Re: [dev] Fwd: skvm bug and question

2010-02-09 Thread Jonas H.
On 02/08/2010 06:04 PM, stateless wrote: How exactly did you execute skvm? $ skvm --help Segmentation fault I'm using the following version: (current Arch linux User Repository version) $ pacman -Qi skvm-hg Version: 0.1-1 Build Date : Sun 07 Feb 2010 01:22:21 PM CET So this sho

Re: [dev] Fwd: skvm bug and question

2010-02-09 Thread stateless
Hi, Could you run it through valgrind and attach the output? You can also run it under gdb and see where it fails. thx On Tue, Feb 9, 2010 at 4:49 PM, Jonas H. wrote: > On 02/08/2010 06:04 PM, stateless wrote: >> >> How exactly did you execute skvm? > > $ skvm --help > Segmentation fault > > I'

Re: [dev] Fwd: skvm bug and question

2010-02-09 Thread Martin Kopta
Hi, I have nothing to do with this issue but I just noticed something interesting: $ hg clone http://hg.suckless.org/skvm skvm requesting all changes adding changesets adding manifests adding file changes added 28 changesets with 55 changes to 13 files updating to branch default 12 files update

Re: [dev] skvm bug and question

2010-02-09 Thread Jonas H.
On 02/09/2010 09:59 PM, stateless wrote: Could you run it through valgrind and attach the output? You can also run it under gdb and see where it fails. Sure. Full-length valgrin and gdb outputs follow. Begin Valgrind/gdb output [jo...@jarchy ~]$ valgrind skvm --help ==8951== Command

[dev] Surf assumes all SSL connections are good, which is bad

2010-02-09 Thread Chris Palmer
I really like that Surf shows a red bar for HTTP connections and a green bar for HTTPS connections. The trouble is, Surf has no store of CA certificates, so can't be verifying server certificates. It is just assuming that any SSL connection is good. However, active network attacks are so easy to p

Re: [dev] Surf assumes all SSL connections are good, which is bad

2010-02-09 Thread Kurt H Maier
On Tue, Feb 9, 2010 at 6:09 PM, Chris Palmer wrote: > Letting people believe that any SSL connection is good is actually worse > than nothing, because it creates a false sense of security. > > I have serious qualms about depending on CAs (the false sense of security > they engender is even more of

Re: [dev] Surf assumes all SSL connections are good, which is bad

2010-02-09 Thread Antoni Grzymala
On Tue, 9 Feb 2010 18:56:39 -0500, Kurt H Maier wrote: > On Tue, Feb 9, 2010 at 6:09 PM, Chris Palmer > wrote: >> Letting people believe that any SSL connection is good is actually worse >> than nothing, because it creates a false sense of security. >> >> I have serious qualms about depending on

Re: [dev] Surf assumes all SSL connections are good, which is bad

2010-02-09 Thread David E. Thiel
On Tue, Feb 09, 2010 at 06:56:39PM -0500, Kurt H Maier wrote: > SSL can do two things: > > 1) provide site-to-site encryption Without certificate verification in some form, you have no way of knowing that. Your connection could be decrypted and re-encrypted by any number of parties along the way

Re: [dev] Surf assumes all SSL connections are good, which is bad

2010-02-09 Thread Alexander Surma
Well, the connection is definitely encrypted. Regardless of a man in the middle or not ;) However - I see your point. My suggestion would be, that we allow yet another userscript to handle this. I for one do not care for verifying certificates. But for those who do, some kind of interface would be