Domain: debian.org
Stories and comments across the archive that link to debian.org.
Comments · 7,134
-
Re:GIT?in short, Git has already won and expect it to be the biggest source code versioning system in less than two years from now.
Indeed. Hg had an early boost from large organizations (e.g. sun), apparently because of it's better windows support at the time, but it seems clear that git has the majority of mindshare these days, especially in the FOSS world.
Here's a graph of scm system on usage on debian which made the rounds recently (note this is based on "popcon" statistics, which measure use of each tool). The top two descending lines are CVS and SVN; the third-from-the-top ascending line is git; the rest of the lines inclucde hg, bzr, darcs, etc. This data obviously isn't perfect, but it seems pretty much reflect the trends that I've observed.
-
Re:GIT?
If you go by Debian's popcon, Subversion has already kicked both our asses and we should all go home:
http://people.debian.org/~igloo/popcon-graphs/index.php?packages=darcs%2Cgit-core%2Cmercurial%2Cbzr%2Csubversion%2C+cvs&show_installed=on&want_legend=on&want_ticks=on&from_date=2003-10-01&to_date=&hlght_date=&date_fmt=%25Y-%25m&beenhere=1 -
Re:It's the algorithm, stupidThis observation is why the choice of language doesn't matter. If a language implementation is slow, all it does is add a constant factor to any algorithms written in that language.
That's the crappiest, most long-winded apology for poor performance I've seen. Yes, everything you said about O() notation is more or less correct. No, you can't wish it to be applicable just by squinting really hard and hoping.
At some point, that constant does start to matter. Suppose your O(n) algorithm written in $fast_language can support the world's population logged in simultaneously. Further suppose that you wrote prototype #1 in $spiffy_language that can support about 100 users on the same hardware as the $fast_language version. Sure, both are O(n), but that doesn't magically make them equally good solutions.
No, I don't think Ruby is 60 million times slower than the fastest language, but it very well might be 100 times slower for their algorithms. Do you honestly think that wouldn't make any difference?
-
Surfraw
There is also surfraw http://surfraw.alioth.debian.org/ which is a great idea but somehow does not aspire greatly enough.
-
Re:Totally geekyThere's already a better choice for command line integration: try surfraw. This lets you stay within a real command shell such as bash, and just type
$ google what I want to know
You'll get the results directly in a browser of your choice. If you're like me, you have the browser set up as w3m, so that the google results simply appear in the same terminal where you can click on them. Since w3m is a pager like more and less, you can postprocess the google output, eg
$ google hello | grep Cached
www.hello.com/ - 2k - Cached - Similar pages
www.hellomagazine.com/ - 32k - Cached - Similar pages
www.hellomagazine.com/royalty/ - 27k - Cached - Similar pages
en.wikipedia.org/wiki/Hello - 39k - Cached - Similar pages
en.wikipedia.org/wiki/Hello_world_program - 32k - Cached - Similar pages
www.elite.net/~runner/jennifers/hello.htm - 157k - Cached - Similar pages
www.ipl.org/div/hello/ - 20k - Cached - Similar pages
www.mylalaland.com/hello/ - 6k - Cached - Similar pages
publicaddress.typepad.com/ - 58k - Cached - Similar pages
www.sanrio.com/ - 10k - Cached - Similar pages
Best of all , surfraw is not just limited to google, so you can have a complete shell browsing experience for a lot of different sites.
-
surfraw
*years* ago, most of us were doing this same type of thing from a commandline with lynx/links.
If you like this, you'll probably like surfraw too
http://surfraw.alioth.debian.org/
All the goodness of goosh without the need for X or a browser
I actually added some of the handlers years ago, but I found that eventually Google searchbox was able to do many of them for me directly - like "quote intc" , "ufo site=cnn.com", etc.
I created my own handlers (elvii) for internal intranet use to do all sorts of mundane queries from the commandline with ease. Its amazing how excited people get when you give them a commandline way to do really quick web queries and get results with minimal CSS/ads/formatting junk. -
Re:Server/customer ratio?
How about catching on fire and burning down??
http://lists.debian.org/debian-devel/2002/11/msg01926.html -
Re:Talk really did wow the conferenceThis talk was one of the highlights of the conference. At the talk, they showed performance benchmarks that included running several things as much as 117x as fast as the default Ruby interpreter that is in use by most Rails installations today. The fact that it's built on this commercial-grade Gemstone platform that has been used for years for high-performance production Smalltalk applications just adds to its credibility. Well, without in any way detracting from the technical prowess of the Gemstone folks - sounds like they know their stuff with OODBs - beating the default implementation Ruby on the performance front isn't that hard. Certainly traditionally, Ruby was slow by all independent measures such as the Language Shootout.
I suppose this does beg the questions: does the Gemstone-based system do better in the shootout benchmarks? If so, by how much? And since there's often tradeoffs between optimizations and (frequently obscure) parts of language semantics, what features of Ruby get lost along the way? What proportion of Ruby scripts are likely to run unchanged? What proportion of those are going to get a good performance boost?
Just the things that go through my head on first glance... -
Re:Ruby Shootout
I took a look at some more of the benchmarks and they are pretty much universally meaningless once you throw in a good optimizing VM. For instance translating the method benchmark into Java and having it loop 2^31 times instead of 6 million times and Java is 29,000 times faster than Ruby 2.8.
Adding a simple global+=1 to the method body makes Java only 16,000 times faster than Ruby 2.8.
Replacing the +1 with global*=5 makes the Java version only 536 times faster than Ruby 2.8.
These are the kinds of optimizations MagLev is doing, and they don't translate into anywhere near the gains in actual code. So you see, you really need to rethink your tests. Even for something seemingly ok like modifying a global can depend on how it is modified and what the VM can optimize (+1 vs *5). Frankly I would just test these different Ruby implementations using the regular shootout code, since these have been designed not to be optimized out. -
Re:GNUbuntu?
http://www.debian.org/vote/2006/vote_007
http://wiki.debian.org/KernelFirmwareLicensing
still open bugs:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=242866
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=243022
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=383403
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412950 -
Re:GNUbuntu?
http://www.debian.org/vote/2006/vote_007
http://wiki.debian.org/KernelFirmwareLicensing
still open bugs:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=242866
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=243022
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=383403
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412950 -
Re:GNUbuntu?
http://www.debian.org/vote/2006/vote_007
http://wiki.debian.org/KernelFirmwareLicensing
still open bugs:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=242866
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=243022
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=383403
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412950 -
Re:GNUbuntu?
http://www.debian.org/vote/2006/vote_007
http://wiki.debian.org/KernelFirmwareLicensing
still open bugs:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=242866
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=243022
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=383403
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412950 -
Re:GNUbuntu?
http://www.debian.org/vote/2006/vote_007
http://wiki.debian.org/KernelFirmwareLicensing
still open bugs:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=242866
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=243022
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=383403
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412950 -
Re:GNUbuntu?
http://www.debian.org/vote/2006/vote_007
http://wiki.debian.org/KernelFirmwareLicensing
still open bugs:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=242866
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=243022
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=383403
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412950 -
Re:Java????
Java surpassed C++ performance many years ago, and by such a wide margin that no one even bothers running benchmarks anymore.
Do you have definite proof of that categorical statement or are you talking out of your ass?
In general, I have found that most benchmarks in which Java surpasses C++ in speed were done by people who have either poor understanding of C++ (using sub-optimal constructs) or poor familiarity with the compiler (using sub-optimal optimization options).
Here's what I found:- Przemyslaw Bruski in his take on the Java vs C++ benchmark writes:
When looking at C++ code, I've noticed many performance problems, which probably may go unnoticed for people with strong Java background. These problems were not present in Java code. In other words, to make this benchmark fair, I had to make some modifications to the original code. In doing so, I tried to make the code as close to the original as possible, even if my personal coding style is completely different. The results?
On Intel, all tests but two ended with C++ being better. Overall, C++ was twice as fast as Java.
On Athlon, every individual test ended with C++ performing better than Java. Overall, C++ was three times faster than Java. - Nikolaus Gebhardt in his blog entry about C++ vs. Java 1.6 - A fair Benchmark writes:
Knowing a bit about the C++ and Java optimizers, I was also able to revert the results completely. For example although using equivalent Java and C++ code, I was able to make the C++ version take 16 seconds for the nested loops-test while Java only needed 1 second by adding some virtual method calls which I knew Java could optimize. I also was able to make the C++ version run in only 78 ms while the equivalent Java version needed even 10 seconds by only using static loops - the C++ optimizer then would not even loop anything and just add the values together. This is partially what some of the wrong benchmarks out there are doing - even if not intentional. The results?
To make it short: As I expected C++ outperforms Java in every single test. But interestingly Java is getting closer now
- The Debian Computer Language Benchmarks Game shows that, on average Java is 2 to 2.5 times slower than C++.
To summarize:
1. That when benchmarking an algorithm in a programming language, you have to use the most efficient implementation for the language you are testing.
2. That it does not matter that language X is slower than language Y as long as it is fast enough for the task at hand.
3. That AKAImBatman was talking out of his ass.
Best regards,
Alex - Przemyslaw Bruski in his take on the Java vs C++ benchmark writes:
When looking at C++ code, I've noticed many performance problems, which probably may go unnoticed for people with strong Java background. These problems were not present in Java code. In other words, to make this benchmark fair, I had to make some modifications to the original code. In doing so, I tried to make the code as close to the original as possible, even if my personal coding style is completely different. The results?
On Intel, all tests but two ended with C++ being better. Overall, C++ was twice as fast as Java.
-
Re:Off the top of my head?
It's the expressiveness, silly. Seriously, that's all it comes down to; I can write the same program with a lot less code (and fewer bugs) in Python than anything else. So I'll prefer Python.
-
Re:Don't.
>C# is like every other system out there, it has its own ways and means - it can be incredibly efficient and fast, if you use it correctly.
Look, the GP said that C# is superior, this isn't even English: I asked superior in what to what?
In memory usage and performance, certainly not superior to C++ on Linux:
http://shootout.alioth.debian.org/gp4/benchmark.php?test=all&lang=csharp&lang2=gpp
And as a language, I think that Scala is better designed, that's all.
This doesn't mean that C# is bad, it's probably a good combination for Windows programming due to Microsoft's support, but that's a poor benchmark for 'superiority'! -
Re:Debian Lenny How-to kde4
Warning, if KDE3 is your working desktop, you may be wise to copy ~/.kde to restore it if KDE4 doesn't work for you.
1. use the url's above minus the [bracketed] words in /etc/apt/sources.list
2. Set pin priority. I borrowed from http://wiki.debian.org/Kde4schroot I also prioritized a couple of packages to be sure they didn't get upgraded. (mythtv-frontend is my biggie)
3. apt-get update
4. aptitude install -t experimental kde4 (this might take a while to calculate a solution that works for your system)
5. Restart X.
Big thanks to the author of the kde4schroot page.
http://wiki.debian.org/Kde4schroot
http://packages.debian.org/experimental/kde4 -
Re:Debian Lenny How-to kde4
Warning, if KDE3 is your working desktop, you may be wise to copy ~/.kde to restore it if KDE4 doesn't work for you.
1. use the url's above minus the [bracketed] words in /etc/apt/sources.list
2. Set pin priority. I borrowed from http://wiki.debian.org/Kde4schroot I also prioritized a couple of packages to be sure they didn't get upgraded. (mythtv-frontend is my biggie)
3. apt-get update
4. aptitude install -t experimental kde4 (this might take a while to calculate a solution that works for your system)
5. Restart X.
Big thanks to the author of the kde4schroot page.
http://wiki.debian.org/Kde4schroot
http://packages.debian.org/experimental/kde4 -
Re:Debian Lenny How-to kde4
Warning, if KDE3 is your working desktop, you may be wise to copy ~/.kde to restore it if KDE4 doesn't work for you.
1. use the url's above minus the [bracketed] words in /etc/apt/sources.list
2. Set pin priority. I borrowed from http://wiki.debian.org/Kde4schroot I also prioritized a couple of packages to be sure they didn't get upgraded. (mythtv-frontend is my biggie)
3. apt-get update
4. aptitude install -t experimental kde4 (this might take a while to calculate a solution that works for your system)
5. Restart X.
Big thanks to the author of the kde4schroot page.
http://wiki.debian.org/Kde4schroot
http://packages.debian.org/experimental/kde4 -
Re:Links Please
Debian has KDE 4.1beta1 in the experimental branch. debian unstable and experimental should satify the requirements for KDE4.1: eg.
deb http://ftp.de.debian.org/debian/ experimental main non-free contrib
deb-src http://ftp.de.debian.org/debian/ experimental main non-free contrib -
Re:Links Please
Debian has KDE 4.1beta1 in the experimental branch. debian unstable and experimental should satify the requirements for KDE4.1: eg.
deb http://ftp.de.debian.org/debian/ experimental main non-free contrib
deb-src http://ftp.de.debian.org/debian/ experimental main non-free contrib -
Re:Just 200 bugs?
My Leopard install is showing "OpenSSL 0.9.7l 28 Sep 2006" while my Debian machine is showing "OpenSSL 0.9.8g 19 Oct 2007". I imagine there might be a few bugs there, and it's late enough that it wouldn't have been released close enough to be included in 10.5.0.
Actually, the bug there is in Debian, not OS X. It's rather serious, too, so you might want to check it out. If your machine is publically exposed and running SSH, it might have already been rooted. -
Look at Debian Live
I've been playing around with Debian Live recently and the level of control you have over package selection and customization is impressive. It takes a little work to get used to the build system and how to customize your final image, but after you get through it once it is very simple.
You also have the ability to build images for CD-Rom's, usb sticks, netboot or hard drive images.
If you are not familiar with Linux, this route may be like jumping into the deep end. As others have mentioned, you may be better off using a canned distro like Monoppix while you do your development so you know exactly what you need in the end. Once you are comfortable and ready to move toward your final product, look towards Debian live. -
Re:Whichever one doesn't require Javathe one that isn't ridiculously slow because it uses Java. Ah, you mean this one. For instructions for any distro, see instructions for running Eclipse natively with GCJ from Classpath.
-
Bad Name
Sorry, the name "Etch" is already taken (in context of computers): the current stable release of Debian has codename Etch.
Usually it's better to find a name that is not yet taken, at least not in the environment that the program lives in. It's much easier to search for, and avoids confusion. -
I would donate to...
Debian. See: http://www.debian.org/social_contract And, if you'r interested after reading above, see: http://www.debian.org/donations Im not in anyway affiliated with Debian project, except I use it for every day work. You asked to whom you might donate, so this is my opinion.. they contributed "much" to the Open Source community. I know you'r not using Debian, but thats not the point. The point (imho) is in helping the Open Source and OS projects.
-
I would donate to...
Debian. See: http://www.debian.org/social_contract And, if you'r interested after reading above, see: http://www.debian.org/donations Im not in anyway affiliated with Debian project, except I use it for every day work. You asked to whom you might donate, so this is my opinion.. they contributed "much" to the Open Source community. I know you'r not using Debian, but thats not the point. The point (imho) is in helping the Open Source and OS projects.
-
Re:What is it with Ubuntu
if you look at http://ubuntu.com/ versus http://debian.org/ you'll notice that one is quite pretty and modern, and the other looks like it fell out of a wormhole circa 1996.
Eh, the Ubuntu site looks like every other corporate site out there. I prefer the Debian site, but those blue button links could probably be a less jarring color. -
Re:What is it with UbuntuI understand the concept and differences on what the title, "Operating System" means. As long as an OS is a title, it's understandable. I guess it just has to do with how it's called Ubuntu. Why not Ubuntu Linux? Because you could replace Linux with the BSD or Solaris kernels and still be Ubuntu. You could even replace the GNU userland with BSD or Solaris userland, and it would still be Ubuntu. The different "flavors" of Windows (lets focus on NT kernel models) all have the word windows in it, NT, XP, 2K, Vista. Though I still see windows as different, because they all don't exactly use the same kernel, they are, i assume, improved versions of the NT kernel. Those are different versions of the same OS, like different versions of Ubuntu. They use the same userland, just different versions of it. They even mostly use the same desktop and applications, just different versions.
-
Re:What is it with Ubuntu
One of the things that's with Ubuntu is that it's the only group with a real sense of marketing. Granted, it's viral marketing, but if you look at http://ubuntu.com/ versus http://debian.org/ you'll notice that one is quite pretty and modern, and the other looks like it fell out of a wormhole circa 1996. I even tried talking about a site redesign on #debian on freenode once and got flamed by someone saying "why the hell should the look of a website matter?" Perhaps it somewhat matters because when I was a newbie and knew nothing about the merits of distros, I overlooked Debian as being a fairly amateurish distro because, well, its website looked amateurish. Yes, I know better now, but we should acknowledge at least a little that appearances do matter.
Of course, it's not just the website. Ubuntu also has an army of Diggers, and it's overall just a really easy distro to get started with when you know nothing about Linux, because the project has made appealing to that crowd one of its goals.
-
Re:Yes.
If you're using uninitialized memory to generate randomness, it wasn't very random in the first place.
It is only one source for the entropy pool and the SSL "fix" was a Debian maintainer running valgrind on OpenSSL, finding a piece of code where uninitialized memory was accessed, "fixed" it and a "similar piece" and accidently removed all entropy from the pool. The result of that is, that all ssh-keys and ssl-certs created on Debian in the last 20 months are to be considered broken. (Debian Wiki SSLkeys on the scope and what to do)
-
Gaming Projects
As the article mentions Google ended up funding a number of Gaming projects. There are a total of 7 game projects and 5 game related projects for a total of over 40 slots.
The following game projects have been accepted,
- Battle for Wesnoth (projects), a very cool turn based strategy game in the theme of Heroes of Might and Magic.
- BZFlag (projects), the classic tank first person shooter game. One of the oldest open source games around!
- Linden Lab (projects), the makers of Second Life the largest "almost game like" online universe.
- ScummVM (projects), an engine which lets you play all the classic Lucas Arts games and many more!
- Thousand Parsec (projects), a framework for building 4x empire building games. Been around since 2001 and growing quickly.
- Tux4Kids (projects), a group of multi-platform open source educational games for children.
- WorldForge (projects), one of the original open source MMORPG which has even been mentioned on Slashdot multiple times (original called Altima).
My own project Thousand Parsec got 8 slots for a number of critical features. One of the coolest is a 3d client, which should make the games much more interesting to look at.
We will also finally have a few more interesting games to actually play, including a clone of Risk in Space and a very interesting game called DroneSec. Finally, we should have some opponents for you to play against as 2 AI clients being developed for our premier RFTS ruleset.
-
Re:Puppy Linux!
debian should have exactly what you are looking for, the netinst has just enough on the cd to install a console, then you can add whatever else you want with apt. link
-
NetBSD is the one to compare here
Isn't NetBSD the system filled with academics who insist upon clean, manageable, and portable code above all other standards? Too bad the NetBSD kernel didn't get judged here, I suspect it would have taken the cake.
I still recall this exhaustive report comparing several kernels' performance back in 2003 in which NetBSD pretty much beat the pants off of everybody else (note the two updates with separate graphs). The initial poor performance was due to an old revision, and upon seeing that there were some places in which the newer revision wasn't so hot, the developers fixed them and in only two weeks, NetBSD beat out FreeBSD on every scalability test. Their pragmatism and insistence on quality code finally paid off.
Ever since seeing those charts, I've been waiting for Debian/NetBSD to come out...
-
Re:Must we highlight every bug in IE?
In contrast, a far more dangerous bug in the openssl package used by Debian and its derivatives was discovered earlier this week, and doesn't seem to have made the Slashdot home page at all
You mean, this bug? -
Must we highlight every bug in IE?
I appreciate the desire to raise awareness, but there's no practical benefit to running this story other than Windows bashing. It'll get patched, the patch will probably ship on some future Tuesday given this is a feature few people use and the risk of exploitation is relatively low, and that'll be that.
In contrast, a far more dangerous bug in the openssl package used by Debian and its derivatives was discovered earlier this week, and doesn't seem to have made the Slashdot home page at all, even though it's probably relevant to a lot of the Slashdot readership and there is real action they can take to fix things. Go figure...
-
Keys are generated, yes.
Your system, when an SSH server (the package on Debian or Ubuntu is called "openssh-server") is installed, it generates host keys (that is, secret keys that identify your computer uniquely). This update will regenerate the keys for you, though you can do it manually (as root: "rm
/etc/ssh/ssh_host*; dpkg-reconfigure openssh-server") if you need to for some reason. Note that regenerating your keys will not fix anything unless you install the update first, because the generated keys will still be weak.
If you or anyone else logs into your machine via SSH, they'll get a warning about the host keys having changed. If you log into anyone else's machine via SSH, you'll need to make yourself new keys (by running ssh-keygen) and send everyone your new public key.
If you run an SSL website with an affected key, you'll have to get the certificate revoked by the issuing CA, and get a new key signed to make a new cert.
There's a list of applications which may be using weak keys at the Debian wiki. If you're not running any kind of server, it's likely that you're only going to need to replace your SSH keys, as described previously.
Those who administer servers are in for a significantly bumpier ride. -
Re:too little, too late?
Java is fast? Go try to run Azureus and weep.
Oh, you do? And you think it is fast? Try utorrent on Windows or Transmission on OSX or KTorrent on Linux some time.
People can write slow programs in any language. The question is, can moderately competent programmers write fast, efficient, maintainable programs in them? Pointing to one example is pointless. Back on topic, a quick check on Alioth will show you that overall, Java is faster than C#/Mono but uses more memory (although on some benchmarks the opposite is the case). It's also worth pointing out that although Java is not faster than C++ on any benchmark, it's substantially slower on only three. In general the performance of a program has much more to do with good design and good algorithms than it has to do with choice of language.
-
Re:Don't underestimate corporate arse-covering
Since you didn't link it, the utility is question is at http://security.debian.org/project/extra/dowkd/dowkd.pl.gz, and a GPG signature can be obtained by appending
.asc to that URL. -
Re:Comment!
That's not how it went down. There was a place that used unitialized memory:
#ifndef PURIFY
MD_Update(&m,buf,j); /* purify complains */
#endif
This neither hurt nor realistically helped much, and it was totally harmless for the Debian coder to remove it. As you can see, the OpenSSL code already had it under an ifdef in case you don't want to use it due to a memory checking tool. It was entirely unnecessary to warn about removing the code or defining PURIFY, since doing so is perfectly safe.The problem is that the Debian coder also removed the line:
MD_Update(&m,buf,j);
This was in a completely different function, where the variable buf was different and was initialized, and indeed was providing valuable entropy (from /dev/random on Linux, for example). It lacked the ifdef and comment about purify.We can't possibly expect the OpenSSL coders to comment every line of code that shouldn't be removed, but rather they should put code that can safely be omitted and which someone might want to omit under an ifdef, as they did here. MD_Update is called a bunch in that file. It would indeed be fairly ridiculous to have the comment,
/* just because we're reading uninitialized memory here, and it's safe to omit this call to MD_Update by defining PURIFY, doesn't mean you can safely comment out MD_Update calls at whim, even if they use a variable with the same name as here */, which is apparently what it would have taken to stop this guy.See the diff.
-
Tor also affected
It appears that the Tor network is also compromised by this bug:
http://archives.seul.org/or/announce/May-2008/msg00000.html
IMPACT:
A local attacker or malicious directory cache may be able to trick
a client running 0.2.0.x into believing a false directory consensus, thus
(e.g.) causing the client to create a path wholly owned by the attacker.
Further, relay identity keys or hidden service secret keys that were
generated on most versions of Debian, Ubuntu, or other Debian-derived OS
are also weak (regardless of your Tor version):
http://lists.debian.org/debian-security-announce/2008/msg00152.html
Given that Tor is relied on in some pretty scary places (China, etc.), I wonder if anyone will get killed because of this. -
Re:The light dawns... and it's a muzzle flash...
man, don't defend this guy. He is undefensible
look at the original ( now infamous ) patch: it didn't compile because Kurt put nested comments !
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/rand/md_rand.c?rev=141&r1=140&r2=141
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=173&r1=167&r2=173
( complete changelog of md_rand.c here )
This guy, Kurt Roeckx, seems really a tourist.
Besides that, if you are changing code that have to do with RNG , the least you can do is to make some test to assure that RN Generation still works
This guy just committed without total lack of responsibility. Very bad for Debian reputation, and it is a shame that debian doesn't have a policies about coding rigorous testing and audits in such sensitive packages like this ( we are not talking about a fancy MP3 player here )
--ombzzz -
Re:The light dawns... and it's a muzzle flash...
man, don't defend this guy. He is undefensible
look at the original ( now infamous ) patch: it didn't compile because Kurt put nested comments !
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/rand/md_rand.c?rev=141&r1=140&r2=141
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=173&r1=167&r2=173
( complete changelog of md_rand.c here )
This guy, Kurt Roeckx, seems really a tourist.
Besides that, if you are changing code that have to do with RNG , the least you can do is to make some test to assure that RN Generation still works
This guy just committed without total lack of responsibility. Very bad for Debian reputation, and it is a shame that debian doesn't have a policies about coding rigorous testing and audits in such sensitive packages like this ( we are not talking about a fancy MP3 player here )
--ombzzz -
Re:The light dawns... and it's a muzzle flash...
man, don't defend this guy. He is undefensible
look at the original ( now infamous ) patch: it didn't compile because Kurt put nested comments !
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/rand/md_rand.c?rev=141&r1=140&r2=141
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=173&r1=167&r2=173
( complete changelog of md_rand.c here )
This guy, Kurt Roeckx, seems really a tourist.
Besides that, if you are changing code that have to do with RNG , the least you can do is to make some test to assure that RN Generation still works
This guy just committed without total lack of responsibility. Very bad for Debian reputation, and it is a shame that debian doesn't have a policies about coding rigorous testing and audits in such sensitive packages like this ( we are not talking about a fancy MP3 player here )
--ombzzz -
Re:who was it?
Who was the member of the security services who acted as package maintainer?
Kurt Roeckx, a guy that seems to be paid by the enemy .. for example, he patches openssl but don't know that nested comments will no compile and had to repatch it:
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/rand/md_rand.c?rev=141&r1=140&r2=141
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=173&r1=167&r2=173
Worst , the same guy *stills* commits changes. See the comment of the last change ( the fix of the stupid thing about disabling RNG ):
"ssleay_rand_add() really needs to call MD_Update() for buf."
( http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=300&r1=199&r2=300
)
Still arrogant! yes ! ssleay_rand_add() *really* needs to call MD_Update. What do you thought? that openssl developers just put useless code for fun? my god, this people ( like Kurt ) is actually committing changes to a fundamental/pervasive security package without ever test that the RNG still works
If you are interested, here is the complete changelog of this md_rand.c source file:
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=300&view=log
IMHO, something has to change at Debian. Learn from Perl people: automated strict testing in any new patch, regression testing, etc. -
Re:who was it?
Who was the member of the security services who acted as package maintainer?
Kurt Roeckx, a guy that seems to be paid by the enemy .. for example, he patches openssl but don't know that nested comments will no compile and had to repatch it:
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/rand/md_rand.c?rev=141&r1=140&r2=141
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=173&r1=167&r2=173
Worst , the same guy *stills* commits changes. See the comment of the last change ( the fix of the stupid thing about disabling RNG ):
"ssleay_rand_add() really needs to call MD_Update() for buf."
( http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=300&r1=199&r2=300
)
Still arrogant! yes ! ssleay_rand_add() *really* needs to call MD_Update. What do you thought? that openssl developers just put useless code for fun? my god, this people ( like Kurt ) is actually committing changes to a fundamental/pervasive security package without ever test that the RNG still works
If you are interested, here is the complete changelog of this md_rand.c source file:
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=300&view=log
IMHO, something has to change at Debian. Learn from Perl people: automated strict testing in any new patch, regression testing, etc. -
Re:who was it?
Who was the member of the security services who acted as package maintainer?
Kurt Roeckx, a guy that seems to be paid by the enemy .. for example, he patches openssl but don't know that nested comments will no compile and had to repatch it:
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/rand/md_rand.c?rev=141&r1=140&r2=141
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=173&r1=167&r2=173
Worst , the same guy *stills* commits changes. See the comment of the last change ( the fix of the stupid thing about disabling RNG ):
"ssleay_rand_add() really needs to call MD_Update() for buf."
( http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=300&r1=199&r2=300
)
Still arrogant! yes ! ssleay_rand_add() *really* needs to call MD_Update. What do you thought? that openssl developers just put useless code for fun? my god, this people ( like Kurt ) is actually committing changes to a fundamental/pervasive security package without ever test that the RNG still works
If you are interested, here is the complete changelog of this md_rand.c source file:
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=300&view=log
IMHO, something has to change at Debian. Learn from Perl people: automated strict testing in any new patch, regression testing, etc. -
Re:who was it?
Who was the member of the security services who acted as package maintainer?
Kurt Roeckx, a guy that seems to be paid by the enemy .. for example, he patches openssl but don't know that nested comments will no compile and had to repatch it:
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/rand/md_rand.c?rev=141&r1=140&r2=141
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=173&r1=167&r2=173
Worst , the same guy *stills* commits changes. See the comment of the last change ( the fix of the stupid thing about disabling RNG ):
"ssleay_rand_add() really needs to call MD_Update() for buf."
( http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=300&r1=199&r2=300
)
Still arrogant! yes ! ssleay_rand_add() *really* needs to call MD_Update. What do you thought? that openssl developers just put useless code for fun? my god, this people ( like Kurt ) is actually committing changes to a fundamental/pervasive security package without ever test that the RNG still works
If you are interested, here is the complete changelog of this md_rand.c source file:
http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?rev=300&view=log
IMHO, something has to change at Debian. Learn from Perl people: automated strict testing in any new patch, regression testing, etc.