| DJones | Has ubottu got a slight factoid problem, its just announced about TLS protocol which I'm assuming has come from the RFC query just before, but the end of the factoid is cut short, it stops at "attackers t" | 09:06 |
|---|---|---|
| DJones | That was in #ubuntu at 9:02 uk time | 09:06 |
| bazhang | DJones, saw that. pretty bizarroid | 09:08 |
| DJones | I was assuming its part the feature just added for bug reports that it picked up the reference & replied | 09:09 |
| Tm_T | DJones: the message length is IRC protocol (implementation) limited, so it got cut off | 09:46 |
| DJones | Tm_T: ok, that would explain it | 09:46 |
| Tm_T | or I assume it is hitting the limit | 09:46 |
| jussi | yeah, it picks up RFC's also iirc. | 10:04 |
| jussi | Grabs them from an external site, much like the bug tracker - we probably want to turn off rfc's in #ubuntu. | 10:05 |
| jussi | DJones: if you have a sec, could you reply to the irc list and mention this? | 10:05 |
| DJones | jussi: yeah will do | 10:06 |
| jussi | DJones: thanks | 10:06 |
| DJones | Do you want it on the thread about the added feature | 10:07 |
| DJones | Done | 10:19 |
| m4v | CVE-2009-3555 | 10:42 |
| ubottu | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attacke | 10:42 |
| bazhang | hehe | 10:42 |
| m4v | not sure what tracker it is .. | 10:42 |
| m4v | ah well, I was looking all over the bugtracker configs, but is actually hardcoded in cveSnarfer method, it grabbed http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 | 10:47 |
| ubottu | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attacke | 10:47 |
| m4v | right | 10:47 |
| Tm_T | how repetitive | 10:47 |
| m4v | looks like there's not config for disable the CVE snarfer, if you want it off I can comment it out (until somebody makes a nicer fix) | 11:00 |
| Tm_T | would it disable it everywhere? | 11:01 |
| m4v | yes | 11:01 |
| Tm_T | hmmm, I'm not sure if that desirable either | 11:02 |
| m4v | obliously, I could do it better and add a config option, but I'm sort of time and removing it is just a one line fix | 11:02 |
| m4v | we can wait for tsimpson and take a look too. | 11:03 |
| elky | o.O | 11:09 |
| elky | Cute. | 11:09 |
| Tm_T | thanks, must be my new haircut | 11:10 |
| * Tm_T hides | 11:10 | |
| elky | Oh, that's hair? I thought it was a dustpuppy. | 11:10 |
| Tm_T | tomeitos | 11:11 |
| jussi | m4v: I think we leave it untill the next ircc meeting - its not that often that people mention those numbers. Ill have a chat with tsimpson in the meantime | 11:21 |
| m4v | jussi: kk | 11:30 |
| === lubotu3` is now known as lubotu3 | ||
| tsimpson | CVE-2009-3555 | 15:04 |
| ubottu | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation han... (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555) | 15:04 |
| tsimpson | DJones: ^ | 15:05 |
| tsimpson | jpds: new Bugtracker stuff committed, you'll need to set supybot.plugins.Bantracker.cveSnarfer to True where you want CVE's to be shown (if anywhere). setting supybot.plugins.Bantracker.bugSnarfer to False overrides cveSnarfer too | 15:08 |
| DJones | tsimpson: That was a quick change | 15:28 |
| tsimpson | everything required to do it already existed in the plugin, so I just had to modify the functions that parse the CVEs | 15:30 |
| m4v | heads up, saymin was flooding #ubuntu-es a few mins ago | 19:51 |
| m4v | he's now in #u | 19:52 |
| IdleOne | thanks m4v | 19:52 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!