Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread Didier Kryn
Le 21/07/2021 à 21:08, Andreas Messer a écrit : > On Wed, Jul 21, 2021 at 02:36:16PM +0200, Didier Kryn wrote: >> added (by gcc ?) to work around a missing feature of the C language: >> dynamic allocation on the stack. This lack has disapeared many years ago >> ( don't know with which version of th

Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread Steve Litt
Bernard Rosset via Dng said on Wed, 21 Jul 2021 18:17:43 +0200 >>     I've found a discussion between a developper and Lennart >> Poeterring in which LP recommends the addition of this kind of >> functions in Musl libc (which will certainly never happen). It's >> slightly amusing how the author o

Re: [DNG] Install OpenSSL (libssl, libcrypto) with weak ciphers

2021-07-21 Thread aitor
On 21/7/21 23:04, aitor wrote: *libssl1.1* provides both libssl and libcrypto shared libraries. Better said: /usr/lib/x86_64-linux-gnu/libssl.so.1.1 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 Aitor. ___ Dng mailing list Dng@lists.dyne.org https://

Re: [DNG] Install OpenSSL (libssl, libcrypto) with weak ciphers

2021-07-21 Thread aitor
Hi Mike, On 21/7/21 15:20, Mike Tubby wrote: Hi All, I appear to have a problem with OpenSSL and lack of support for weak ciphers, i.e. DES and 3DES ... I am trying to migrate a legacy system from Ubuntu 16.04 to Devuan 3.0 where we have mobile IoT devices based on Cinterion TC65i that are

Re: [DNG] Install OpenSSL (libssl, libcrypto) with weak ciphers

2021-07-21 Thread Gregory Nowak via Dng
On Wed, Jul 21, 2021 at 02:20:50PM +0100, Mike Tubby wrote: > I am trying to migrate a legacy system from Ubuntu 16.04 to Devuan 3.0 where > we have mobile IoT devices based on Cinterion TC65i that are 10+ years old > with a limited sub-set of SSL 3.0/TLS 1.0 ciphers in its Java-ME runtime, in > pa

Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread Andreas Messer
On Wed, Jul 21, 2021 at 02:36:16PM +0200, Didier Kryn wrote: > added (by gcc ?) to work around a missing feature of the C language: > dynamic allocation on the stack. This lack has disapeared many years ago > ( don't know with which version of the C standard) , with the following > form of allocati

Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread Didier Kryn
Le 21/07/2021 à 18:19, Tomasz Torcz a écrit : > On Wed, Jul 21, 2021 at 06:00:15PM +0200, Didier Kryn wrote: >> Le 21/07/2021 à 16:51, Bernard Rosset via Dng a écrit : https://www.zdnet.com/article/nasty-linux-systemd-security-bug-revealed/ >>> I'll be projecting myself here, but I reckon shar

Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread Tomasz Torcz
On Wed, Jul 21, 2021 at 06:00:15PM +0200, Didier Kryn wrote: > Le 21/07/2021 à 16:51, Bernard Rosset via Dng a écrit : > >> https://www.zdnet.com/article/nasty-linux-systemd-security-bug-revealed/ > > > > I'll be projecting myself here, but I reckon sharing the original > > source rather than journ

Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread Bernard Rosset via Dng
    I've found a discussion between a developper and Lennart Poeterring in which LP recommends the addition of this kind of functions in Musl libc (which will certainly never happen). It's slightly amusing how the author of such a critical software as systemd lacks a culture of security. Many t

Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread Didier Kryn
Le 21/07/2021 à 16:51, Bernard Rosset via Dng a écrit : >> https://www.zdnet.com/article/nasty-linux-systemd-security-bug-revealed/ > > I'll be projecting myself here, but I reckon sharing the original > source rather than journalistic articles whenever possible is best > towards a tech-savvy audie

Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread Bernard Rosset via Dng
https://www.zdnet.com/article/nasty-linux-systemd-security-bug-revealed/ I'll be projecting myself here, but I reckon sharing the original source rather than journalistic articles whenever possible is best towards a tech-savvy audience. The source (included in above article) is here: https:

Re: [DNG] RFC: minimal-live iso changes for chimaera

2021-07-21 Thread Bernard Rosset via Dng
I've used transmission in the past but currently use deluge. Both have a gui, whereas AFAIR them as relatively klunky. YMMV. I have been a user of Transmission for years, because license, features and history talk for it. I just checked Deluge on those and it seems decent too (despite the fact

Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread Didier Kryn
Le 21/07/2021 à 15:47, William Gallafent via Dng a écrit : > According to a man page I happen to have in front of me, “alloca() > appeared in Version 32V AT&T UNIX.” > > I've certainly seen it in use on code originally written during the > last millennium for SGI IRIX, and then ported to several ot

Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread William Gallafent via Dng
On Wed, 21 Jul 2021 at 13:36, Didier Kryn wrote: > I want to add to the comments that this alloca() function has been > added (by gcc ?) to work around a missing feature of the C language: > dynamic allocation on the stack. This lack has disapeared many years ago > ( don't know with which vers

[DNG] Install OpenSSL (libssl, libcrypto) with weak ciphers

2021-07-21 Thread Mike Tubby
Hi All, I appear to have a problem with OpenSSL and lack of support for weak ciphers, i.e. DES and 3DES ... I am trying to migrate a legacy system from Ubuntu 16.04 to Devuan 3.0 where we have mobile IoT devices based on Cinterion TC65i that are 10+ years old with a limited sub-set of SSL 3.

Re: [DNG] Nasty Linux systemd security bug revealed

2021-07-21 Thread Didier Kryn
Le 20/07/2021 à 22:08, Dr. Nikolaus Klepp a écrit : > Just in case sombody missed it: > > https://www.zdnet.com/article/nasty-linux-systemd-security-bug-revealed/ > > > "Systemd, the Linux system and service manager that has largely > replaced init as the master Linux startup and control program, h

Re: [DNG] New service manager being developed

2021-07-21 Thread d...@d404.nl
On 20-07-2021 22:33, Martin Steigerwald wrote: Hi! Look at https://skarnet.com/projects/service-manager.html Sounds quite interesting, if you ask me. Best, Great initiative. I am currently using Alpine combined with s6-overlay in most of my docker containers and it works very well. A sep