agwa

99 ms·

931.
by agwa 12y ago
I've been monitoring my Apache logs all day for the string "() {". So far Robert Graham's scan is the only match. This is what the log entry looks like: 209.126.230.72 - - [24/Sep/2014:22:07:56 +0000] &qu
932.
Bash 'shellshock' scan of the Internet(blog.erratasec.com)
109 points by agwa 12y ago|38 comments
933.
by agwa 12y ago
Debian security updates are distributed from security.debian.org, which is separate from the normal Debian mirror network, and Debian discourages the mirroring of security.debian.org because security updates are time sensitive. Hopefully D
934.
by agwa 12y ago
Debian has only made systemd the default , and getting sysvinit back is as simple as running `apt-get install sysvinit-core`. Removing systemd might have consequences for GNOME, but that's not a concern on servers. There is a signifi
935.
by agwa 12y ago
Yes, potentially - if at any point during the execution of a program (or its descendents) a bash script gets called with an untrusted environment variable value from a remote source. The difference between a system with bash as /bin&#
936.
by agwa 12y ago
The API for system() is not great, but the execve family of functions are not drop-in replacements since they don't take care of forking, changing the signals, and waiting. As long as you're not passing arguments from outside sou
937.
by agwa 12y ago
Squeeze doesn't have regular security support anymore. A subset of packages on i386 and amd64 are receiving long term security support, but you need to enable the Squeeze LTS repo: https://wiki.debian.org/LTS/Usin
938.
by agwa 12y ago
Well, that's very odd because that command reports vulnerable on an unpatched Debian system, but fails with exactly that error message on a patched system.
939.
by agwa 12y ago
You appear to already have the updated package installed.
940.
by agwa 12y ago
You're right and my comment was unclear. I'm just saying that the impact on Debian will be less than on distros using /bin/bash for /bin/sh. Of course, even a lessened impact can still be really bad!
941.
by agwa 12y ago
It is a very good thing that Debian and Ubuntu use /bin/dash for /bin/sh by default, since /bin/sh is implicitly invoked all over the place (e.g. by system(3)). Distros which use /bin/bash for /
942.
by agwa 12y ago
Also, if apt did use HTTPS, it would make client-side vulnerabilities like this one even more likely, since you'd have an entire TLS implementation to contend with. (Though there is certainly some value in using HTTPS to hide what p
943.
by agwa 12y ago
That doesn't contain the buffer overflow fix. You can tell from the diff of the changelog that the fix is already there.
944.
by agwa 12y ago
Here's a diff between apt-0.9.7.9+deb7u4 and apt-0.9.7.9+deb7u5, obtained via `apt-get source`: https://gist.github.com/AGWA/4069e45856ed261ac0af You can see the change from a fixed-length buffer to a std::string.
945.
by agwa 12y ago
> The don't solve race conditions in peers trying to locate each other (surprisingly difficult). There's only one PID 1 - it would not be hard to locate its UNIX domain socket. > They don't solve a standardized marshal
946.
by agwa 12y ago
Trying to restrict the browser as a whole doesn't work for a couple reasons: 1. The browser as a whole needs to have permission to do quite a few things, including reading from and writing to the filesystem (for uploading and downloadi
947.
by agwa 12y ago
I think a TODO app would be an instance where the benefits of a "full client-side application" may be significant enough to outweigh the downsides, for the good reasons you describe. I was a bit imprecise in the portion of my comm
948.
by agwa 12y ago
It's on the home page: Standard: $15.95/year Wildcard: $149.95/year But thanks for the feedback; I'll make this more prominent.
949.
by agwa 12y ago
Sites with minimal or no JavaScript are faster than sites with lots of JavaScript. The volume of JS is often so large, especially with frameworks, that it can take a long time both to transfer and to execute. I've noticed the differe
950.
by agwa 12y ago
Check out my startup, SSLMate: https://sslmate.com . What sets SSLMate apart is that we're working on making SSL certificate management extremely easy on Linux servers. You buy certs from the command line in a single step
951.
by agwa 12y ago
Nothing that complicated is required. When the server needs to sign the DH handshake, it sends the value to be signed over to the key server, and the key server replies with the signature. Although the diagrams in the blog post show the no
952.
by agwa 12y ago
The handshake is probably not much slower than it would be if the web browser were connecting directly to the bank, since there is only one round trip with the key server per handshake, and the latency between Cloudflare and web browsers te
953.
by agwa 12y ago
Cloudflare already has a heavy dependence on the origin server being up, particularly for non-cacheable dynamic websites, so adding a key server doesn't really change anything. It has always been critical that you keep the address of
954.
by agwa 12y ago
Why the former is broken: https://www.imperialviolet.org/2014/04/19/revchecking.html https://www.imperialviolet.org/2014/04/29/revocationagain.ht...
955.
by agwa 12y ago
'apt-get download' is a relatively recent addition.
956.
by agwa 12y ago
The Ubuntu advisory says "source packages" for some reason. I think it's a typo but it doesn't change the analysis - most people don't use 'apt-get download' to install packages.
957.
by agwa 12y ago
I concur with your analysis of 2-4. Edit: Regarding #1(If-Modified-Since), the vulnerability is that if a hash in the Release file changes, but the file being referred to by the Release file gets served with a 304 response, apt will ignore
958.
by agwa 12y ago
Here's the GitHub link: https://github.com/cplusplus/draft
959.
by agwa 12y ago
Yes, I've been using Liferea [ http://lzone.de/liferea/ ] since 2004. Seeing the rise and fall of Google Reader while meanwhile Liferea steadily progressed from 0.4 to 1.11 I think says a lot about the value of bot
960.
by agwa 12y ago
That proposal wasn't just to remove sendmail; it was to install no MTA by default. OpenBSD, on the other hand, has a replacement for sendmail in OpenSMTPd.

More ›