Re: OpenSSL

2014-04-08 Thread Niels Dettenbach (Syndicat ITInternet)
On 8. April 2014 05:34:28 MESZ, Ludwig macpo...@metaspasm.org wrote: What else do I need to do about the addressed vulnerability besides updating the port — generate new keys or what? ...as far as i informed about the current security notice / patch in OpenSSH (!) it makes no sense to generate

Re: OpenSSL

2014-04-08 Thread René J . V . Bertin
Hello, I wonder, how feasible would it be to replace the system OpenSSL with the one from MacPorts? If security updates are pushed this quickly it would make sense for just about any OS X version, but even more so for those of us still running 10.6 ... R. On Tuesday April 08 2014 08:24:16

Re: OpenSSL

2014-04-08 Thread Ned Deily
In article 2628775.Ob0fHhrzob@patux, René J.V. Bertin rjvber...@gmail.com wrote: I wonder, how feasible would it be to replace the system OpenSSL with the one from MacPorts? If security updates are pushed this quickly it would make sense for just about any OS X version, but even more so for

port command arguments

2014-04-08 Thread René J . V . Bertin
Hello, This is a bit of a flyer/test ... These days I spend my time switching back and forth between Linux/Debian and OS X. The various package management tools I use on the former (apt, apt-get, aptitude) all have a very similar syntax, but port has a number of just-or-completely different

Re: port command arguments

2014-04-08 Thread Ryan Schmidt
On Apr 8, 2014, at 02:00, René J.V. Bertin wrote: These days I spend my time switching back and forth between Linux/Debian and OS X. The various package management tools I use on the former (apt, apt-get, aptitude) all have a very similar syntax, but port has a number of

Can MacPorts be used without full Xcode without any issues?

2014-04-08 Thread Amarendra Kumar
The install instruction still starts with: Install Xcode and the Xcode Command Line Tools But I cannot afford to put aside 5+GB on my 120GB machine that I shall never use. So, is there any way or any beta MacPorts that doesn't require full Xcode as a must? Or is there a work around? *PS*. As

Re: Can MacPorts be used without full Xcode without any issues?

2014-04-08 Thread Ryan Schmidt
On Apr 8, 2014, at 05:06, Amarendra Kumar wrote: The install instruction still starts with: Install Xcode and the Xcode Command Line Tools But I cannot afford to put aside 5+GB on my 120GB machine that I shall never use. So, is there any way or any beta MacPorts that doesn't require full

Re: Can MacPorts be used without full Xcode without any issues?

2014-04-08 Thread Amarendra Kumar
Yes, I have CMD Line Tools installed but any port I tried to install I got an error and none of them worked. I didn't face this issue with Homebrew though so I thought I'll ask here as I might be doing sth wrong. Also, can I use MacPorts even if Homebrew is installed? Homebrew throws error and

Re: Can MacPorts be used without full Xcode without any issues?

2014-04-08 Thread Ryan Schmidt
On Apr 8, 2014, at 07:33, Amarendra Kumar wrote: Yes, I have CMD Line Tools installed but any port I tried to install I got an error and none of them worked. I didn't face this issue with Homebrew though so I thought I'll ask here as I might be doing sth wrong. My understanding is that

OpenSSL

2014-04-08 Thread Joshua Root
Niels Dettenbach wrote: On 8. April 2014 05:34:28 MESZ, Ludwig macports at metaspasm.org wrote: What else do I need to do about the addressed vulnerability besides updating the port — generate new keys or what? ...as far as i informed about the current security notice / patch in OpenSSH (!)

Re: OpenSSL

2014-04-08 Thread Niels Dettenbach
Am Dienstag, 8. April 2014, 22:37:53 schrieb Joshua Root: ...as far as i informed about the current security notice / patch in OpenSSH (!) it makes no sense to generate new host or client keys. It could make sense to delete the known_hosts as the sec flaw could make it possible in

Re: Can MacPorts be used without full Xcode without any issues?

2014-04-08 Thread Clemens Lang
Hi, Yes, I have CMD Line Tools installed but any port I tried to install I got an error and none of them worked. I didn't face this issue with Homebrew though so I thought I'll ask here as I might be doing sth wrong. My understanding is that Homebrew supports the use of the command line

Re: OpenSSL

2014-04-08 Thread René J . V . Bertin
On Monday April 07 2014 23:58:37 Ned Deily wrote: Don't even think of that! First, as you may know, most Apple-supplied programs don't use OpenSSL anyway (at least since 10.7 when it was This I didn't know ... officially deprecated). Second, the Heartbleed bug only applies to OpenSSL

Re: OpenSSL

2014-04-08 Thread Harald Hanche-Olsen
[Niels Dettenbach n...@syndicat.com (2014-04-08 12:46:27 UTC)] Anyhow: where server secret keys could be changed more easily (i.e. SSH host keys) this should be done. But ssh does not use the openssl libraries, so there is no point, as this bug will not have exposed the ssh host keys. –

Re: OpenSSL

2014-04-08 Thread Brandon Allbery
On Tue, Apr 8, 2014 at 2:03 PM, Harald Hanche-Olsen han...@math.ntnu.nowrote: But ssh does not use the openssl libraries, so there is no point, as this bug will not have exposed the ssh host keys. Actually, it does use the libraries. But only for crypto; it does not use the SSL protocol at

Re: OpenSSL

2014-04-08 Thread Niels Dettenbach
Am Dienstag, 8. April 2014, 20:03:30 schrieb Harald Hanche-Olsen: But ssh does not use the openssl libraries, so there is no point, as this bug will not have exposed the ssh host keys. hmm, i'm not deep into the OpenSSH developement yet, but i thought that OpenSSH does even use (or at least

Re: OpenSSL

2014-04-08 Thread Kastus Shchuka
On Apr 8, 2014, at 11:31 AM, Niels Dettenbach wrote: Am Dienstag, 8. April 2014, 20:03:30 schrieb Harald Hanche-Olsen: But ssh does not use the openssl libraries, so there is no point, as this bug will not have exposed the ssh host keys. hmm, i'm not deep into the OpenSSH developement yet,

Re: OpenSSL

2014-04-08 Thread Brandon Allbery
On Tue, Apr 8, 2014 at 2:49 PM, Kastus Shchuka macpo...@tprfct.net wrote: On Apr 8, 2014, at 11:31 AM, Niels Dettenbach wrote: But as far as i can read til now OpenSSH uses OpenSSL code not related to TLS/SSL or the ASN.1 parser which is affected here - but yesterday and today some

Re: OpenSSL

2014-04-08 Thread Ned Deily
In article 1496567.dPnP996dF6@patux, Rene J.V. Bertin rjvber...@gmail.com wrote: On Monday April 07 2014 23:58:37 Ned Deily wrote: Don't even think of that! First, as you may know, most Apple-supplied programs don't use OpenSSL anyway (at least since 10.7 when it was This I didn't know