What we should do (Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...))

2014-04-18 Thread Joel Rees
Okay, the short version of the long post: If you don't know what to do about things like the heartbeat/bleed bug, I'm suggesting we all start contributing more to the projects we regularly use. Learn to code if we haven't. Report bugs. Help with documentation and localization. That's how we redu

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-18 Thread David Guntner
Joel Rees grabbed a keyboard and wrote: > (Reader beware. Length breeds length.) And this whole thread has gone on (and morphed) entirely too long. Please take it to the Debian Offtopic list. http://lists.alioth.debian.org/mailman/listinfo/d-community-offtopic smime.p7s Description: S/MIME Cr

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-18 Thread Joel Rees
(Reader beware. Length breeds length.) On Thu, Apr 17, 2014 at 10:57 PM, somebody wrote: > On 4/17/2014 5:40 AM, Curt wrote: > >> On 2014-04-17, ken wrote: >> >>> >>> Steve brings up a very good point, one often overlooked in our zeal for >>> getting so much FOSS for absolutely no cost. Since w

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-17 Thread Jerry Stuckle
On 4/17/2014 10:31 AM, Curt wrote: On 2014-04-17, Jerry Stuckle wrote: This is a totally irresponsible post, showing the op knows very little about programming. http://en.wikipedia.org/wiki/Theo_de_Raadt Theo de Raadt (/ˈθiː.oʊ dɛˈrɔːt/; Dutch: [ˈteː.o dɛˈraːt]; born May 19, 1968) is a

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-17 Thread Curt
On 2014-04-17, Jerry Stuckle wrote: > > This is a totally irresponsible post, showing the op knows very little > about programming. http://en.wikipedia.org/wiki/Theo_de_Raadt Theo de Raadt (/ˈθiː.oʊ dɛˈrɔːt/; Dutch: [ˈteː.o dɛˈraːt]; born May 19, 1968) is a software engineer who lives in Calg

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-17 Thread Brad Alexander
On Thu, Apr 17, 2014 at 3:36 AM, ken wrote: > Steve brings up a very good point, one often overlooked in our zeal for > getting so much FOSS for absolutely no cost. Since we're all given the > source code, we're all in part responsible for it and for improving it. > This ethic should be visited

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-17 Thread Jerry Stuckle
On 4/17/2014 5:40 AM, Curt wrote: On 2014-04-17, ken wrote: Steve brings up a very good point, one often overlooked in our zeal for getting so much FOSS for absolutely no cost. Since we're all given the source code, we're all in part responsible for it and for improving it. I don't think th

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-17 Thread Curt
On 2014-04-17, ken wrote: > > Steve brings up a very good point, one often overlooked in our zeal for > getting so much FOSS for absolutely no cost. Since we're all given the > source code, we're all in part responsible for it and for improving it. I don't think the point is very good for the

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-17 Thread ken
On 04/16/2014 11:50 PM green wrote: Steve Litt wrote at 2014-04-16 13:05 -0500: I'd feel a lot better with 200 eyes than 4. Even 10 would make me nervous. But the fault is partly mine. I never contributed to the OpenSSL project, either with dollars or eyes. +1 Steve brings up a very good p

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread green
Steve Litt wrote at 2014-04-16 13:05 -0500: > I'd feel a lot better with 200 eyes than 4. Even 10 would make me > nervous. > > But the fault is partly mine. I never contributed to the OpenSSL > project, either with dollars or eyes. +1 signature.asc Description: Digital signature

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread Steve Litt
On Wed, 16 Apr 2014 08:48:01 -0600 Paul E Condon wrote: > On 20140416_0823+, Curt wrote: > > On 2014-04-16, Slavko wrote: > > Robin Seggelmann introduced the bug: > > > > >From the Sydney Morning Herald: > > > > Dr Seggelmann, of Münster in Germany, said the bug which > > introduced the

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread Ralph Katz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 04/16/2014 10:36 AM, Bill Wood wrote: > On Wed, 2014-04-16 at 09:01 -0400, shawn wilson wrote: >> On Wed, Apr 16, 2014 at 8:54 AM, John Hasler >> wrote: > . . . >>> What is medical identity theft? > > Theft of patient identity information, usually

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread Curt
On 2014-04-16, Paul E Condon wrote: >> >> Only four eyes? > > This is a silly rhetorical question. > How many 'eyes' are appropriate for a last, final look? > Many, many eyes had surely already looked at the same code before > this final look. We're talking about code *review*. >From the Syd

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread Paul E Condon
On 20140416_0754-0500, John Hasler wrote: > Bill Wood writes: > > I have noticed that everyone talks about the impact on the financial > > services sector but no one has mentioned the health care information > > sector. I understand that healthcare systems use SSL a great deal, > > and medical ide

Re: [OT] Medical identity theft was: Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread Karen Lewellen
Perhaps smiles. After all most countries do not associate so much critical information to one number. But many people do not put their private information by choice in places where security of a site is a risk either so. Sorry for the side track smiles. Kare On Wed, 16 Apr 2014, Lisi Reisz wr

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread Paul E Condon
On 20140416_0823+, Curt wrote: > On 2014-04-16, Slavko wrote: > > > > If this vulnerability comes not from newbie and was made by intent, > > thing are worse than wrong. Then it is an attack to alone fundamental of > > the free/open software. And what community about this? Where are > > inform

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread Bill Wood
On Wed, 2014-04-16 at 09:01 -0400, shawn wilson wrote: > On Wed, Apr 16, 2014 at 8:54 AM, John Hasler wrote: . . . > > What is medical identity theft? Theft of patient identity information, usually for the purpose of insurance fraud. > I'd also be interested seeing the proof for the claim (I

[OT] Medical identity theft was: Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread Lisi Reisz
On Wednesday 16 April 2014 14:54:03 Karen Lewellen wrote: > I give you an example of medical identity theft. At least how it > can happen stateside. > You are say a senior or someone with a print disability in a > doctor's office. > You must get help completing the forms, and the first question yo

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread Karen Lewellen
I give you an example of medical identity theft. At least how it can happen stateside. You are say a senior or someone with a print disability in a doctor's office. You must get help completing the forms, and the first question you must provide is...? your social security umber. Add that you

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread shawn wilson
On Wed, Apr 16, 2014 at 8:54 AM, John Hasler wrote: > Bill Wood writes: >> and medical identity theft has risen sharply in recent years. > > What is medical identity theft? I'd also be interested seeing the proof for the claim (I think he means medical data breaches but IDK anyone has disclosed

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread John Hasler
Bill Wood writes: > I have noticed that everyone talks about the impact on the financial > services sector but no one has mentioned the health care information > sector. I understand that healthcare systems use SSL a great deal, > and medical identity theft has risen sharply in recent years. What

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-16 Thread Curt
On 2014-04-16, Slavko wrote: > > If this vulnerability comes not from newbie and was made by intent, > thing are worse than wrong. Then it is an attack to alone fundamental of > the free/open software. And what community about this? Where are > information, from who this vulnerability arrived? It

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-15 Thread Slavko
Dňa 16. 4. 2014 1:50 Charles Kroeger wrote / napísal(a): > At this point, the probability is close to one that every target has had > its private keys extracted by multiple intelligence agencies. The real > question is whether or not someone deliberately inserted this bug into > OpenSSL, and

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-15 Thread Bill Wood
On Tue, 2014-04-15 at 15:55 -0400, Stephen Allen wrote: . . . > BTW Revenue Canada was hacked by this bug and publicly admitted so. So > far only a minimal number of people were affected. They were offline for > several days. I've been following this thread since it started, as well as some oth

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-15 Thread Charles Kroeger
On Tue, 15 Apr 2014 07:00:03 +0200 shawn wilson wrote: > >> On Apr 14, 2014 11:01 AM, "Chris Bannister" > >>wrote: > >> > On Mon, Apr 14, 2014 at 01:55:04AM -0500, Stan Hoeppner wrote: > >> > I read https://www.schneier.com/blog/archives/2014/04/heartbleed.html Here's the article from Bruce's

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-15 Thread Stephen Allen
On Tue, Apr 15, 2014 at 02:11:00PM +1200, Richard Hector wrote: > On 15/04/14 12:59, shawn wilson wrote: > >> That statement was made in the sense that at least the bank could have > >> > issued a statement along the lines of 'you may have heard of the > >> > heartbleed bug, we can assure all of ou

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-15 Thread Richard Hector
On 14/04/14 23:41, Richard Hector wrote: > The only local bank I've heard any info about is Kiwibank, who are > apparently not vulnerable due to running their systems on Windows. Heh. It turns out my bank, ASB, apparently uses Windows/IIS as well. I have yet to decide whether I'm happy about that.

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-15 Thread Curt
On 2014-04-15, John Hasler wrote: > > If I did any online banking (I don't) I'd change all the passwords no > matter what the banks said and consider closing the accounts and opening > new ones with different account numbers as well. Maybe with different > banks. Except that in the case of an un

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-15 Thread Martin Steigerwald
Am Dienstag, 15. April 2014, 11:41:34 schrieb Richard Hector: > On 15/04/14 02:03, Stan Hoeppner wrote: > >> I certainly wouldn't jump to conclusions that they're a bank therefore > >> > >> > they use IBM mainframes therefore they don't use OpenSSL therefore > >> > they're invulnerable, > > > >

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Chris Bannister
On Mon, Apr 14, 2014 at 10:34:29PM -0400, shawn wilson wrote: > On Apr 14, 2014 10:11 PM, "Richard Hector" wrote: > > They don't need to send an email, or anything intrusive. They just need > > to put a big notice on the login page of their internet banking site - > > along with (or instead of) al

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread shawn wilson
On Tue, Apr 15, 2014 at 12:44 AM, Chris Bannister wrote: > On Mon, Apr 14, 2014 at 08:59:30PM -0400, shawn wilson wrote: >> On Apr 14, 2014 11:01 AM, "Chris Bannister" >> wrote: >> > >> > On Mon, Apr 14, 2014 at 01:55:04AM -0500, Stan Hoeppner wrote: >> > > On 4/13/2014 10:03 PM, Chris Bannister

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Chris Bannister
On Mon, Apr 14, 2014 at 08:59:30PM -0400, shawn wilson wrote: > On Apr 14, 2014 11:01 AM, "Chris Bannister" > wrote: > > > > On Mon, Apr 14, 2014 at 01:55:04AM -0500, Stan Hoeppner wrote: > > > On 4/13/2014 10:03 PM, Chris Bannister wrote: > > > ... > > > > considering it is a catastrophe worse th

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread shawn wilson
On Apr 14, 2014 10:11 PM, "Richard Hector" wrote: > > On 15/04/14 12:59, shawn wilson wrote: > >> That statement was made in the sense that at least the bank could have > >> > issued a statement along the lines of 'you may have heard of the > >> > heartbleed bug, we can assure all of our customers

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Richard Hector
On 15/04/14 12:59, shawn wilson wrote: >> That statement was made in the sense that at least the bank could have >> > issued a statement along the lines of 'you may have heard of the >> > heartbleed bug, we can assure all of our customers that we are not >> > affected by this bug and there is no ne

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread shawn wilson
On Apr 14, 2014 9:15 PM, "John Hasler" wrote: > > shawn wilson writes: > > No, I don't want to hear from my bank unless there's a problem. If > > everything is going OK, don't spam me. If its not, by all means, let > > me know. This didn't affect them so don't tell me anything. > > You assume that

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread John Hasler
shawn wilson writes: > No, I don't want to hear from my bank unless there's a problem. If > everything is going OK, don't spam me. If its not, by all means, let > me know. This didn't affect them so don't tell me anything. You assume that they would tell you if they were affected. If I did any on

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread shawn wilson
On Apr 14, 2014 11:01 AM, "Chris Bannister" wrote: > > On Mon, Apr 14, 2014 at 01:55:04AM -0500, Stan Hoeppner wrote: > > On 4/13/2014 10:03 PM, Chris Bannister wrote: > > ... > > > considering it is a catastrophe worse than the Y2K bug. > > > > This is several orders of magnitude less severe than

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Richard Hector
On 15/04/14 02:03, Stan Hoeppner wrote: >> I certainly wouldn't jump to conclusions that they're a bank therefore >> > they use IBM mainframes therefore they don't use OpenSSL therefore >> > they're invulnerable, > I jumped to no conclusion. Do you see the word "bank" in my original > statement b

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread David Guntner
For those interested: http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/ --Dave smime.p7s Description: S/MIME Cryptographic Signature

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Chris Bannister
On Mon, Apr 14, 2014 at 01:55:04AM -0500, Stan Hoeppner wrote: > On 4/13/2014 10:03 PM, Chris Bannister wrote: > ... > > considering it is a catastrophe worse than the Y2K bug. > > This is several orders of magnitude less severe than Y2K. I read https://www.schneier.com/blog/archives/2014/04/he

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Stan Hoeppner
On 4/14/2014 6:41 AM, Richard Hector wrote: > On 14/04/14 23:31, Stan Hoeppner wrote: BTW, you shouldn't focus only on banks either. There are a lot of popular services that use free software a lot, some of which happen to include payment functionality. >> I did not "focusing on bank

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Andre
is it really necessary to discuss this on this list? -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: https://lists.debian.org/c62d2a36796a92df309092b679802...@cyberh0me.net

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Scott Ferguson
On 14/04/14 19:49, Curt wrote: > On 2014-04-14, Richard Hector wrote: >> >> This one, on the other hand, was generally not predicted, and was widely >> exploited before people got a chance to fix it. That's presumably still >> going on. > > Widely exploited? > > http://en.wikipedia.org/wiki/Hear

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Chris Angelico
On Mon, Apr 14, 2014 at 11:22 PM, Joel Rees wrote: > On Mon, Apr 14, 2014 at 8:41 PM, Richard Hector > wrote: >> >> The only local bank I've heard any info about is Kiwibank, who are >> apparently not vulnerable due to running their systems on Windows. > > > That's a laugh. Not vulnerable to this

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Joel Rees
On Mon, Apr 14, 2014 at 8:41 PM, Richard Hector wrote: > On 14/04/14 23:31, Stan Hoeppner wrote: > >> > BTW, you shouldn't focus only on banks either. There are a lot of > >> > popular services that use free software a lot, some of which happen to > >> > include payment functionality. > > I did no

Re: My fellow (Debian) Linux users ...

2014-04-14 Thread Joel Rees
On Mon, Apr 14, 2014 at 1:37 AM, Ralf Mardorf wrote: > > > On Sun, 2014-04-13 at 09:33 +0900, Joel Rees wrote: > > In what sense do you mean hacked? > > Cracked, as in passwords and other sensitive information > > Exactly in this way. But how serious is the current exposure? I was trying to sep

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Jochen Spieker
Stan Hoeppner: > On 4/14/2014 5:53 AM, Jochen Spieker wrote: >> Stan Hoeppner: >>> >>> This problem only exists *if* these devices connect to a compromised or >>> rogue host via SSL/TLS *and* the user hasn't reset and or deleted >>> locally cached usernames and passwords. >> >> That is not the wh

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Richard Hector
On 14/04/14 23:31, Stan Hoeppner wrote: >> > BTW, you shouldn't focus only on banks either. There are a lot of >> > popular services that use free software a lot, some of which happen to >> > include payment functionality. > I did not "focusing on banks". I replied to Chris Bannister's statement >

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Stan Hoeppner
On 4/14/2014 5:53 AM, Jochen Spieker wrote: > Stan Hoeppner: >> On 4/13/2014 10:03 PM, Chris Bannister wrote: >> >>> Then there is also the very serious issue of embedded devices using >>> openssl. Tablets, smartphones, routers, ... etc. etc. >> >> This problem only exists *if* these devices conne

Re: My fellow (Debian) Linux users ...

2014-04-14 Thread Curt
On 2014-04-14, Joel Rees wrote: >> Secondly - do you know who runs it? I don't. If I wanted to harvest a >> bunch of potentially vulnerable sites, setting up a test site is how I'd >> do it ... >> >> Richard > > > Thank you, Richard, for expressing that better than I could. I know (and so would

Re: My fellow (Debian) Linux users ...

2014-04-14 Thread Joel Rees
Heads up, guys! On Mon, Apr 14, 2014 at 9:05 AM, Richard Hector wrote: > On 13/04/14 23:43, Curt wrote: > > On 2014-04-13, Eduardo M KALINOWSKI wrote: > >> On 20h20 12 de Abril de 2014, Steve Litt wrote: > >>> I'm changing every password: That's about 100 of them. > >> > >> That's a good thing t

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Jochen Spieker
Stan Hoeppner: > On 4/13/2014 10:03 PM, Chris Bannister wrote: > >> Then there is also the very serious issue of embedded devices using >> openssl. Tablets, smartphones, routers, ... etc. etc. > > This problem only exists *if* these devices connect to a compromised or > rogue host via SSL/TLS *an

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Curt
On 2014-04-14, Brian wrote: > > The increase in the bank balances of many consultants is well-documented > as part of the history of the Y2K period. What is is still under discussion > is whether the failure of a set of traffic lights in Alice Springs was its > only major effect. > My understandin

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Curt
On 2014-04-14, Richard Hector wrote: > > My understanding is that it has been widely exploited _since_ disclosure. > > I could be wrong, of course - I think I heard it in chat around the office. > No kidding. -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Richard Hector
On 14/04/14 21:49, Curt wrote: > On 2014-04-14, Richard Hector wrote: >> > >> > This one, on the other hand, was generally not predicted, and was widely >> > exploited before people got a chance to fix it. That's presumably still >> > going on. > Widely exploited? > > http://en.wikipedia.org/wiki

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Curt
On 2014-04-14, Richard Hector wrote: > > This one, on the other hand, was generally not predicted, and was widely > exploited before people got a chance to fix it. That's presumably still > going on. Widely exploited? http://en.wikipedia.org/wiki/Heartbleed Possible exploitation prior to disclo

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Brian
On Mon 14 Apr 2014 at 21:15:23 +1200, Richard Hector wrote: > On 14/04/14 18:55, Stan Hoeppner wrote: > > > > This is several orders of magnitude less severe than Y2K. > > Y2K was extensively predicted, a lot of people did a lot of work to > avoid it, and in the end it wasn't very significant, n

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-14 Thread Richard Hector
On 14/04/14 18:55, Stan Hoeppner wrote: > On 4/13/2014 10:03 PM, Chris Bannister wrote: > ... >> considering it is a catastrophe worse than the Y2K bug. > > This is several orders of magnitude less severe than Y2K. Y2K was extensively predicted, a lot of people did a lot of work to avoid it, an

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-13 Thread Stan Hoeppner
On 4/13/2014 10:03 PM, Chris Bannister wrote: ... > considering it is a catastrophe worse than the Y2K bug. This is several orders of magnitude less severe than Y2K. > It seems very likely that people are using compromised apps on their > smartphone and you'd think it would be advisable to warn

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-13 Thread shawn wilson
On Apr 13, 2014 11:03 PM, "Chris Bannister" wrote: > > Then there is also the very serious issue of embedded devices using > openssl. Tablets, smartphones, routers, ... etc. etc. > You're correct about network hardware (though the only one I'm aware of so far is F5 with the latest firmware). If

Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

2014-04-13 Thread Chris Bannister
On Sun, Apr 13, 2014 at 06:37:19PM +0200, Ralf Mardorf wrote: > > > On Sun, 2014-04-13 at 09:33 +0900, Joel Rees wrote: > > In what sense do you mean hacked? > > Cracked, as in passwords and other sensitive information > > > The openssl issues have been baking for how many years? The bug was i

Re: My fellow (Debian) Linux users ...

2014-04-13 Thread Richard Hector
On 13/04/14 23:43, Curt wrote: > On 2014-04-13, Eduardo M KALINOWSKI wrote: >> On 20h20 12 de Abril de 2014, Steve Litt wrote: >>> I'm changing every password: That's about 100 of them. >> >> That's a good thing to do, but only after the server has patched >> openssl and changed its certificate. O

Re: My fellow (Debian) Linux users ...

2014-04-13 Thread Ralf Mardorf
PS: On Sun, 2014-04-13 at 18:37 +0200, Ralf Mardorf wrote: > I only own an Alice account and 3 Rocketmail accounts Oops, it's 1 Alice, 2 Rocketmail and 1 Yahoo account, but Rocketmail is Yahoo. First I used Alice (My ISP) only. When I run into issues using Alice only, I add the Rocketmail/Yahoo a

Re: My fellow (Debian) Linux users ...

2014-04-13 Thread Ralf Mardorf
On Sun, 2014-04-13 at 09:33 +0900, Joel Rees wrote: > In what sense do you mean hacked? > Cracked, as in passwords and other sensitive information Exactly in this way. > The openssl issues have been baking for how many years? Too long for Linux community members to be surprised by the news of

Re: My fellow (Debian) Linux users ...

2014-04-13 Thread Curt
On 2014-04-13, Eduardo M KALINOWSKI wrote: > On 20h20 12 de Abril de 2014, Steve Litt wrote: >> I'm changing every password: That's about 100 of them. > > That's a good thing to do, but only after the server has patched > openssl and changed its certificate. Otherwise someone could have > captured

Re: My fellow (Debian) Linux users ...

2014-04-13 Thread Rick Thomas
On Apr 13, 2014, at 3:21 AM, Martin Steigerwald wrote: > Hello! > > Am Samstag, 12. April 2014, 21:03:36 schrieb Ralf Mardorf: >> On Sat, 2014-04-12 at 20:48 +0200, Ralf Mardorf wrote: >>> I experience issues with Debian lists :(. _With Debian lists only_ :(. >>> >>> :( I'm still subscribed to

Re: My fellow (Debian) Linux users ...

2014-04-13 Thread Martin Steigerwald
Hello! Am Samstag, 12. April 2014, 21:03:36 schrieb Ralf Mardorf: > On Sat, 2014-04-12 at 20:48 +0200, Ralf Mardorf wrote: > > I experience issues with Debian lists :(. _With Debian lists only_ :(. > > > > :( I'm still subscribed to d-community-offtopic, I checked it, however, > > > > my latest

Re: My fellow (Debian) Linux users ...

2014-04-13 Thread David Guntner
John Hasler grabbed a keyboard and wrote: > Henrique writes: >> It also includes the emails that were read over a >> heartbleed-vulnerable IMAP, and every data that went over a >> heartbleed-vulnerable VPN tunnel, for example. > > I wasn't aware that IMAP and VPN used heartbeat. I don't see that

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Reco
Hi. On Sat, 12 Apr 2014 23:20:40 +0100 Lisi Reisz wrote: > On Saturday 12 April 2014 23:11:35 Henrique de Moraes Holschuh wrote: > > There IS a reason why it was given a "Severity: Apocaliptic" label > > by the best in the field: > > So what action do readers recommend? Change every single pa

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Eduardo M KALINOWSKI
On 20h20 12 de Abril de 2014, Steve Litt wrote: > I'm changing every password: That's about 100 of them. That's a good thing to do, but only after the server has patched openssl and changed its certificate. Otherwise someone could have captured the private key and other information that could be

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Joel Rees
Uhm, ... On Sun, Apr 13, 2014 at 4:31 AM, Ralf Mardorf wrote: > > > Well.. do be aware that as of mid-last week, any messages sent from > > a yahoo mail account are pretty likely to bounce from other > > yahooaccounts, rcn, hotmail, comcast, and other large mail systems. > > See "Yahoo breaks eve

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread John Hasler
SteveT writes: > I'm changing every password: That's about 100 of them. I really don't see why I should change my Reddit or Slashdot passwords or any of the others for sites of similarly trivial importance. -- John Hasler jhas...@newsguy.com Elmwood, WI USA -- To UNSUBSCRIBE, email to debian-

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Steve Litt
On Sat, 12 Apr 2014 23:20:40 +0100 Lisi Reisz wrote: > On Saturday 12 April 2014 23:11:35 Henrique de Moraes Holschuh wrote: > > There IS a reason why it was given a "Severity: Apocaliptic" label > > by the best in the field: > > So what action do readers recommend? Change every single password

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread John Hasler
Lisi writes: > So what action do readers recommend? Change every single password, or > just passwords to sensitive sites/information? If I did any online banking I would certainly change the passwords: I might even close the accounts. But I don't. I may change my Ebay password and perhaps the

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread John Hasler
Henrique writes: > It also includes the emails that were read over a > heartbleed-vulnerable IMAP, and every data that went over a > heartbleed-vulnerable VPN tunnel, for example. I wasn't aware that IMAP and VPN used heartbeat. I don't see that IMAP is all that serious, though. Email isn't secu

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Lisi Reisz
On Saturday 12 April 2014 23:11:35 Henrique de Moraes Holschuh wrote: > There IS a reason why it was given a "Severity: Apocaliptic" label > by the best in the field: So what action do readers recommend? Change every single password, or just passwords to sensitive sites/information? Lisi --

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Henrique de Moraes Holschuh
On Sun, 13 Apr 2014, Reco wrote: > On Sat, 12 Apr 2014 16:07:23 -0500 > John Hasler wrote: > > Miles Fidelman writes: > > > Not just in Germany. And, if you access password-protected sites that > > > expose an https: or other SSL interface - those passwords are at risk. > > > > Just TLS and just

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Reco
Hi. On Sat, 12 Apr 2014 16:07:23 -0500 John Hasler wrote: > Miles Fidelman writes: > > Not just in Germany. And, if you access password-protected sites that > > expose an https: or other SSL interface - those passwords are at risk. > > Just TLS and just with Web servers that used the "heartbe

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread John Hasler
Miles Fidelman writes: > Not just in Germany. And, if you access password-protected sites that > expose an https: or other SSL interface - those passwords are at risk. Just TLS and just with Web servers that used the "heartbeat" kluge. Still a very serious bug, though. -- John Hasler jhas...@ne

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Miles Fidelman
Ralf Mardorf wrote: PPS & OT: In Germany there's a huge OpenSSL security risk hype going on. I don't follow this crappy "news", since I never relied on OpenSSL for my needs. Not just in Germany. And, if you access password-protected sites that expose an https: or other SSL interface - those p

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Miles Fidelman
Ralf Mardorf wrote: Well.. do be aware that as of mid-last week, any messages sent from a yahoo mail account are pretty likely to bounce from other yahooaccounts, rcn, hotmail, comcast, and other large mail systems. See "Yahoo breaks every mailing list in the world including the IETF's" http://ww

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Ralf Mardorf
On Sat, 2014-04-12 at 21:31 +0200, Ralf Mardorf wrote: > > Well.. do be aware that as of mid-last week, any messages sent from > > a yahoo mail account are pretty likely to bounce from other > > yahooaccounts, rcn, hotmail, comcast, and other large mail systems. > > See "Yahoo breaks every mailing

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Ralf Mardorf
> Well.. do be aware that as of mid-last week, any messages sent from > a yahoo mail account are pretty likely to bounce from other > yahooaccounts, rcn, hotmail, comcast, and other large mail systems. > See "Yahoo breaks every mailing list in the world including the > IETF's" http://www.ietf.org/

list issues [was: Re: My fellow (Debian) Linux users ...]

2014-04-12 Thread Miles Fidelman
y latest mail didn't come through the list: Forwarded Message From: Ralf Mardorf To: d-community-offto...@lists.alioth.debian.org Subject: My fellow (Debian) Linux users ... Date: Sat, 12 Apr 2014 20:29:42 +0200 Mailer: Evolution 3.10.4 ... assumed there should be something ver

My fellow (Debian) Linux users ...

2014-04-12 Thread Ralf Mardorf
debian.org Subject: My fellow (Debian) Linux users ... Date: Sat, 12 Apr 2014 20:29:42 +0200 Mailer: Evolution 3.10.4 ... assumed there should be something very interesting going on at debian-user@lists.debian.org please send me a note. If so, I'll read the archive and/or subscribe using anoth

Re: My fellow (Debian) Linux users ...

2014-04-12 Thread Ralf Mardorf
s delayed and did came trough right now :) > Forwarded Message > From: Ralf Mardorf > To: d-community-offto...@lists.alioth.debian.org > Subject: My fellow (Debian) Linux users ... > Date: Sat, 12 Apr 2014 20:29:42 +0200 > Mailer: Evolution 3.10.4 > &