Re: Warning to NoReply.org DEB Package Users

2007-08-11 Thread Mike Cardwell
* on the Fri, Aug 10, 2007 at 04:12:21PM -0400, Ringo Kamens wrote: As you know, a major security vulnerability was just patched with the 0.1.2.16 release. I have been using the noreply.org deb packages but they didn't update to the newest version (at least not under amd64 feisty). If you are

Re: Warning to NoReply.org DEB Package Users

2007-08-11 Thread Florian Reitmeir
On Fri, 10 Aug 2007, coderman wrote: On 8/10/07, Ringo Kamens [EMAIL PROTECTED] wrote: I think what he is saying (which might be true) is that tor doesn't have the permissions to save the torcc. there are some configurations that don't allow saving the config. they are still vulnerable.

Re: Warning to NoReply.org DEB Package Users

2007-08-11 Thread Florian Reitmeir
On Fri, 10 Aug 2007, Kyle Williams wrote: This is not true. The affects of the bug are very sever, and it DOES NOT require the config to be saved! An attacker could still cause you to loose your anonymity. UPDATE, UPDATE, UPDATE. like i wrote before, you are only vunerable if you have the

Re: Warning to NoReply.org DEB Package Users

2007-08-11 Thread Ringo Kamens
@Mike: Good to know. I'll just use the etch version for now since feisty isn't out. Comrade Ringo Kamens On 8/11/07, Florian Reitmeir [EMAIL PROTECTED] wrote: On Fri, 10 Aug 2007, Kyle Williams wrote: This is not true. The affects of the bug are very sever, and it DOES NOT require the

Question about the vulnerability

2007-08-11 Thread nobledark
Hi, Forgive my ignorance, but when exactly does the Control Port come into play? Is a Tor user who simply uses Tor in client mode vulnerable? I've seen the Control Port info in the man pages but that doesn't really answer my question - can anyone advise? Thanks... -- Physical Therapy

Re: Question about the vulnerability

2007-08-11 Thread Roger Dingledine
On Sat, Aug 11, 2007 at 02:21:31PM -0400, [EMAIL PROTECTED] wrote: Forgive my ignorance, but when exactly does the Control Port come into play? Is a Tor user who simply uses Tor in client mode vulnerable? I've seen the Control Port info in the man pages but that doesn't really answer my

ModSecurity v2 Apache rules for directory servers

2007-08-11 Thread Mike Cardwell
On http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#ServerForFirewalledClients one of the suggested methods to get your Directory service on port 80 if Apache is in the way is to use mod_proxy. Personally I think sticking tors directory service behind Apache so it's not exposed to the

Re: Question about the vulnerability

2007-08-11 Thread nobledark
Roger, thank you for your response - I did follow that thread when it came out and upgraded my systems. The question I have is not really about the vulnerability but more of a general operational one - in what situations is the control port actually used? If I am not running a Tor server but

Re: Question about the vulnerability

2007-08-11 Thread Freemor
On Sat, 2007-11-08 at 15:33 -0400, [EMAIL PROTECTED] wrote: Roger, thank you for your response - I did follow that thread when it came out and upgraded my systems. The question I have is not really about the vulnerability but more of a general operational one - in what situations is the

Re: Question about the vulnerability

2007-08-11 Thread nobledark
Freemor, thanks a lot - that makes perfect sense...glad I upgraded :) -Nd On Sat, 11 Aug 2007 18:13:12 -0400 Freemor [EMAIL PROTECTED] wrote: On Sat, 2007-11-08 at 15:33 -0400, [EMAIL PROTECTED] wrote: Roger, thank you for your response - I did follow that thread when it came out and

Re: New Hidden Wiki

2007-08-11 Thread Ringo Kamens
Respect and stay safe. You are a hero. Comrade Ringo Kamens On 8/11/07, Matthew [EMAIL PROTECTED] wrote: I just put up a new hidden wiki. It's at http://624eb2rznzhtq2cz.onion/ With a little googling, I found a page that had the main page of the old hidden wiki, so I put it up as the main