Review swap offers

2012-01-07 Thread Volker Fröhlich
I have these 3 review requests that haven't got a lot of attention yet. Is somebody interested in swapping? https://bugzilla.redhat.com/show_bug.cgi?id=767082 -- wxpropgrid https://bugzilla.redhat.com/show_bug.cgi?id=760294 -- freexl https://bugzilla.redhat.com/show_bug.cgi?id=759941 -- spatialit

Re: service version disclosure

2012-01-07 Thread Miloslav Trmač
On Sat, Jan 7, 2012 at 5:24 AM, Bruno Wolff III wrote: > On Sat, Jan 07, 2012 at 05:09:42 +0100, >  Reindl Harald wrote: >> >> however - why do we spit the current running versions to everyone? > > It can help when trouble shooting problems. The current version isn't > really that helpful to atta

GPG keysigning event at FUDCon Blacksburg 2012 (and CAcert Assurance Event)

2012-01-07 Thread Nick Bebout
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 We are planning a GPG Key Signing event at FUDCon Blacksburg, which will be held on Saturday, January 14, 2012 at 1600 (4pm). If you are interested in participating, please add your info to https://fedoraproject.org/wiki/FUDCon:Blacksburg_2012_GPG

LLVM rebuild failure (was: Re: rawhide report: 20120107 changes)

2012-01-07 Thread Richard W.M. Jones
On Sat, Jan 07, 2012 at 11:47:07AM +, Rawhide Report wrote: > llvm-ocaml-3.0-1.fc17.x86_64 requires ocaml(runtime) = 0:3.12.0 I tried to rebuild llvm, but it fails in the tests. I'm pretty sure this is nothing to do with OCaml though, it's something unrelated (maybe GCC 4.7?). Here is

Re: F16 Linux 3.1 soft lockups

2012-01-07 Thread Michał Piotrowski
Hi, I've noticed some strange soft lockup behaviour on my system (please see the attachment). Soft lockup appears to be caused by kswapd0 process. It seems to me that in both cases this error occured when I used "git fsck --full" or "git gc" commands. -- Best regards, Michal http://eventhorizon.

Re: service version disclosure

2012-01-07 Thread Reindl Harald
Am 07.01.2012 16:02, schrieb Kevin Kofler: > Reindl Harald wrote: >> but i also know that from "SSH-2.0-OpenSSH_5.8" only "SSH-2.0" >> is relevant for clients > > "SSH-2.0" brings no information at all. ANY even remotely current SSH server > will report "SSH-2.0". That doesn't tell you anything

Re: service version disclosure

2012-01-07 Thread Bruno Wolff III
On Sat, Jan 07, 2012 at 15:55:34 +0100, Reindl Harald wrote: > > i, and only i am responsible for the machines so why > do i not have a option only "SSH-2.0-OpenSSH" provide > to a anonymous client? You do have that option. That's the nice thing about free software. You can rebuild the rpm wit

Re: service version disclosure

2012-01-07 Thread Kevin Kofler
Reindl Harald wrote: > but i also know that from "SSH-2.0-OpenSSH_5.8" only "SSH-2.0" > is relevant for clients "SSH-2.0" brings no information at all. ANY even remotely current SSH server will report "SSH-2.0". That doesn't tell you anything about implementation- specific behavior an SSH client

Re: service version disclosure

2012-01-07 Thread Reindl Harald
Am 07.01.2012 15:44, schrieb Sam Varshavchik: >> no, one keys of security is to provide as less informations as >> absolutely necessary, not only for sshd, for every single >> service >> >> in the best case no single foreign person has an idea >> what software you are currently running, not what

Re: service version disclosure

2012-01-07 Thread Reindl Harald
Am 07.01.2012 15:40, schrieb Kevin Kofler: > Reindl Harald wrote: >> if you have a big customer which hires a 3rd party auditor >> you are NOT in the poisiton to give such arguments or >> you can give them but you can not change ANYTHING in >> the fact that finally "fix it or shutdown the service

Re: service version disclosure

2012-01-07 Thread Sam Varshavchik
Reindl Harald writes: Am 07.01.2012 08:02, schrieb Digimer: >> i know about the pros and cons for obscurity >> >> but i also know that from "SSH-2.0-OpenSSH_5.8" only "SSH-2.0" >> is relevant for clients and having backports in mind this must >> be the truth because if the whole version would

Re: service version disclosure

2012-01-07 Thread Sam Varshavchik
Reindl Harald writes: Am 07.01.2012 06:35, schrieb Digimer: >> if you have a big customer which hires a 3rd party auditor >> you are NOT in the poisiton to give such arguments or >> you can give them but you can not change ANYTHING in >> the fact that finally "fix it or shutdown the service" >>

Re: service version disclosure

2012-01-07 Thread Kevin Kofler
Reindl Harald wrote: > if you have a big customer which hires a 3rd party auditor > you are NOT in the poisiton to give such arguments or > you can give them but you can not change ANYTHING in > the fact that finally "fix it or shutdown the service" > is what you have to do They need to fire the a

Re: service version disclosure

2012-01-07 Thread Paul Wouters
On Sat, 7 Jan 2012, Reindl Harald wrote: would it not be a good idea to NOT disclosure service versions? https://bugzilla.redhat.com/show_bug.cgi?id=718133 you will more and more have the "problem" of 3rd party security scans to your servers and currently in the case of openssh the only solutio

Re: updating goffice to 0.9.0

2012-01-07 Thread Julian Sikorski
W dniu 28.11.2011 17:52, Julian Sikorski pisze: > W dniu 28.11.2011 17:32, Bill Nottingham pisze: >> Julian Sikorski (beleg...@gmail.com) said: >>> Dear Fedorians, >>> >>> goffice-0.9.0 was released recently, along with new gnumeric [1,2]. What >>> is your opinion on pushing the update to rawhide