3:37 a.m.
----- "Conrad Meyer" <cemeyer(a)u.washington.edu> wrote:
On Thursday 30 July 2009 08:49:12 am Jan Chadima wrote:
> Hi
> I've just solve the problem with the openssh-blacklist package.
> Now the packae is only the 16 kbytes. It contains the downloader.
The data
> are downloaded from the server on user request. Excuse me the first
> (big)package. I hope that way will work.
If I'm reading this correctly, this behavior is also broken. The user
should
not have to be connected to the internet to use the package after
(s)he
installs it.
Another interpretation suggests that you download the data in the
build
process; that won't work on Koji (and should be fixed).
Maybe I do not understand your question. Now the srpm and noarch.rpm also < 20kB. The
build is normal koji build. User (or admin) run the program and then program synchronize
the local database of keys to the internet one. I someone have no Internet, it is also the
possibility transfer the data on CD, DVD, FLASH or else ....
Regards,
--
Conrad Meyer <cemeyer(a)u.washington.edu>
--
fedora-devel-list mailing list
fedora-devel-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list
--
JFCh
3:42 a.m.
New subject: openssh-blacklist - careless waste of space.
On 31/07/09 09:37, Jan Chadima wrote:
I think what is meant, it that the app is useless, without either
web\media input. Which the user should not have to do to take full
advantage of it.
----- "Conrad Meyer"<cemeyer(a)u.washington.edu>
wrote:
--snip--
Maybe I do not understand your question. Now the srpm and noarch.rpm
also< 20kB.
The build is normal koji build. User (or admin) run the program and then
program synchronize the local database of keys to the internet one.
I someone have no Internet, it is also the possibility transfer the data
on CD, DVD, FLASH or else ....
3:56 a.m.
New subject: openssh-blacklist - careless waste of space.
----- "Frank Murphy" <frankly3d(a)gmail.com> wrote:
On 31/07/09 09:37, Jan Chadima wrote:
> ----- "Conrad Meyer"<cemeyer(a)u.washington.edu> wrote:
--snip--
> Maybe I do not understand your question. Now the srpm and noarch.rpm
also< 20kB.
The build is normal koji build. User (or admin) run the program and
then
program synchronize the local database of keys to the internet one.
I someone have no Internet, it is also the possibility transfer the
data
on CD, DVD, FLASH or else ....
>
I think what is meant, it that the app is useless, without either
web\media input. Which the user should not have to do to take full
advantage of it.
1) who is unable to get data from Internet and transfer it by other mains to another
computer today?
2) how put various set of data of total size up to 1GB (2GB in future) into distro?
3) why user without Internet want to test his network security?
--- if it is user on great intranet, admins should provide internal mirror.
--- if it is single computer then the whole package is useless....
:) and the user should not have to do to take full advantage of it. :)
--
fedora-devel-list mailing list
fedora-devel-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list
--
JFCh
10:31 a.m.
New subject: openssh-blacklist - careless waste of space.
On Friday 31 July 2009 04:42:12 am Frank Murphy wrote:
I think what is meant, it that the app is useless, without either
web\media input. Which the user should not have to do to take full
advantage of it.
I think this is a bit like virus definitions. 800Mb is excessive to ship in a
package. I think the definitions could be created by a script, but will take
some time to generate. Maybe adding a generator for people not connected would
let them recreate the content?
But a 800Mb package is bigger than the livecd.
-Steve
4:50 a.m.
New subject: openssh-blacklist - careless waste of space.
On Fri, Jul 31, 2009 at 11:31 AM, Steve Grubb<sgrubb(a)redhat.com> wrote:
On Friday 31 July 2009 04:42:12 am Frank Murphy wrote:
> I think what is meant, it that the app is useless, without either
> web\media input. Which the user should not have to do to take full
> advantage of it.
I think this is a bit like virus definitions.
It's more akin to a bad password list.
800Mb is excessive to ship in a
package. I think the definitions could be created by a script, but will take
some time to generate. Maybe adding a generator for people not connected would
let them recreate the content?
But a 800Mb package is bigger than the livecd.
What?!
Openssh-blacklist is a list of bad keys that could have been generated
by the debian lack of entropy bug.
In it should be a couple of text files: A DSA key file, and an RSA key
file for each of a couple common key sizes. Each file should have
100k lines or so with just a fingerprint on them.. all in all it
should just be a couple of mbytes.
It looks like that distribution also includes the full public and
private keyparts for the bad keys in addition to the fingerprints.
That isn't needed for bad key screening— that additional info is only
really needed by attackers.
After the vulnerability I screened the accounts on my systems and
found a couple of these bad keys just from giving my ubuntu/debian
running friends access to rsync data, so this is a risk for fedora
users too.
Not only should this install without requiring a live internet
connection but these, or at least a subset with the most common key
sizes, should really be part of the default ssh install along with the
feature in SSH that causes it to refuse to use these keys.
11:37 a.m.
New subject: openssh-blacklist - careless waste of space.
On Fri, 2009-07-31 at 09:42 +0100, Frank Murphy wrote:
I think what is meant, it that the app is useless, without either
web\media input. Which the user should not have to do to take full
advantage of it.
We ship rather a lot of applications which are fairly useless without an
internet connection. If the data is downloaded from the internet when
you run _the installed program_, I don't see any problem here.
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Fedora Talk: adamwill AT fedoraproject DOT org
http://www.happyassassin.net
1:10 p.m.
New subject: openssh-blacklist - careless waste of space.
On Fri, Jul 31, 2009 at 11:37 AM, Adam Williamson<awilliam(a)redhat.com> wrote:
<snip>
We ship rather a lot of applications which are fairly useless without
an
internet connection. If the data is downloaded from the internet when
you run _the installed program_, I don't see any problem here.
<snip>
+1
-Adam
--
http://maxamillion.googlepages.com
---------------------------------------------------------
() ascii ribbon campaign - against html e-mail
/\ www.asciiribbon.org - against proprietary attachments
1:11 p.m.
New subject: openssh-blacklist - careless waste of space.
On 31/07/09 17:37, Adam Williamson wrote:
On Fri, 2009-07-31 at 09:42 +0100, Frank Murphy wrote:
> I think what is meant, it that the app is useless, without either
> web\media input. Which the user should not have to do to take full
> advantage of it.
We ship rather a lot of applications which are fairly useless without an
internet connection. If the data is downloaded from the internet when
you run _the installed program_, I don't see any problem here.
I agree, but thought I was clarifying Conrad's comment :(
Back to the TV
5382
days inactive
5383
days old
7 comments
6 participants
participants (6)
-
Adam Miller -
Adam Williamson -
Frank Murphy -
Gregory Maxwell -
Jan Chadima -
Steve Grubb