Re: Bug#283061: opendchub: user with hub admin access can overflow a buffer and execute arbitrary code

2004-11-26 Thread Grzegorz B. Prokopski
tags 283061 help thanks Could somebody please NMU? I didn't get my new key signed yet so I am in no position to perform an upload. Thanks, Grzegorz B. Prokopski On Fri, 2004-11-26 at 01:56, Brian Dessent wrote: > Package: opendchub > Version: 0.7.14-1

Re: Bug#283061: opendchub: user with hub admin access can overflow a buffer and execute arbitrary code

2004-11-26 Thread Grzegorz B. Prokopski
tags 283061 help thanks Could somebody please NMU? I didn't get my new key signed yet so I am in no position to perform an upload. Thanks, Grzegorz B. Prokopski On Fri, 2004-11-26 at 01:56, Brian Dessent wrote: > Package: opendchub > Version: 0.7.14-1

Re: [jdamour@nycap.rr.com: Re: Please help sorting out which sid updates need to make sarge]

2004-08-16 Thread Grzegorz B. Prokopski
GBP -- Grzegorz B. Prokopski <[EMAIL PROTECTED]> Debian GNU/Linux http://www.debian.org SableVM - LGPL'ed Java VM http://www.sablevm.org Why SableVM ?!?http://devel.sablevm.org/wiki/Features

Re: [jdamour@nycap.rr.com: Re: Please help sorting out which sid updates need to make sarge]

2004-08-16 Thread Grzegorz B. Prokopski
GBP -- Grzegorz B. Prokopski <[EMAIL PROTECTED]> Debian GNU/Linux http://www.debian.org SableVM - LGPL'ed Java VM http://www.sablevm.org Why SableVM ?!?http://devel.sablevm.org/wiki/Features -- To UNSUBSCRIBE, email to [EMAIL PROTECTED]

Re: [Pkg-firebird-general] Request for comments for ibwebadmin package

2004-06-08 Thread Grzegorz B. Prokopski
from upstream" - yes, this is a common practice, when the version you want/need to package didn't contain the proper licensing terms. HTH Grzegorz B. Prokopski -- Grzegorz B. Prokopski <[EMAIL PROTECTED]> Debian GNU/Linux http://www.debian.or

Re: [Pkg-firebird-general] Request for comments for ibwebadmin package

2004-06-08 Thread Grzegorz B. Prokopski
from upstream" - yes, this is a common practice, when the version you want/need to package didn't contain the proper licensing terms. HTH Grzegorz B. Prokopski -- Grzegorz B. Prokopski <[EMAIL PROTECTED]> Debian GNU/Linux http://www.debian.or

Re: [Pkg-firebird-general] Request for comments for ibwebadmin package

2004-06-08 Thread Grzegorz B. Prokopski
;. It seems that debian-legal didn't like it either. Again you should try to contact upstream and explain the problem. Dual licensing w/ GPL (or LGPL) would be an option that would also eliminate all problems mentioned in 1) by eliminating the need for an exception. HTH Grzegorz B. Prokopski

Re: [Pkg-firebird-general] Request for comments for ibwebadmin package

2004-06-08 Thread Grzegorz B. Prokopski
;. It seems that debian-legal didn't like it either. Again you should try to contact upstream and explain the problem. Dual licensing w/ GPL (or LGPL) would be an option that would also eliminate all problems mentioned in 1) by eliminating the need for an exception. HTH

Re: RFS: libxp-java : XML 1.0 parser for Java

2004-06-07 Thread Grzegorz B. Prokopski
way). On the other hand, as a user, I treat putting names of alternative packages into Depends field as an important information, which will help me in case I had troubles running this software. Maybe I should switch to different JVM to run this app? Summarizing: in both cases - for an enduser a

Re: RFS: libxp-java : XML 1.0 parser for Java

2004-06-06 Thread Grzegorz B. Prokopski
way). On the other hand, as a user, I treat putting names of alternative packages into Depends field as an important information, which will help me in case I had troubles running this software. Maybe I should switch to different JVM to run this app? Summarizing: in both cases - for an enduser a

Re: setgid-wrapper

2004-05-19 Thread Grzegorz B. Prokopski
root.root /usr/lib/my_util/util BTW: your wrapper should also check whether the user who claims to have ran your wrapper actually has *execution rights* to it! One could play an ld.so trick and execute it (AFAIR). There's probably more security concerns. You should see perl-suid sou

Re: setgid-wrapper

2004-05-19 Thread Grzegorz B. Prokopski
On (19/05/04 13:14), Grzegorz B. Prokopski wrote: > On (19/05/04 15:54), Goswin von Brederlow wrote: > > Could it be you mean bash droping the setuid/setgid bits when it is > > set setuid/setgid? Thats a bash speciality preventing hackers to > > setuid/gid bash as so many root

Re: setgid-wrapper

2004-05-19 Thread Grzegorz B. Prokopski
root.root /usr/lib/my_util/util BTW: your wrapper should also check whether the user who claims to have ran your wrapper actually has *execution rights* to it! One could play an ld.so trick and execute it (AFAIR). There's probably more security concerns. You should see perl-suid sou

Re: setgid-wrapper

2004-05-19 Thread Grzegorz B. Prokopski
On (19/05/04 13:14), Grzegorz B. Prokopski wrote: > On (19/05/04 15:54), Goswin von Brederlow wrote: > > Could it be you mean bash droping the setuid/setgid bits when it is > > set setuid/setgid? Thats a bash speciality preventing hackers to > > setuid/gid bash as so many root

Re: setgid-wrapper

2004-05-19 Thread Grzegorz B. Prokopski
this. The only thing I am afraid of is that there's some quirk we can't see and that can open a serious security hole. You should at least try to discuss the implementation once its done (there's not much to do, right?). Not to mention that you should be absolutely ANAL about all standard

Re: setgid-wrapper

2004-05-19 Thread Grzegorz B. Prokopski
this. The only thing I am afraid of is that there's some quirk we can't see and that can open a serious security hole. You should at least try to discuss the implementation once its done (there's not much to do, right?). Not to mention that you should be absolutely ANAL about all standard

Re: ITA: filler - Simple game in Java

2004-05-11 Thread Grzegorz B. Prokopski
in in a week if you still want your package to be reviewed and uploaded by me. I am very sorry about it, but I really have a very unpleseant deadline to deal with. Cheers, Grzegorz B. Prokopski -- Grzegorz B. Prokopski <[EMAIL PROTECTED]> Debian GNU/Linux http://www.debian.org SableVM - LGPLed JVM http://www.sablevm.org Why SableVM ?!? http://devel.sablevm.org/wiki/WhySableVM

Re: ITA: filler - Simple game in Java

2004-05-11 Thread Grzegorz B. Prokopski
in in a week if you still want your package to be reviewed and uploaded by me. I am very sorry about it, but I really have a very unpleseant deadline to deal with. Cheers, Grzegorz B. Prokopski -- Grzegorz B. Prokopski <[EMAIL PROTECTED]> Debian GNU/Lin