Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-19 Thread Wietse Venema
and MX but not between client and the nearest anycast > > 8.8.8.8.) > > Congratulations! You just gave a new definition of security theatre: > using an unauthenticated channel to distribute trust anchors. You > can consider libc-musl as unsupported from now on. Verified on alpine-

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-19 Thread Matus UHLAR - fantomas
Congratulations! You just gave a new definition of security theatre: using an unauthenticated channel to distribute trust anchors. You can consider libc-musl as unsupported from now on. On 19.04.20 13:11, Wietse Venema wrote: Verified on alpine-3.11.5. alpine:~/postfix-3.6-20200419$ make makefi

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-19 Thread Viktor Dukhovni
On Sun, Apr 19, 2020 at 08:02:41PM +0200, Matus UHLAR - fantomas wrote: > On 19.04.20 13:11, Wietse Venema wrote: > > >Warning: libc-musl breaks DANE/TLSA security. > >Use a glibc-based Linux distribution instead. > >Remove this test to build unsupported Postfix. > >make: *** [Makefile:79: makefil

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-19 Thread @lbutlr
On 18 Apr 2020, at 11:04, Rich Felker wrote: > It's not security theater because nobody's claiming it's secure. > Rather it's a fairly weak form of hardening that increases the > required capabilities an attacker needs to exploit a known-insecure > system. It is secure in the sense that the commu

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-19 Thread @lbutlr
On 19 Apr 2020, at 12:16, @lbutlr wrote: > It is secure Sorry, I thought this was Opportunistic TLS. -- I mistook thee for thy better Hamlet Act III scene 4

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-19 Thread Wietse Venema
ew definition of security theatre: > >> using an unauthenticated channel to distribute trust anchors. You > >> can consider libc-musl as unsupported from now on. > > On 19.04.20 13:11, Wietse Venema wrote: > >Verified on alpine-3.11.5. > > > >alpine:~/postf