new device ids

2012-11-22 Thread Kirill Bychkov
Hi. This patch adds fingerprint reader and ati video, found on my girlfriend's hp pavillion dv6. OK? Index: pci/pcidevs === RCS file: /cvs/src/sys/dev/pci/pcidevs,v retrieving revision 1.1661 diff -u -r1.1661 pcidevs --- pci/pcidevs 1

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Andres Perera
On Thu, Nov 22, 2012 at 11:41 PM, Marc Espie wrote: > > On Thu, Nov 22, 2012 at 01:27:46PM -0430, Andres Perera wrote: > > why would the runtime be attractive for rop? what configuration vm > > needs syscalls that would be attractive to an attacker that can change > > the address of a jump? does t

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Marc Espie
On Thu, Nov 22, 2012 at 01:27:46PM -0430, Andres Perera wrote: > why would the runtime be attractive for rop? what configuration vm > needs syscalls that would be attractive to an attacker that can change > the address of a jump? does the runtime really need to open sockets, > or spawn processes? (

Re: login_yubikey case-insensitive hex decoding

2012-11-22 Thread Philip Guenther
On Thu, Nov 22, 2012 at 5:28 PM, Alexander Hall wrote: > The corresponding part in yubikey_hex_decode is for consistency and, > IMO, sanity, allowing mixed case hex strings, e.g. /var/db/yubikey/*. > > Comments? OK? (Don't mess with the from-upstream-derived yubikey.c?) ... > - if ((

login_yubikey case-insensitive hex decoding

2012-11-22 Thread Alexander Hall
Cheers, SHIFT or CAPS LOCK (on any keyboard) screws up the parsing of the yubikey OTP. So make that parsing case-insensitive. The corresponding part in yubikey_hex_decode is for consistency and, IMO, sanity, allowing mixed case hex strings, e.g. /var/db/yubikey/*. Comments? OK? (Don't mess with

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Kevin Chadwick
On Thu, 22 Nov 2012 15:58:12 -0430 Andres Perera wrote: > On Thu, Nov 22, 2012 at 2:53 PM, Kevin Chadwick > wrote: > > On Thu, 22 Nov 2012 14:18:59 -0430 > > Andres Perera wrote: > > > >> there's still no tie-in to the privileges of the process, > > > > It still lets a process do something unint

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Andres Perera
On Thu, Nov 22, 2012 at 2:53 PM, Kevin Chadwick wrote: > On Thu, 22 Nov 2012 14:18:59 -0430 > Andres Perera wrote: > >> there's still no tie-in to the privileges of the process, > > It still lets a process do something unintended. In fact getting a > browser to execute an external javascript progr

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Kevin Chadwick
On Thu, 22 Nov 2012 14:18:59 -0430 Andres Perera wrote: > there's still no tie-in to the privileges of the process, It still lets a process do something unintended. In fact getting a browser to execute an external javascript program is a threat in itself that could have no end of custom instructi

Re: pf: fixup stack corruption caused by pf_set_rt_ifp

2012-11-22 Thread Mike Belopuhov
On Thu, Nov 22, 2012 at 16:05 +0100, Mike Belopuhov wrote: > re pf bug on bugs@: > > apparently the crash is caused by the stack corruption that happens > in pf_map_addr as it expects to get an array of struct pf_src_node > pointers, not just one pointer. the bug was introduced about four > years

Re: TX_/RX_CSUM on Intel I350/X540T

2012-11-22 Thread Mike Belopuhov
On Thu, Nov 22, 2012 at 7:34 PM, mxb wrote: > Hey tech@, > > I'll more than gladly test any diffs for . > > Regards, > Maxim > both have rx checksums enabled. tx checksums can't be enabled on i350 right now. tx checksums on ix will need henning's diff to go in first.

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Andres Perera
On Thu, Nov 22, 2012 at 1:52 PM, Kevin Chadwick wrote: > On Thu, 22 Nov 2012 13:27:46 -0430 > Andres Perera wrote: > >> but jit isn't irreparably interleaved with js >> > > The latest polkit actually depends on the javascript package. specifically, js185, aka spidermonkey, aka: MOZ_ARG_DISABLE_B

TX_/RX_CSUM on Intel I350/X540T

2012-11-22 Thread mxb
Hey tech@, I'll more than gladly test any diffs for . Regards, Maxim

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Kevin Chadwick
On Thu, 22 Nov 2012 13:27:46 -0430 Andres Perera wrote: > but jit isn't irreparably interleaved with js > The latest polkit actually depends on the javascript package. > am i compromising by running luajit in interpreter mode instead of the > reference implementation, moreover, would that imply

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Andres Perera
On Thu, Nov 22, 2012 at 11:58 AM, Kevin Chadwick wrote: > On Thu, 22 Nov 2012 09:30:41 -0430 > Andres Perera wrote: > >> i'm not sure how using js for configuration files, as opposed to using >> a language commonly deployed for the same purpose, such as lua, >> presents an innate constraint on sec

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Kevin Chadwick
On Thu, 22 Nov 2012 09:30:41 -0430 Andres Perera wrote: > i'm not sure how using js for configuration files, as opposed to using > a language commonly deployed for the same purpose, such as lua, > presents an innate constraint on security. Firstly the article mentioned JIT preventing true randomi

Re: pf: fixup stack corruption caused by pf_set_rt_ifp

2012-11-22 Thread Arjan Schrijver
Mike Belopuhov schreef op 2012-11-22 16:05: i've verified that this fixes the issue for me and arjan is going to verify as well. I've verified that this patch has fixed the issue for me. Many thanks to Mike! Kind regards, Arjan

pf: fixup stack corruption caused by pf_set_rt_ifp

2012-11-22 Thread Mike Belopuhov
re pf bug on bugs@: apparently the crash is caused by the stack corruption that happens in pf_map_addr as it expects to get an array of struct pf_src_node pointers, not just one pointer. the bug was introduced about four years ago, but somehow (stack layout?) went unnoticed. the proper fix is to

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Andres Perera
i'm not sure how using js for configuration files, as opposed to using a language commonly deployed for the same purpose, such as lua, presents an innate constraint on security. if i'm somehow expected to ignore how unlikely it is for the configuration vm to: a. intentionally have the ability of

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Kevin Chadwick
> Follow-up interview, much better to say what you want instead of having people > interpret your email. Do you know polkit (which I believe is cross platform but I prefer to remove it, primarily because it gives little indication of what is allowed and requires constant review, unlike sudo) now u

Re: upstream vendors and why they can be really harmful

2012-11-22 Thread Marc Espie
Follow-up interview, much better to say what you want instead of having people interpret your email. http://www.itwire.com/business-it-news/open-source/57589-upstream-vendors-can-harm-small-projects-openbsd-dev At least this has some visibility, which is a good thing...