[Tails-dev] Old unresolved security-related Firefox issue

2013-10-22 Thread Andreas Kuckartz
The security of Firefox/Iceweasel is important for the security of Tails. I therefore suggest to have a look at this old unresolved Firefox issue and vote for it. Years ago people working for RedHat spent a lot of time to create a patch which does not yet seem to have been applied. Resolving the

Re: [Tails-dev] Control Port / Timing of the move to FF24

2013-10-22 Thread intrigeri
adrelanos wrote (22 Oct 2013 04:24:06 GMT) : I think it won't leave anyone's wishes for features open, even has a .d config folder - unless you'd like to see a rewrite in something other than bash. So if you like my implementation or have any feature requests, I may be able to polish it and

Re: [Tails-dev] Please review'n'merge bugfix/world-readable-persistence-state-file

2013-10-22 Thread bertagaz
On Fri, Oct 18, 2013 at 02:19:13PM +0200, intrigeri wrote: Hi, * branch: bugfix/world-readable-persistence-state-file, both in the tails-greeter and main Git repositories (+ APT) * ticket: https://labs.riseup.net/code/issues/6374 This branch fixes #6374, that was discovered while

Re: [Tails-dev] Please review feature/consistent-persistence-path

2013-10-22 Thread intrigeri
Hi, Merged, building on lizard. Actually, the branch as proposed for merging was basically a no-op, as merging testing in it brought in a revert of the interesting code (as that branch had been merged by mistake, then reverted, in the 0.20 cycle IIRC). So I had to revert the revert, woo! This

Re: [Tails-dev] Tor Launcher extension [Was: Mike's March 2013]

2013-10-22 Thread intrigeri
Hi Mike, hi Pearl Crescent team! Mike Perry wrote (02 Apr 2013 08:52:56 GMT) : Thus spake intrigeri (intrig...@boum.org): 1. Any obvious showstopper, off the top of your head, regarding how the Tor Launcher could be usable for Tails? I think you guys mostly won't use it. Back in April, I

Re: [Tails-dev] Bug#725779: libotr: OTR clients supporting both OTRv1 and v2 are subject to protocol downgrade attacks

2013-10-22 Thread intrigeri
Hi Thibault, intrig...@debian.org wrote (08 Oct 2013 09:27:56 GMT) : as you are surely aware of, it's been known [1] since 2006 that clients supporting both OTRv1 and v2 (such as libotr 3.x) are subject to protocol downgrade attacks clients. It's also been known for a while that OTRv1 has

Re: [Tails-dev] Bug#725779: libotr: OTR clients supporting both OTRv1 and v2 are subject to protocol downgrade attacks

2013-10-22 Thread Thibaut Varène
On 22 oct. 2013, at 20:17, intrigeri intrig...@debian.org wrote: Hi Thibault, Hi, intrig...@debian.org wrote (08 Oct 2013 09:27:56 GMT) : as you are surely aware of, it's been known [1] since 2006 that clients supporting both OTRv1 and v2 (such as libotr 3.x) are subject to protocol

Re: [Tails-dev] Bug#725779: libotr: OTR clients supporting both OTRv1 and v2 are subject to protocol downgrade attacks

2013-10-22 Thread Ian Goldberg
On Wed, Oct 23, 2013 at 12:35:09AM +0200, Thibaut Varène wrote: intrig...@debian.org wrote (08 Oct 2013 09:27:56 GMT) : as you are surely aware of, it's been known [1] since 2006 that clients supporting both OTRv1 and v2 (such as libotr 3.x) are subject to protocol downgrade attacks

Re: [Tails-dev] Bug#725779: libotr: OTR clients supporting both OTRv1 and v2 are subject to protocol downgrade attacks

2013-10-22 Thread Thibaut Varène
On 23 oct. 2013, at 01:53, Ian Goldberg i...@cypherpunks.ca wrote: To be explicit, removing support for OTRv1 from libotr 3.x is totally fine (and indeed libotr 4.x has already done it). Ian, thanks a lot for the input. I guess it's all good then, no objection for an NMU and thanks in advance

Re: [Tails-dev] Tor Launcher extension [Was: Mike's March 2013]

2013-10-22 Thread adrelanos
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Thank you for starting this discussion! intrigeri: Also, it would be really awesome if all major ways of using Tor (TBB, Tails, etc.) could provide the same interface for configuring how Tor should access the network. This would be interesting