that make me paranoid about Debian Security. > > Why is that? IIS is the second most used web server on the market. And since > mirrors are not a trust

Re: Microsoft-IIS/6.0 serves up Debian... WTF!

2008-06-08 Thread Jim Popovitch
On Sun, Jun 8, 2008 at 7:02 AM, Nico Golde <[EMAIL PROTECTED]> wrote: > Yep this is lighttpd and it's mod_status. OK (if true), I still question the need for posing as IIS, and therefore I question the mirror operator's intent/reasons/capabilities/interests/ as well as security capabilites.

Re: Microsoft-IIS/6.0 serves up Debian... WTF!

2008-06-08 Thread Jim Popovitch
On Sun, Jun 8, 2008 at 5:30 PM, Simon Valiquette <[EMAIL PROTECTED]> wrote: > Jim Popovitch un jour écrivit: >> >> If they want to do this, fine. But should they continue to be in >> rotation for ftp.us.debian.org? > > Personnaly, I would have chosen to imperson

Re: Microsoft-IIS/6.0 serves up Debian... WTF!

2008-06-08 Thread Jim Popovitch
On Sun, Jun 8, 2008 at 7:00 PM, Jacob Appelbaum <[EMAIL PROTECTED]> wrote: > Your thoughts on this subject are really fascinating. Because while I > agree that the idea of "security by obscurity" as the only line of > defense is flawed, you're making assumptions and value judgments that > seem beyo

Re: Find installed contrib and non-free packages

2008-06-12 Thread Jim Popovitch
On Thu, Jun 12, 2008 at 11:23 AM, Martin Bartenberger <[EMAIL PROTECTED]> wrote: > Thanks a lot guys, I like all of your suggestions (the "virtual RMS" made me > laugh, never heard of this before). > Seems like TIMTOWTDI, reminds me of PERL ;-) > > I will play around with all of them and find out w

Re: Find installed contrib and non-free packages

2008-06-12 Thread Jim Popovitch
On Thu, Jun 12, 2008 at 4:06 PM, W. Martin Borgert <[EMAIL PROTECTED]> wrote: > On Thu, Jun 12, 2008 at 11:38:33AM +0200, Filip Husak wrote: >> I think the following command resolves your problem: >> >> for pkg in `dpkg -l | grep ii | awk '{print $2}'` ; do if [ `apt-cache >> show $pkg | grep 'cont

Re: Find installed contrib and non-free packages

2008-06-12 Thread Jim Popovitch
On Thu, Jun 12, 2008 at 5:58 PM, Jim Popovitch <[EMAIL PROTECTED]> wrote: > grep -v '^Filename: pool\/main\/' will get everything not in main, > which is the OP's intention, IIRC. Just to be clear, this cmd shows me all pkgs not in main: for pkg in `dpkg -l | grep

Re: Study: Attacks on package managers (inclusing apt)

2008-07-17 Thread Jim Popovitch
On Thu, Jul 17, 2008 at 3:43 PM, Goswin von Brederlow <[EMAIL PROTECTED]> wrote: > The simple solution would be to create a Timestamp.gpg file that is > signed daily (as oppsoed to Release.gpg being signed only on updates) > and have apt-get warn if it gets old. But as long as Release.gpg/Timestam

Re: [SECURITY] [DSA 1615-1] New xulrunner packages fix several vulnerabilities

2008-07-23 Thread Jim Popovitch
On Wed, Jul 23, 2008 at 7:36 PM, Michael Gilbert <[EMAIL PROTECTED]> wrote: > wouldn't it be better to send this person a warning? i'm sure it was > just an honest mistake. it seems rather harsh to purge them from the > mailing list without giving them a fair chance to remedy their > mistake. Ho

17 updates for Etch?!?!

2008-07-26 Thread Jim Popovitch
Ok, this is the weekend for DNS strangeness... so my suspicions are easily raised by the following: ~$ apt-get update .. ~$ apt-get upgrade Reading package lists... Done Building dependency tree... Done The following packages will be upgraded: apache2-mpm-worker apache2-utils apache2.2-commo

Re: Misunderstanding about normal (stable) and security channels

2008-07-28 Thread Jim Popovitch
On Mon, Jul 28, 2008 at 12:19 PM, Riku Valli <[EMAIL PROTECTED]> wrote: > May be debsecan is suitable for you? Hold crap Batman! That's a lot of "low urgency" issues open in Etch. -Jim P. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PR

Re: harbian-audit v0.2 for Debian "Stretch" 9 is released

2018-12-26 Thread Jim Popovitch
On Wed, 2018-12-26 at 23:57 +0800, Samson wrote: > https://github.com/hardenedlinux/harbian-audit/blob/master/docs/CIS_De > bian_Linux_8_Benchmark_v1.0.0.pdf I'm curious, Does CIS know that you are distributing their published work? -Jim P.

Re: harbian-audit v0.2 for Debian "Stretch" 9 is released

2018-12-26 Thread Jim Popovitch
On Thu, 2018-12-27 at 09:32 +0800, Shawn wrote: > Hi Jim, > > On Thu, Dec 27, 2018 at 1:06 AM Jim Popovitch wrote: > > > > On Wed, 2018-12-26 at 23:57 +0800, Samson wrote: > > > https://github.com/hardenedlinux/harbian-audit/blob/master/docs/CI > > > S_De

RE: Peace is not off topic

2003-03-10 Thread Jim Popovitch
Can we bring some peace to this list? Please? -Jim P.

RE: Peace is not off topic

2003-03-10 Thread Jim Popovitch
> -Original Message- > From: Steve Hagerman [mailto:[EMAIL PROTECTED] > Sent: Monday, March 10, 2003 10:43 PM > > These people and their treasonist attitudes make me wish > that our nation would Enforce the laws against treason. Right now I would settle for the Debian.org admins to enforce

execute permissions in /tmp

2003-07-12 Thread Jim Popovitch
I have a complaint/opinion/statement to express. It seems that every now and then when I run 'apt-get upgrade' i get a lot of errors about "Can't exec "/tmp/config.x": Permission denied at...". I like to keep my Debian boxen nice and secure, so I 'chmod +t /tmp' to prevent temp files from bei

RE: execute permissions in /tmp

2003-07-12 Thread Jim Popovitch
nal Message- > From: Noah L. Meyerhans [mailto:[EMAIL PROTECTED] Behalf Of Noah L. > Meyerhans > Sent: Saturday, 12 July, 2003 21:34 > To: debian-security@lists.debian.org > Subject: Re: execute permissions in /tmp > > > On Sat, Jul 12, 2003 at 09:22:45PM -0400, Jim Po

RE: execute permissions in /tmp

2003-07-13 Thread Jim Popovitch
> -Original Message- > From: Matt Zimmerman > Sent: Sunday, 13 July, 2003 23:56 > > If the user can read files in /tmp, they can execute the code in > them. What problem is noexec /tmp supposed to solve? Microsoft did a related thing a few years ago, they moved the TEMP directory to the u

RE: Peace is not off topic

2003-03-10 Thread Jim Popovitch
Can we bring some peace to this list? Please? -Jim P. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

RE: Peace is not off topic

2003-03-10 Thread Jim Popovitch
> -Original Message- > From: Steve Hagerman [mailto:[EMAIL PROTECTED] > Sent: Monday, March 10, 2003 10:43 PM > > These people and their treasonist attitudes make me wish > that our nation would Enforce the laws against treason. Right now I would settle for the Debian.org admins to enforce

execute permissions in /tmp

2003-07-12 Thread Jim Popovitch
I have a complaint/opinion/statement to express. It seems that every now and then when I run 'apt-get upgrade' i get a lot of errors about "Can't exec "/tmp/config.x": Permission denied at...". I like to keep my Debian boxen nice and secure, so I 'chmod +t /tmp' to prevent temp files from bei

RE: execute permissions in /tmp

2003-07-12 Thread Jim Popovitch
nal Message- > From: Noah L. Meyerhans [mailto:[EMAIL PROTECTED] Behalf Of Noah L. > Meyerhans > Sent: Saturday, 12 July, 2003 21:34 > To: [EMAIL PROTECTED] > Subject: Re: execute permissions in /tmp > > > On Sat, Jul 12, 2003 at 09:22:45PM -0400, Jim Popovitch wrote: >

RE: execute permissions in /tmp

2003-07-13 Thread Jim Popovitch
> -Original Message- > From: Matt Zimmerman > Sent: Sunday, 13 July, 2003 23:56 > > If the user can read files in /tmp, they can execute the code in > them. What problem is noexec /tmp supposed to solve? Microsoft did a related thing a few years ago, they moved the TEMP directory to the u

moin 1.5.3-1.2etch1 and CVE-2006-0658

2008-11-22 Thread Jim Popovitch
I'm seeing some inconsistencies floating around and reaching out here for some clarification ;-) According to this source http://idssi.enyo.de/tracker/CVE-2006-0658 Etch "package moin is vulnerable". However there is no mention of it here: http://bugs.debian.org/cgi-bin/pkgreport.cgi?src=

Re: [SECURITY] [DSA 1680-1] New clamav packages fix potential code execution

2008-12-09 Thread Jim Popovitch
On Tue, Dec 9, 2008 at 17:44, Mapper ict department <[EMAIL PROTECTED]> wrote: > We have Debian Etch with the volatile clamav installed. This is > the version: > > 0.94.dfsg.1-1~volatile1 > > That is the one affected if i am not mistaking. > > We have the volatile archive in the apt-get sources lis

Re: [SECURITY] [DSA 1680-1] New clamav packages fix potential code execution

2008-12-10 Thread Jim Popovitch
On Wed, Dec 10, 2008 at 07:27, Dominic Hargreaves <[EMAIL PROTECTED]> wrote: > I don't think that's relevant to volatile versions though. To Volatile or Not to Volatile. That is the question (now).Is volatile a dead thing and security now back to real-time updates? I'm ok with manually downl

Re: [SECURITY] [DSA 1680-1] New clamav packages fix potential codeexecution

2008-12-10 Thread Jim Popovitch
On Wed, Dec 10, 2008 at 13:21, Dominic Hargreaves <[EMAIL PROTECTED]> wrote: > I don't really understand your question. There is no separate security > archive for volatile, as I understand it. Oddly enough I understood Tony, yet I don't understand the Volative+ClamAV situation. Can someone defin

Re: [SECURITY] [DSA 1680-1] New clamav packages fix potential codeexecution

2008-12-10 Thread Jim Popovitch
On Wed, Dec 10, 2008 at 15:10, Michael Tautschnig <[EMAIL PROTECTED]> wrote: > I guess only the volatile archive maintainers can help out. Yet they have been silent for several days now on this issue. Are they overloaded? Do we need new volatile maintainers? Who's in the know here? -Jim P.

Re: [VUA 51-1] Updated clamav version

2008-12-10 Thread Jim Popovitch
On Thu, Dec 11, 2008 at 00:55, Andreas Barth <[EMAIL PROTECTED]> wrote: > --- > Debian Volatile Update Announcement VUA 51-1 http://volatile.debian.org > [EMAIL PROTECTED] Stephen Gran > Dec 11

Re: AUTO: Ross Willman is out of the office (returning 29/09/2008)

2009-01-15 Thread Jim Popovitch
On Thu, Jan 15, 2009 at 19:10, Stephen Vaughan wrote: > > When will people learn not to set auto replies all people? never. You can only do so much education before you have to give up. The real solution is to fix bad email clients. A proper email client, or vacation subsystem, should neve

Re: Out of office replies

2009-01-17 Thread Jim Popovitch
On Sat, Jan 17, 2009 at 12:50 AM, Izak Burger wrote: > our own auto-reply exim router (as requested by clients) checks for about 16 > different headers On Sat, Jan 17, 2009 at 06:44, Dusty Wilson wrote: [snip] > I understand that it takes both sides to fix the problem: mailing > list software t

Re: Out of office replies

2009-01-17 Thread Jim Popovitch
On Sat, Jan 17, 2009 at 07:29, Frank Lanitz wrote: > On Sat, 17 Jan 2009 07:15:30 -0500 "Jim Popovitch" wrote: >> Bah!! Headers change over time. The simple and easy way to solve >> OoO problems is for vacation responders to only reply to From:/Sender: >> if

Re: Out of office replies

2009-01-17 Thread Jim Popovitch
On Sat, Jan 17, 2009 at 08:14, Dusty Wilson wrote: > Sometimes you have a situation where the recipient is > f...@someplace.com, but that is forwarded to f...@someotherplace.com. Ahhh, but that is the recipient's problem (user generated) and therefore not the realm of Sender: or ML. Let those pe

Re: HEAD's UP: possible 0day SSH exploit in the wild

2009-07-08 Thread Jim Popovitch
On Wed, Jul 8, 2009 at 09:33, Roger Bumgarner wrote: > ALLOW rules and SSH-keys. Is there a way to force keys AND passwd verification? -Jim P. -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Re: Debian and CVE-2010-0624

2010-03-10 Thread Jim Popovitch
On Wed, Mar 10, 2010 at 08:32, Nico Golde wrote: > No and as this is no serious issue we also decided to not release a DSA for > this. We will encourage the maintainer to provide updated packages through > stable-proposed-updates. I, for one, Thank you for decisions like that. There doesn't nee

Re: New Version of Adobe PDF for all Windows platforms

2010-07-03 Thread Jim Popovitch
WTF? Come on folks. who's running this list? -Jim P. On Sat, Jul 3, 2010 at 22:14, Adobe PDF wrote: > > New Version of Adobe PDF Reader for all Windows platforms > Dear valued customers, > > 50%-60% of your daily office works requires document handling. > 70% of your documents requires ext

Re: ...

2010-07-04 Thread Jim Popovitch
On Sun, Jul 4, 2010 at 04:17, Yves-Alexis Perez wrote: > On sam., 2010-07-03 at 23:37 -0400, Jim Popovitch wrote: >> WTF?  Come on folks. who's running this list? > > Please don't reply to spam, especially not quoting them. Please quit allowing your systems to s

Re: ...

2010-07-04 Thread Jim Popovitch
On Sun, Jul 4, 2010 at 13:48, Russ Allbery wrote: > Multiple people already spend lots of time working on the spam filtering > for this list, and it's about as good as it can get given the requirements > the Debian project has for openness for its mailing lists.  It's unlikely > to get substantial

Re: ...

2010-07-04 Thread Jim Popovitch
On Sun, Jul 4, 2010 at 15:13, Stephen Frost wrote: > * Jim Popovitch (jim...@gmail.com) wrote: >> How about I volunteer to tackle that remaining 5% rather than giving >> up so easily? > > Erm, seriously? Yes. Esp based on the last 2 paragraphs on this page: http://www.de

Re: ...

2010-07-04 Thread Jim Popovitch
On Sun, Jul 4, 2010 at 19:31, Stephen Gran wrote: > > No, Russ implied that reality occasionally intrudes on fantasies of > spam-free inboxes. Russ stated: It's unlikely to get substantially better than it is (I believe we're already rejecting something like 95% of the incoming mail), so

Re: ...

2010-07-04 Thread Jim Popovitch
On Sun, Jul 4, 2010 at 20:08, Russ Allbery wrote: > Jim Popovitch writes: >> On Sun, Jul 4, 2010 at 19:31, Stephen Gran wrote: > >>> No, Russ implied that reality occasionally intrudes on fantasies of >>> spam-free inboxes. > >> Russ stated: > >&g

Re: Spam fighting

2010-07-05 Thread Jim Popovitch
On Mon, Jul 5, 2010 at 09:49, Roger Hanna wrote: > Ok Folks, really, your mails about the spam are starting to actually spam! > > Wait, this email is then also considered a spam about spamming. > > You just can't win. Good thing the FOSS ppl don't think like that. -Jim P. -- To UNSUBSCRIBE, e

Re: Spam fighting

2010-07-05 Thread Jim Popovitch
On Mon, Jul 5, 2010 at 17:38, Arthur Machlas wrote: > Forward all mail to a gmail account, then forward back to Debian's > list-servs. Spam problem solved. except Debian pushes hard for their outbound mail host to be whitelisted... which is also a reason the default Spamassassin will generally n

Re: Michael Baumgartner/bam/SFS ist außer Haus.

2010-10-08 Thread Jim Popovitch
When is Debian going to learn how to filter out OoO messages? I'm willing to train/educate for free. Who's willing to listen and learn? -Jim P. 2010/10/8 Michael Baumgartner : > Ich werde ab 07.10.2010 nicht im Büro sein. Ich kehre zurück am 11.10.2010. > > Ich werde Ihre Nachricht nach meiner

Re: AUTO: Breyer, Mark is out of the office. (Rückk ehr am 29.11.2010)

2010-11-22 Thread Jim Popovitch
2010/11/22 : > > Ich bin bis 29.11.2010 abwesend. Header "Auto-Submitted: auto-generated" existed.Why can't the Debian lists simply discard these? -Jim P. -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@list

Re: Lenny version info

2010-12-12 Thread Jim Popovitch
On Sun, Dec 12, 2010 at 21:38, Michael Cassano wrote: > No, this is not the right place to ask.  A better place is Google, for > instance. > > http://www.google.com/search?hl=en&q=how%20do%20I%20tell%20what%20version%20of%20debian%20I%20am%20running&btnG=Search Oh, come on. We can do better than

Re: Lenny version info

2010-12-13 Thread Jim Popovitch
On Mon, Dec 13, 2010 at 02:18, Andrew McGlashan wrote: > Hi, > > Chris Bannister wrote: >> Naturally, I assume you would do a google first!!! Just think, in a few >> years time if someone googles your name, will they think you >> ignorant/lazy and not able to use a search engine? > > I don't under

Re: Lenny version info

2010-12-13 Thread Jim Popovitch
On Mon, Dec 13, 2010 at 20:12, Ash Narayanan wrote: > Can you imagine stepping in to a pet *security* store with a question about > your > pets *health* symptoms to be abused by the store attendant for not going to a > vet instead? ^ There, I fixed it for you. -Jim P. -- To UNSUBSCRIBE, emai

Re: Lenny version info

2010-12-13 Thread Jim Popovitch
On Mon, Dec 13, 2010 at 22:50, Mike Mestnik wrote: > From what I can tell debian-security is listed under [2]User and not under > [3]Developer lists, so it stands to reason that users should be encouraged > to seek assistance from this list's members. > > 2. http://lists.debian.org/users.html >Fr

Re: Lenny version info

2010-12-13 Thread Jim Popovitch
On Mon, Dec 13, 2010 at 23:33, Andrew McGlashan wrote: > Chris Wadge wrote: >>> >>> PS: I've solved my problem. Thanks to those that actually helped. > > Besides all the noise, the "version of Lenny" can be directly relevant to > the security of the installation ... and therefore it could technica

Re: Lenny version info

2010-12-15 Thread Jim Popovitch
On Wed, Dec 15, 2010 at 07:00, John Keimel wrote: > On Wed, Dec 15, 2010 at 6:49 AM, Ashley Taylor wrote: >> Hi, >> >> Does anyone have any decent filter rules for Gmail so I can stop receiving >> this nonsense without unsubscribing? >> Thanks. > > http://tinyurl.com/2b3g2l4 > > Also, since you n

Re: Bind security announce

2010-12-30 Thread Jim Popovitch
On Thu, Dec 30, 2010 at 13:57, Adam D. Barratt wrote: > On Tue, 2010-12-28 at 18:34 -0800, Account for Debian group mail wrote: >> >> Well I waited to see if someone came our with a solution to this problem, >> none seen. So I'm updating another machine, here is what "dselect" is >> showing me: >

Re: Bind security announce

2010-12-30 Thread Jim Popovitch
On Thu, Dec 30, 2010 at 14:07, Jim Popovitch wrote: > On Thu, Dec 30, 2010 at 13:57, Adam D. Barratt > wrote: >> On Tue, 2010-12-28 at 18:34 -0800, Account for Debian group mail wrote: >>> >>> Well I waited to see if someone came our with a solution to this

Re: AUTO: Breyer, Mark is out of the office. (Rückkehr am 21.02.2011)

2011-01-27 Thread Jim Popovitch
Auto-Submitted: auto-generated. EOM -Jim P. 2011/1/27 : > > Ich bin bis 21.02.2011 abwesend. > > > > > Hinweis: Dies ist eine automatische Antwort auf Ihre Nachricht  "[SECURITY] > [DSA 2152-1] hplip security update" gesendet am 27.01.2011 23:35:07. > > Diese ist die einzige Benachrichtigung,

Re: AUTO: Steve Bownas is out of the office. (returning 06/09/2011)

2011-06-04 Thread Jim Popovitch
On Sat, Jun 4, 2011 at 23:08, Steven Bownas wrote: > > I am out of the office until 06/09/2011. X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on liszt.debian.org X-Spam-Level: * X-Spam-Status: No, score=1.1 required=4.0 tests=AUTOGENERATE,AUTOREBOD,FOURLA, LDO_WHITELIST,OUTOFOF