Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Watson Ladd
On Wed, Apr 9, 2014 at 5:43 PM, Joe Btfsplk wrote: > On 4/9/2014 1:29 PM, Christopher J. Walters wrote: >> >> It seems no one wants to talk or hear about this issue. It is not being >> reported on media sites or anywhere else, other than the Heartbleed site, >> and the OpenSSL lists > > It's all o

Re: [tor-talk] strange behavior of Tor Browser on Windows 8.1

2014-04-09 Thread Joe Btfsplk
On 4/9/2014 11:21 AM, s...@sky-ip.org wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, I have upgraded to latest Tor Browser Bundle version: 3.5.4 - Windows 32 bit. My operating system is Windows 8.1 Pro Enterprise, 64 bit. The odd things i have noticed (which didn't happen in previ

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Joe Btfsplk
On 4/9/2014 1:29 PM, Christopher J. Walters wrote: It seems no one wants to talk or hear about this issue. It is not being reported on media sites or anywhere else, other than the Heartbleed site, and the OpenSSL lists It's all over the internet, when I look in Ixquick / Startpage. Possible t

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Joe Btfsplk
On 4/9/2014 12:36 PM, Andrew F wrote: Would be interesting if someone created an app to test for the problem and then published which big websites are slow to upgrade. that would certainly be good for consumers. Well, one website sorta has. They seem to have more extensive testing for overall s

Re: [tor-talk] Linux kernel transproxy packet leak (w/ repro case + workaround)

2014-04-09 Thread Patrick Schleizer
Mike Perry: > At this point, you will see a FIN ACK or RST ACK packet appear in your > tcpdump window. That packet has leaked past the iptables firewall rules, > and past the transproxy rules. It went straight to Google. Can you post an example log please how it's the tcpdump output is looking whe

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Jann Horn
On Wed, Apr 09, 2014 at 03:07:11PM -0400, Christopher J. Walters wrote: > On 4/9/2014 3:04 PM, Michael Wolf wrote: > >On 4/9/2014 2:29 PM, Christopher J. Walters wrote: > > > >>This bug has been a known issue for about 2 years, and we are only now > >>learning about it. > > > >The bug has existed f

Re: [tor-talk] Linux kernel transproxy packet leak (w/ repro case + workaround)

2014-04-09 Thread Patrick Schleizer
Has this bug been reported upstream against the Linux kernel on kernel.org? -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Christopher J. Walters
On 4/9/2014 2:49 PM, Jann Horn wrote: On Wed, Apr 09, 2014 at 02:29:19PM -0400, Christopher J. Walters wrote: It seems no one wants to talk or hear about this issue. It is not being reported on media sites or anywhere else, other than the Heartbleed site, and the OpenSSL lists. And FD... and

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Michael Wolf
On 4/9/2014 2:29 PM, Christopher J. Walters wrote: > This bug has been a known issue for about 2 years, and we are only now > learning about it. The bug has existed for about 2 years, but was not a "known issue" before the last week or so. (Excluding, of course, criminals and such who may have f

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Christopher J. Walters
On 4/9/2014 3:04 PM, Michael Wolf wrote: On 4/9/2014 2:29 PM, Christopher J. Walters wrote: This bug has been a known issue for about 2 years, and we are only now learning about it. The bug has existed for about 2 years, but was not a "known issue" before the last week or so. (Excluding, of

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Jann Horn
On Wed, Apr 09, 2014 at 02:29:19PM -0400, Christopher J. Walters wrote: > It seems no one wants to talk or hear about this issue. It is not > being reported on media sites or anywhere else, other than the > Heartbleed site, and the OpenSSL lists. And FD... and arstechnica... and Heise... > This

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Christopher J. Walters
On 4/9/2014 12:57 PM, Joe Btfsplk wrote: On 4/8/2014 5:24 PM, Joe Btfsplk wrote: On 4/8/2014 4:25 PM, grarpamp wrote: https://blog.torproject.org/ covers what to do for Tor things. .snip. http://s3.jspenguin.org/ssltest.py https://gist.github.com/takeshixx/10107280 https://github.com/FiloSot

Re: [tor-talk] [tor-dev] Linux kernel transproxy packet leak (w/ repro case + workaround)

2014-04-09 Thread Abel Luck
Abel Luck: > On Saturday 29 March 2014 03:10:47 grarpamp wrote: > > On Fri, Mar 28, 2014 at 5:20 PM, intrigeri wrote: > > > grarpamp wrote (28 Mar 2014 21:02:35 GMT) : > > >> [...] what happens with entire vm IP transproxy (perhaps like > > >> Tails)? > > > > > > Tails only uses a transproxy for

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Andrew F
Would be interesting if someone created an app to test for the problem and then published which big websites are slow to upgrade. that would certainly be good for consumers. On Wed, Apr 9, 2014 at 9:57 AM, Joe Btfsplk wrote: > On 4/8/2014 5:24 PM, Joe Btfsplk wrote: > >> On 4/8/2014 4:25 PM, gr

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

2014-04-09 Thread Joe Btfsplk
On 4/8/2014 5:24 PM, Joe Btfsplk wrote: On 4/8/2014 4:25 PM, grarpamp wrote: https://blog.torproject.org/ covers what to do for Tor things. For everything else on the net, fix the clients and servers you're responsible for. Then... You're right, there's a big gotcha in all this, users won't r

[tor-talk] strange behavior of Tor Browser on Windows 8.1

2014-04-09 Thread s...@sky-ip.org
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, I have upgraded to latest Tor Browser Bundle version: 3.5.4 - Windows 32 bit. My operating system is Windows 8.1 Pro Enterprise, 64 bit. The odd things i have noticed (which didn't happen in previous versions) are: 1. Some kind of cookie / se

Re: [tor-talk] TBB 3.5.4 says I should upgrade

2014-04-09 Thread Joe Btfsplk
On 4/9/2014 4:52 AM, Roger Dingledine wrote: On Wed, Apr 09, 2014 at 09:32:08AM +, antispa...@sent.at wrote: I downloaded the right archive and overwrote the existing folder (3.5.3). Restarted and the yellow triangle is still there. On the upper right corner it's written 3.5.4, yet the welco

[tor-talk] Tor Weekly News — April 9th, 2014

2014-04-09 Thread harmony
Tor Weekly News April 9th, 2014 Welcome to the fourteenth issue of Tor Weekly News in 2014, the weekly newslett

Re: [tor-talk] TBB 3.5.4 says I should upgrade

2014-04-09 Thread Roger Dingledine
On Wed, Apr 09, 2014 at 09:32:08AM +, antispa...@sent.at wrote: > I downloaded the right archive and overwrote the existing folder > (3.5.3). Restarted and the yellow triangle is still there. On the upper > right corner it's written 3.5.4, yet the welcome page says: > > > HOWEVER, this browser

[tor-talk] TBB 3.5.4 says I should upgrade

2014-04-09 Thread antispam06
I downloaded the right archive and overwrote the existing folder (3.5.3). Restarted and the yellow triangle is still there. On the upper right corner it's written 3.5.4, yet the welcome page says: > HOWEVER, this browser is out of date. Am I doing something wrong? -- tor-talk mailing list - tor-