Re: fbsd11 & sshv1

2017-01-30 Thread jungle boogie
On 01/30/2017 09:36 PM, Heasley wrote: whats wrong with providing a 7.4+v1 port for everyone to use? What will happen when 7.4 gets a vulnerability, then? I don't think you or I will be patching it (or anyone else) and therefore, the port/pkg will be knowingly vulnerable. Why do we want that?

Re: fbsd11 & sshv1

2017-01-30 Thread jungle Boogie
On 30 January 2017 at 14:24, heasley wrote: > Mon, Jan 30, 2017 at 01:56:03PM -0800, jungle Boogie: >> On 30 January 2017 at 11:52, heasley wrote: >> > Mon, Jan 30, 2017 at 01:57:32PM +0100, Dag-Erling Smørgrav: >> >> heasley writes: >> >> > S

Re: fbsd11 & sshv1

2017-01-30 Thread jungle Boogie
On 30 January 2017 at 11:52, heasley wrote: > Mon, Jan 30, 2017 at 01:57:32PM +0100, Dag-Erling Smørgrav: >> heasley writes: >> > So, what is the BCP to support a v1 client for outbound connections on fbsd >> > 11? Hopefully one that I do not need to maintain by building a special ssh >> > from

Re: FreeBSD Security Advisory FreeBSD-SA-16:16.ntp

2016-04-29 Thread jungle Boogie
Sent from my iPhone 7.1 On Apr 29, 2016 5:09 PM, "Charles Swiger" wrote: > > On Apr 29, 2016, at 4:43 PM, Roger Marquis wrote: > > > Who needs millisecond accuracy anyway? > > Cell phones, cell phone towers, computers handling financial transactions, etc. > And these use cases actually use FreeB

Re: Quarterly packages and security updates...

2015-08-14 Thread jungle Boogie
On 14 August 2015 at 10:31, Mason Loring Bliss wrote: > How about, two of them were vulnerable until I wrote to the list with the > dismaying thought that we were going to ship vulnerable packages, at which > point someone with the ability to push packages around decided to fix > them...? > > That

Re: FreeBSD + Yubikey NEO in OATH-HOTP mode?

2015-07-09 Thread jungle Boogie
Hi, On 9 July 2015 at 09:15, Lev Serebryakov wrote: > Does somebody succeed to setup FreeBSD for usage with Yubikey NEO > token without Yubico authentication service, with OATH-HOTP? I don't have the neo but it works, at least, with openssh. See comments in this blog post: http://sysconfig.org.u

Re: Forums.FreeBSD.org - SSL Issue?

2015-05-14 Thread jungle Boogie
On 14 May 2015 at 06:08, Mark Felder wrote: > > > On Thu, May 14, 2015, at 05:19, Adam Major wrote: >> Hello >> >> I checked now by sslLabs.com: >> https://www.ssllabs.com/ssltest/analyze.html?d=forums.freebsd.org >> >> and score is A+ >> >> But I don't think disable TLS 1.0 is ok. >> > > TLS 1.0

Re: FreeBSD Security Advisory FreeBSD-SA-15:05.bind

2015-02-25 Thread jungle Boogie
Hi Security Officials of FreeBSD, On 24 February 2015 at 22:29, FreeBSD Security Advisories wrote: > 2) To update your vulnerable system via a binary patch: > > Systems running a RELEASE version of FreeBSD on the i386 or amd64 > platforms can be updated via the freebsd-update(8) utility: > > # fre

Re: FreeBSD Security Advisory FreeBSD-SA-15:02.kmem

2015-01-28 Thread jungle Boogie
Hi Nick, On Jan 28, 2015 4:56 PM, "Nick Frampton" wrote: > > On 29/01/15 08:46, Joe Holden wrote: >> >> Really, how many SCTP users are there om the wild... maybe one? >> >> It shouldn't be in GENERIC at the very least! > > > We use Netflow over SCTP in our network monitoring product, so it would

Re: ntpd vulnerabilities

2014-12-22 Thread jungle Boogie
Hi Mark, On 22 December 2014 at 11:02, Mark Felder wrote: > On Mon, Dec 22, 2014, at 11:39, Brett Glass wrote: >> I'd like to propose that FreeBSD move to OpenNTPD, which appears to >> have none of the >> fixed or unfixed (!) vulnerabilities that are present in ntpd. >> There's already a port. >>

Re: pkg repositories out of alignment

2014-09-26 Thread Jungle Boogie
Dear Mark, From: Mark Felder Sent: Fri, 26 Sep 2014 14:55:03 -0500 To: freebsd-security@freebsd.org Subject: Re: pkg repositories out of alignment (was: Re: bash velnerability) > > On Fri, Sep 26, 2014, at 10:25, Paul Hoffman wrote: >> >> I appreciate