Re: Allegations regarding OpenBSD IPSEC

2010-12-16 Thread Theo de Raadt
> > Here's a tip: when a government organization works with private > > contractors to help them spy on other government organizations, those > > NDAs don't fucking expire. > > > > Jesus. > > That is what I would expect. > > >From memory, in my part of the World if you did this sort of work for >

Re: Allegations regarding OpenBSD IPSEC

2010-12-16 Thread Theo de Raadt
> I about talked myself out of believing that this happened after explaining > this to a cow-orker today. They were quite surprised i'd buy into something > this speculative and far fetched at all. After listening to him generalize > it back to me it seems even sillier. I think you are totally mis

Re: Allegations regarding OpenBSD IPSEC

2010-12-16 Thread SJP Lists
On Friday, 17 December 2010, (private) HKS wrote: > On Thu, Dec 16, 2010 at 4:47 AM, Joachim Schipper > wrote: >> On Wed, Dec 15, 2010 at 07:04:27PM +, Kevin Chadwick wrote: >>> "Jason L. Wright" wrote: >>> >I cannot fathom his motivation for writing such falsehood >> >>> >The real work on O

Re: Allegations regarding OpenBSD IPSEC

2010-12-16 Thread (private) HKS
On Thu, Dec 16, 2010 at 4:47 AM, Joachim Schipper wrote: > On Wed, Dec 15, 2010 at 07:04:27PM +, Kevin Chadwick wrote: >> "Jason L. Wright" wrote: >> >I cannot fathom his motivation for writing such falsehood > >> >The real work on OCF did not begin in earnest until February 2000. >> >> I can

Re: Allegations regarding OpenBSD IPSEC

2010-12-16 Thread Carson Harding
The item I find interesting in all this is one I have not seen commented on: "the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemente

Re: Allegations regarding OpenBSD IPSEC

2010-12-16 Thread Rod Whitworth
On Fri, 17 Dec 2010 00:30:27 +0100, Marc Espie wrote: > if you read french, go check >http://www.macgeneration.com/news/voir/180982/un-systeme-espion-du-fbi-dans-openbsd >and be amazed at how clueless those writers are. Gee, even the google page translation makes it clearer than my rusty frangais

Re: Allegations regarding OpenBSD IPSEC

2010-12-16 Thread Brandon Mercer
I about talked myself out of believing that this happened after explaining this to a cow-orker today. They were quite surprised i'd buy into something this speculative and far fetched at all. After listening to him generalize it back to me it seems even sillier. Brandon On Dec 16, 2010 6:34 PM, "Ma

Re: Allegations regarding OpenBSD IPSEC

2010-12-16 Thread Marc Espie
I'm not going to comment on the mail itself, but I've seen a lot of incredibly dubious articles on the net over the last few days. - use your brains, people. Just because a guy does say so doesn't mean there's a backdoor. Ever heard about FUD ? - of course OpenBSD is going to check. Geeez!! what

uticom firmware

2010-12-16 Thread Alexander Schrijver
This diff makes the uticom(4) driver work on my machine with an Abbott USB converter, which is used to connect to the Abbott Freestyle series glucose meter. This makes the firmware loading work again. Index: usbdevs === RCS file: /ho

Re: set loginterface [if|ifgroup|none|all]

2010-12-16 Thread Han Boetes
Henning Brauer wrote: > * Han Boetes [2010-12-16 16:41]: > > If it was easy I bet you would already have fixed it. And you're > > much more of a coder than me. > > it should be rather easy actually. i just never got around to do it. Well half of the job has already been done. ;-) # Han

Destructoras de Papel

2010-12-16 Thread DigitalesNet
USD19,60 DESTRUCTORA DE PAPEL USB Ng-188 Nueva Trituradora NOGA NET NG-188 / Capacidad: una hoja A4 doblada / Velocidad: 0.6 m / min / Conexion:

Re: set loginterface [if|ifgroup|none|all]

2010-12-16 Thread Henning Brauer
* Han Boetes [2010-12-16 16:41]: > If it was easy I bet you would already have fixed it. And you're > much more of a coder than me. it should be rather easy actually. i just never got around to do it. -- Henning Brauer, h...@bsws.de, henn...@openbsd.org BS Web Services, http://bsws.de Full-Serv

Re: slower logins

2010-12-16 Thread Ted Unangst
Curse you gmail. CC tech this time On Thu, Dec 16, 2010 at 11:39 AM, Ted Unangst wrote: > On Thu, Dec 16, 2010 at 10:14 AM, Bob Beck wrote: >> Show me colin percivals' peer reviewed paper about this new scheme, >> and where it has been compared to bcrypt. then go read neil's paper >> on the su

Re: slower logins

2010-12-16 Thread Joachim Schipper
On Thu, Dec 16, 2010 at 08:14:06AM -0700, Bob Beck wrote: > > Why not? An attacker can, after all, brute-force your password on a > > machine of his choice. Silently decreasing the number of rounds on older > > architectures surprises the user in a way that can lead to password > > compromise ("My

Re: slower logins

2010-12-16 Thread Bob Beck
On 16 December 2010 05:38, Mike Belopuhov wrote: > I was about to do the same and do some measurements to back my > words up, but got distracted. I'm strongly in a favor of > increasing number of rounds at least to 2^8. Solar Designer > uses this number of rounds in Openwall for quite some time

Re: set loginterface [if|ifgroup|none|all]

2010-12-16 Thread Han Boetes
If it was easy I bet you would already have fixed it. And you're much more of a coder than me. Henning Brauer wrote: > if memory serves set logingterface for anything but a single > interface doesn't lead to the intended results, so this is on purpose. > unless you fix the code so that pfctl -si

Re: slower logins

2010-12-16 Thread Bob Beck
> Why not? An attacker can, after all, brute-force your password on a > machine of his choice. Silently decreasing the number of rounds on older > architectures surprises the user in a way that can lead to password > compromise ("My password was brute-forced because I used it on a sparc?! > I would

Re: slower logins

2010-12-16 Thread Ted Unangst
On Thu, Dec 16, 2010 at 4:35 AM, Joachim Schipper wrote: > On Wed, Dec 15, 2010 at 09:42:52PM -0700, Bob Beck wrote: >> I don't mind [increasing the number of Blowfish rounds] if the >> eventual goal is to think about diddling with it per arch.. >> >> I certainly do NOT want a 2^11 blowfish passwo

Re: slower logins

2010-12-16 Thread Mike Belopuhov
I was about to do the same and do some measurements to back my words up, but got distracted. I'm strongly in a favor of increasing number of rounds at least to 2^8. Solar Designer uses this number of rounds in Openwall for quite some time now. On Thu, Dec 16, 2010 at 5:42 AM, Bob Beck wrote: >

Re: set loginterface [if|ifgroup|none|all]

2010-12-16 Thread Henning Brauer
if memory serves set logingterface for anything but a single interface doesn't lead to the intended results, so this is on purpose. unless you fix the code so that pfctl -si shows the sum for all interfaces in the given group, there is no point at all. * Han Boetes [2010-12-16 12:16]: > Hi, > >

set loginterface [if|ifgroup|none|all]

2010-12-16 Thread Han Boetes
Hi, I took a leap of faith and discovered some options not mentioned in pf.conf(5). What do you think of this patch? Index: share/man/man5/pf.conf.5 === RCS file: /cvs/src/share/man/man5/pf.conf.5,v retrieving revision 1.476 diff -u

Re: slower logins

2010-12-16 Thread Joachim Schipper
On Wed, Dec 15, 2010 at 09:42:52PM -0700, Bob Beck wrote: > I don't mind [increasing the number of Blowfish rounds] if the > eventual goal is to think about diddling with it per arch.. > > I certainly do NOT want a 2^11 blowfish password when logging into my > sparc Why not? An attacker can, afte

Re: Allegations regarding OpenBSD IPSEC

2010-12-16 Thread Joachim Schipper
On Wed, Dec 15, 2010 at 07:04:27PM +, Kevin Chadwick wrote: > "Jason L. Wright" wrote: > >I cannot fathom his motivation for writing such falsehood > >The real work on OCF did not begin in earnest until February 2000. > > I can't see how this gives you credibility but maybe the people who >

Re: diff to bsearch the autoconf vendor/product match tables

2010-12-16 Thread Mark Kettenis
> Date: Thu, 16 Dec 2010 02:39:47 +0200 > From: Vladimir Kirillov > > Hello, t...@! > > The pci/usb (and others) known_{products,vendors} generated from > {pci,usb}devs are really big and scanning them is not so efficient. > > I took the reyk@'s bsearch() implementation found in ieee80211 code