On Tue, 20 Jun 2017 14:25:09 +0800
Ed Greshko wrote:
> Also, please note that by default when a new user is created in
> Fedora they also get a corresponding group unless you override.
> Along with that the home directory is created with drwx--.
> permissions. So, even if the permissions on
On 06/20/17 14:00, stan wrote:
> But I won't lose any sleep over it.
Good to hear
Also, please note that by default when a new user is created in Fedora they
also get
a corresponding group unless you override. Along with that the home directory
is
created with drwx--. permissions. So
I haven't seen anyone else post about this, so this message is
forwarded from the kernel list, about a new kernel vulnerability. The
vulnerability is severe as it leads to root authority, but so far only
local logins have been demonstrated to have the ability to exploit it.
So, for most Fedora use
On Tue, 20 Jun 2017 07:52:07 +1000
Cameron Simpson wrote:
> Dunno. I'm fairly private and like to end my umask in a 7 normally.
> Usually discussions revolve around the group bits.
>
> Normally you wouldn't share membership of your personal group - this
> arranges that 027 (or the like) in your
Allegedly, on or about 19 June 2017, Greg Woods sent:
> I'm surprised no one has posted this yet:
>
> https://xkcd.com/936/
Virtually the same thing as I said, minus the illustrations.
--
[tim@localhost ~]$ uname -rsvp
Linux 3.9.10-100.fc17.x86_64 #1 SMP Sun Jul 14 01:31:27 UTC 2013 x86_64
(alw
On Mon, 19 Jun 2017 21:27:51 +0100
Patrick O'Callaghan wrote:
> Because modern CPUs already have hardware RNGs built-in, without
> requiring an additional chip?
But, but, but, they aren't quantum :-).
___
users mailing list -- users@lists.fedoraproject.
On 06/18/2017 01:55 PM, Andre Robatino wrote:
Thanks. I had actually installed pwgen a few months ago, but it looked like the passwords weren't strong enough.
gnome-password-generator has a Character set option "All printable (excluding space)". It appears that
"pwgen -sy 30 1", for example, do
On 19Jun2017 13:17, stan wrote:
On Mon, 19 Jun 2017 16:48:40 +0100
Patrick O'Callaghan wrote:
Bear in mind that by default Fedora allocates each user to his own
private group. Presumably someone who intentionally shares group
membership is expected to understand the implications and adjust um
On Mon, 2017-06-19 at 15:54 -0400, Tom Horsley wrote:
> I just want to know when we'll all have one of these built into
> our computers?
>
> http://www.physicscentral.com/buzz/blog/index.cfm?postid=4422261597116577682
>
> (Doesn't look like it has been turned into a commercial product
> yet which
On Mon, 19 Jun 2017 16:48:40 +0100
Patrick O'Callaghan wrote:
> Bear in mind that by default Fedora allocates each user to his own
> private group. Presumably someone who intentionally shares group
> membership is expected to understand the implications and adjust umask
> if necessary.
Another g
On Mon, 19 Jun 2017 15:54:25 -0400
Tom Horsley wrote:
> http://www.physicscentral.com/buzz/blog/index.cfm?postid=4422261597116577682
>
> (Doesn't look like it has been turned into a commercial product
> yet which kind of surprises me - probably the researchers and the
> university arguing about
I just want to know when we'll all have one of these built into
our computers?
http://www.physicscentral.com/buzz/blog/index.cfm?postid=4422261597116577682
(Doesn't look like it has been turned into a commercial product
yet which kind of surprises me - probably the researchers and the
university
On Mon, 19 Jun 2017 17:35:10 -
"Andre Robatino" wrote:
> It seemed
> to be a fairly sophisticated attack. When my PayPal account was
> accessed, my email account was DoS'd by sending thousands of garbage
> emails to it every hour, to prevent me from reading PayPal's email
> notifications asso
On Mon, 19 Jun 2017 10:03:35 -0700
Gordon Messmer wrote:
> As a minor point, I'd mention that Fedora's default umask is 002, not
> 022, except for the root user.
Thanks.
> I think either is fine. umask governs how you share files with other
> authorized users of the local computer system (wh
On Mon, 19 Jun 2017 07:37:35 +0200
Heinz Diehl wrote:
> Pwgen uses /dev/urandom, so the statement that those passwords are
> less secure than "fully" random passwords (define "fully random"..) is
> merely of academical nature.
>
> In case of any doubt, you can always do something like
>
> head
On Mon, 19 Jun 2017 20:26:29 +0200
Walter H. wrote:
> what is this?
> header_checks tells this and I'm used to use pcre with postfix ...
Perhaps postfix-pcre isn't installed?
___
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an
Hello,
Jun 19 20:18:01 fedorabox postfix/smtp[4723]: error: unsupported
dictionary type: pcre
what is this?
header_checks tells this and I'm used to use pcre with postfix ...
/etc/postfix/main.cf:
smtp_header_checks = pcre:/etc/postfix/smtp_hdr_chks.pcre
smtp_mime_header_checks =
smtp_nested
> How? Don't the attackers have to know the password hashing algorithm to
> do that? If they have enough penetration into the system to know that,
> couldn't they just capture the passwords when they were unhashed?
> i.e. could it have been that they let paypal know they had been
> compromised, s
On 06/18/2017 08:49 PM, Andre Robatino wrote:
Many websites don't allow even 30 chars. One of the important ones I use allows
only 16 characters (and no 2FA option), but happens to allow special
characters. Using the largest possible character set is the only way to shore
that up.
A credit
On 06/18/2017 08:28 PM, Lawrence E Graves wrote:
Not able to control the maximize control on my firefox web browser. If
I unmaximize the browser and close it out. When I log back on, it
automatically goes to maximize. Can anybody help with this matter? Am
I reporting to the list?
Unfortuna
On 06/18/2017 07:18 PM, stan wrote:
On Mon, 19 Jun 2017 05:49:20 +0800 Ed Greshko wrote:
You haven't described your environment.
Home workstation with no web facing services.
As a minor point, I'd mention that Fedora's default umask is 002, not
022, except for the root user.
I think eit
On Mon, Jun 19, 2017 at 8:42 AM, stan wrote:
> The man page says they are modified to be more memorable, by
> some definition, and so are less than compeletely random.
>
> ...generates passwords which are designed to be easily memorized by
> humans, while being as secure as possible.
>
I'm surpr
On Mon, 19 Jun 2017 11:12:20 -0400
Matthew Miller wrote:
> There are only a handful of commonly-used cryptographically-secure
> hashes which are likely to be used, and they're relatively easy to
> narrow down simply by looking at length. Or, if they're stored like
> they are in /etc/shadow, the e
On Mon, 2017-06-19 at 12:07 -0400, Tom Horsley wrote:
> On Mon, 19 Jun 2017 16:44:25 +0100
> Patrick O'Callaghan wrote:
>
> > Exactly. It also makes me question the competence of whoever programmed
> > the website. Can it be that they only know how to read alphanumeric
> > input?
>
> I always sus
On Mon, 19 Jun 2017 16:44:25 +0100
Patrick O'Callaghan wrote:
> Exactly. It also makes me question the competence of whoever programmed
> the website. Can it be that they only know how to read alphanumeric
> input?
I always suspect someone's nephew built the web site and
didn't know how to proper
Tim:
>> Really, what ought to get tightened up is the software accepting
>> logons. There should be a limited number of attempts (3 goes and your
>> out for a significant time limit). Any system that lets a cracker
>> hammer away with repeated attempts is the thing that is broken.
stan:
> I don't
On Mon, 2017-06-19 at 07:05 -0700, stan wrote:
> On Mon, 19 Jun 2017 07:55:59 +1000
> Cameron Simpson wrote:
>
> > As remarked elsewhere, it does depend on your environment.
>
> Well, yes, but it just seems that the default should be to the most
> secure.
>
> > I like 027 myself. Combined with
Allegedly, on or about 18 June 2017, Lawrence E Graves sent:
> Not able to control the maximize control on my firefox web browser. If
> I unmaximize the browser and close it out. When I log back on, it
> automatically goes to maximize.
Sometimes dopey things can stop that kind of problem, such a
On Mon, 2017-06-19 at 08:36 -0400, Tom Horsley wrote:
> On Mon, 19 Jun 2017 12:55:28 +0100
> Patrick O'Callaghan wrote:
>
> > One
> > of them even disallows cut-and-paste, which tempts the user to have a
> > password simple enough to remember and type by hand.
>
> One of the keepassx features is
On Mon, Jun 19, 2017 at 08:02:28AM -0700, stan wrote:
> > That works as long as the website isn't hacked. If it is, even if the
> > passwords are hashed (which they often aren't), the hash can be
> > cracked if the password is weak.
> How? Don't the attackers have to know the password hashing algo
On Mon, 19 Jun 2017 02:49:30 -
"Andre Robatino" wrote:
> Many websites don't allow even 30 chars. One of the important ones I
> use allows only 16 characters (and no 2FA option), but happens to
> allow special characters. Using the largest possible character set is
> the only way to shore tha
On Mon, 19 Jun 2017 04:48:16 -
"Andre Robatino" wrote:
> That works as long as the website isn't hacked. If it is, even if the
> passwords are hashed (which they often aren't), the hash can be
> cracked if the password is weak.
How? Don't the attackers have to know the password hashing algo
On Mon, 19 Jun 2017 12:51:30 +0930
Tim wrote:
> Really, what ought to get tightened up is the software accepting
> logons. There should be a limited number of attempts (3 goes and your
> out for a significant time limit). Any system that lets a cracker
> hammer away with repeated attempts is the
On Mon, 19 Jun 2017 07:37:35 +0200
Heinz Diehl wrote:
> Pwgen uses /dev/urandom, so the statement that those passwords are
> less secure than "fully" random passwords (define "fully random"..) is
> merely of academical nature.
The man page says they are modified to be more memorable, by
some def
On Mon, Jun 19, 2017 at 11:33:00AM +0930, Tim wrote:
> Matthew Miller:
> > This seems... unnecssary.
> Though, I'd say it's accurate.
Maybe, but *entirely* unrelated to the situation here. So I don't see
the value.
--
Matthew Miller
Fedora Project Leader
__
On Mon, 19 Jun 2017 07:55:59 +1000
Cameron Simpson wrote:
> As remarked elsewhere, it does depend on your environment.
Well, yes, but it just seems that the default should be to the most
secure.
> I like 027 myself. Combined with setgid directories it leaves things
> readable by the group of th
On Sun, 18 Jun 2017 20:28:28 -0600
Lawrence E Graves wrote:
> Not able to control the maximize control on my firefox web browser.
> If I unmaximize the browser and close it out. When I log back on, it
> automatically goes to maximize. Can anybody help with this matter?
> Am I reporting to the l
Allegedly, on or about 26 May 2017, Wade Hampton sent:
> I am trying out multiple video editors on Fedora, with very poor
> results and a ton of crashes.
When I tried this, long ago, I came across the same thing. As well as;
all the video formats you need are encumbered, and probably not even
a
Allegedly, on or about 19 June 2017, Patrick O'Callaghan sent:
> I have a number of bank accounts in several countries (for perfectly
> legitimate reasons, I hasten to add) and in my experience each bank
> has its own rules which as often as not mitigate *against* good
> security practice, e.g. for
Allegedly, on or about 19 June 2017, Tom Horsley sent:
> The sites that crack me up are the ones which have rules
> like "you can only use letters and numbers" in your password.
> Why? That just means anyone trying to guess passwords has
> a much simpler job.
I can guess two reasons:
Some specia
On Mon, Jun 19, 2017 at 08:36:35AM -0400, Tom Horsley wrote:
> On Mon, 19 Jun 2017 12:55:28 +0100
> Patrick O'Callaghan wrote:
>
> > One
> > of them even disallows cut-and-paste, which tempts the user to have a
> > password simple enough to remember and type by hand.
>
> One of the keepassx featu
On Mon, 19 Jun 2017 12:55:28 +0100
Patrick O'Callaghan wrote:
> One
> of them even disallows cut-and-paste, which tempts the user to have a
> password simple enough to remember and type by hand.
One of the keepassx features is the ability to simulate
typing to teach the annoying web designers who
On Mon, 2017-06-19 at 00:17 -0700, Joe Zeff wrote:
> On 06/18/2017 08:21 PM, Tim wrote:
> > I completely agree, it's just as impossible to guess that a password is
> > "$#DfSGxS" than "sickturtlepyjamas", and I know which one is easier to
> > remember and type. With the peculiar password rules, I
On 27/05/17 08:53, Wade Hampton wrote:
I am trying out multiple video editors on Fedora, with very poor results
and a ton of crashes.
There is also LightWorks (https://www.lwks.com). There's an RPM
available for Fedora, although the software does require you to have a
lightworks account but i
On Mon, 19 Jun 2017 06:03:08 -0400
Tom Horsley wrote:
> I use keepassx to not only generate, but also store passwords.
I was using the same, but now find (qt)pass more pleasant to use.
Sincerely,
Gour
--
As the ignorant perform their duties with attachment to results,
the learned may similar
I use keepassx to not only generate, but also store passwords.
It has lots of rules you can select about how to generate
passwords, which is useful, because lots of web sites
have idiotic requirements for passwords, and you can plug
those idiot requirements into the password generator.
On 06/18/2017 08:21 PM, Tim wrote:
I completely agree, it's just as impossible to guess that a password is
"$#DfSGxS" than "sickturtlepyjamas", and I know which one is easier to
remember and type. With the peculiar password rules, I have no choice
to but to do the insecure and write down passwor
47 matches
Mail list logo
