Re: Fixing stupid PHP application design flaws

2005-04-28 Thread Javier Fernández-Sanguino Peña
On Thu, Apr 28, 2005 at 10:04:00PM +0200, Hans Spaans wrote: > Is this going to solve the problems? Don't get me wrong, because I love > your goal but I don't believe that what you suggesting right now is > going to solve the problems with PHP at this moment. Maybe its an idea > to get in contact w

Re: Fixing stupid PHP application design flaws

2005-04-28 Thread Jean Christophe André
Hans Spaans a Ãcrit : It may be a better idea to start with PHP itself and ask during installation of the users wants to install a secure or insecure version of php4.ini. The same is done with setuid issues for example. Great idea! And I would suggest to have multiple choices, depending on the leve

Re: Fixing stupid PHP application design flaws

2005-04-28 Thread Hans Spaans
Martin Schulze wrote: > Hey! > > What do people on this list think about fixing PHP include files in a > DSA that are accessible via HTTP as well and contain one bug or > another as they are not supposed to be accessible via HTTP but > accidently are. Patching them like Squirrelmail has fixed thi

Re: how to display the SSHd fingerprint

2005-04-28 Thread Dominic Hargreaves
On Thu, Apr 28, 2005 at 07:37:19PM +0200, martin f krafft wrote: > echo /etc/ssh/ssh_host_dsa_key | ssh-keygen -l > > is a little ugly to parse... ssh-keygen -l -f /etc/ssh/ssh_host_dsa_key being the obvious improvement... -- Dominic Hargreaves | http://www.larted.org.uk/~dom/ PGP key 5178

Re: how to display the SSHd fingerprint

2005-04-28 Thread martin f krafft
also sprach Dominic Hargreaves <[EMAIL PROTECTED]> [2005.04.28.1926 +0200]: > > How can I find out the SSHD key fingerprint given the local file? > > ssh-keygen -l Thanks! No way to do so from a script? echo /etc/ssh/ssh_host_dsa_key | ssh-keygen -l is a little ugly to parse... -- Please

Re: how to display the SSHd fingerprint

2005-04-28 Thread Dominic Hargreaves
On Thu, Apr 28, 2005 at 07:24:11PM +0200, martin f krafft wrote: > How can I find out the SSHD key fingerprint given the local file? ssh-keygen -l Cheers, -- Dominic Hargreaves | http://www.larted.org.uk/~dom/ PGP key 5178E2A5 from the.earth.li (keyserver,web,email) -- To UNSUBSCRIBE, email

how to display the SSHd fingerprint

2005-04-28 Thread martin f krafft
How can I find out the SSHD key fingerprint given the local file? openssl dsa -in /etc/ssh/ssh_host_dsa_key -noout -text does not seem to produce the desired output. Thanks, -- Please do not send copies of list mail to me; I read the list! .''`. martin f. krafft <[EMAIL PROTECTED]> :

Re: Fixing stupid PHP application design flaws

2005-04-28 Thread Henrique de Moraes Holschuh
On Thu, 28 Apr 2005, Martin Schulze wrote: > What do people on this list think about fixing PHP include files in a > DSA that are accessible via HTTP as well and contain one bug or > another as they are not supposed to be accessible via HTTP but > accidently are. I think not only we should do it,

Re: [SECURITY] [DSA 719-1] New prozilla packages fix arbitrary code execution

2005-04-28 Thread Ulrik De Bie
http://www.debian.org/security/2005/dsa-718 the previous announcement already mentioned this prozilla as the fix instead of the ethereal package .. __ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yaho

Re: Fixing stupid PHP application design flaws

2005-04-28 Thread Jeroen van Wolffelaar
On Thu, Apr 28, 2005 at 03:15:08PM +0200, Martin Schulze wrote: > Hey! > > What do people on this list think about fixing PHP include files in a > DSA that are accessible via HTTP as well and contain one bug or > another as they are not supposed to be accessible via HTTP but > accidently are. > >

Fixing stupid PHP application design flaws

2005-04-28 Thread Martin Schulze
Hey! What do people on this list think about fixing PHP include files in a DSA that are accessible via HTTP as well and contain one bug or another as they are not supposed to be accessible via HTTP but accidently are. I'm rather annoyed by the lack of comptence of some PHP coders who manage their