Dear ladies and gentlemen,

OpenCON is the only conference fully dedicated to OpenBSD. Last year edition
was a great success and featured also the party for OpenBSD 10th birthday,
with project leader Theo de Raadt and a lot of developers. More info here:
http://2006.opencon.org/

The OpenCON program committee is inviting speakers to submit innovative,
original, and interesting talks on apps, architecture, implementation,
performance and security of OpenBSD. Speeches and slides must be in englis...

[IMAGE]Having trouble reading this email? See it in your browser

ArabianBusiness.com Daily News Alert

GHMK ]m Gacf^Z:

GaCMO ,24 SHJcHQ 2007

------------------------------------------------------------------------

[IMAGE]

GaCNHGQ GaQFmSmI

5 caGmmd edOm mZcafd ]m Ofa "GaJZGfd"
6 ]m GacGFI cd GaZcGa GaedfO cfLfOfd ]m GaSZfOmI mZcafd ]m Ga^XGZ GaQScm
faG JTcaec ^fGdmd GaZca

eGamHmQJfd JSZl aTQGA MUU HTQ_GJ d]X NamLmI
d^aJ UMm]I GaTQ^ GaCfSX Zd eGamHQJfd GaCcQm_mI CdeG JOQS TQGA MUU HT...

Yes, which is one of the reasons I personally believe Visa's PCI is an
extortion sham.

However, some hugely influential entities happen to require those
complexities, and no reason on the world will convince anyone (who doesn't
know but decides) on the virtues of the KISS principle.

Rui

--
Frink!
Today is Boomtime, the 48th day of Bureaucracy in the YOLD 3173
+ No matter how much you do, you never do enough -- unknown
+ Whatever you do will be insignificant,
| but it is very important ...

Intelligent sysadmins know every setuid binary on their system.
Unintelligent ones get owned.

Oh, that sounds like a recipe for success.

- Run _arbitrary_ _binary_ application on system. Intend to use policy
wrapper to restrict to allowed operations.
- Can't figure out how to get a working policy (made harder because
you can't debug the damn blob well anyway). (made harder because the
ppl who sold you that application aren't going to be able to help you
when you ask them "why is this app doing X Y and Z?" when X Y and Z
are system calls they've never heard of.)
- So, disable policy stuff...

... Whether or not the business wants to stay in business.
Security policy seems like a very effective tool for Denial of Service.
Burroughs Computers essentially went out of business because their
computers refused to do illegal operations while IBM's computers
very happily did all sorts of illegal stuff.

The problem is that if you must wait for perfection, you're dead.
It is always a case of what can be achieved with how much effort.
There are many cases where people fix what they can fix,
ind...

On 9/24/07, Tony Abernethy <tony@servacorp.com> wrote:

This is ironic considering that Burroughs Corp was founded by William
S. Burroughs' grandfather ;-)

http://www.openbsd.org/anoncvs.html#CVSROOT

Howdy all,

Anyone tried OpenBSD on a decTOP?
http://store.dataevolution.com/ProductDetails.asp?ProductCode=DT%2D7001&...
Small, little, Geode system. The downside is there's no serial console,
until of course you take a look at a picture of the system board,
http://www.enicomms.com/decTOP/DSCF1159.JPG , where you'll find an
unpopulated location for a pin header that has 5V,GND,RX,TX labelled,
sounds like a serial port to me. :-) Oh, yeah, no onboard ethernet and
USB 1.1 only, but ...

hmmm, I don't comprehend your question.

diana

typically the USB lines are called VBUS, D+, D-, and GND. I would guess
that is a serial port. Send me one and I'll put a 'scope on it and see :-)

There has been at least one dmesg submitted for these,
audio/modem is currently not yet supported and I'm looking for someone
who replies to mail to test a diff to support DMA on the CS5535 IDE
controller which is designed somewhat strangely.

Hi all

Can tags from ipsec (defined in ipsec.conf) be referenced in pf nat
rules (OBSD 4.1)?

The idea is:
ipsec.conf:
ike esp from A to B tag "mytag"

pf.conf:
nat on $int_if tagged "mytag" -> ($int_if:1)
nat on $int_if from !($int_if) -> ($int_if:0)

If I use the "tagged" keyword, the second nat rule is used even for
packets coming out of the ipsec tunnel. Replacing the "tagged" keyword
with the actual IPs works:
nat on $int_if from A to B -> ($int_if:1)

Shouldn't this be...

I currently have OBSD running on my P-II with an 850 MB drive and 64 MB
ram. On install, I chose not to include the compiler set over concern
re drive space. The FAQ says how much space is required to minimally
run OBSD and it says how much to be able to comfortably compile ("4G is
not a bad size").

It may not be "bad" but what is the absolute minimum size of hard drive
for an i386 to be able to recompile any necessary patches itself?

Thanks,

Doug.

I do not want to sound mean or snide here, but you are playing
a somewhat foolish game trying to do things on an 850M drive
and having to worry about every K of disk. This reminds me
of something that Ted Nelson of Xanadu fame once said about
people who dealt with inadequate systems: "Look what I did
with 16K and a Bowie knife!"

I think you could get away with 2.5G of disk if you aren't
using X. /usr/src is around 1G, /usr/obj is I think a little
under that, so 2.5G should give you slop room...

Well, do you consider, say, ksh and vi as part of the system or as
"common applications"?

What about wscons? Does a Hebrew VT220 change writing direction?

I know that adding full POSIX i18n support requires changes to lots
of text processing tools under /usr/bin. Languages like Hebrew or
Arabic are likely to add further complications, but I don't know
if their needs are covered by POSIX.

At least I'm aware that I know approximately nothing about this
topic. I sure hope people who make con...

Then it sounds almost like you were running with a too short passtime,

We've been seeing a lot of that here, too. Mostly it's a few (maybe
20) a day to the most widely known domain here, then occasionally
somebody pushes the "generate" button for too long and one domain
almost nobody actually uses gets the bouces for 700+ fake
addresses[1]. Bob Beck's greyscanner is rather effective, as is the
more manual methods I've blogged about the observations quite a bit,
starting with [2].

Short summa...

It wouldn't be a problem if it didn't mimic a DDOS attack.
Getting bombarded by many dozen SMTP connection in a very
short time-span iss a bit alarming (at least was to me).

Other than that, I agree, sendmail would drop them as "User
unknown" and that's the end of story.

Btw, your "reply-to" field contains my e-mail address. Is that
intended?

Cheers,
--patrick

The command you used works for me (well, no errors) on i386 - 4.1
installed off CD. X installed at install time, and definitely
working on the machine.

What is your PKG_PATH / where are the packages that you are
installing from?

# PKG_PATH=ftp://ftp.openbsd.org/pub/OpenBSD/4.1/packages/i386/
# export PKG_PATH
# echo $PKG_PATH
ftp://ftp.openbsd.org/pub/OpenBSD/4.1/packages/i386/

# pkg_add -nv xfwm4
parsing xfwm4-4.2.3.2p1
Dependencies for xfwm4-4.2.3.2p1 resolve to: libxfce4mcs-4.2.3p...

Darren, thanks for expounding on the subject. Funny, I just read about
screen(1) on merdely's blog last night.

http://erdelynet.com/tech/openbsd/my-gnu-screen-config/

A capsule summary of the situation is:

OpenBSD aims to improve security by taking advantage of easy-to-use,
hard-to-disable, low-overhead technologies.

yes, you can disable propolice if you need to, but you have to know how.
yes, you can disable random library mappings, but you have to know how.
yes, you can disable W^X, but you have to try.

you could turn off the security features, but why would you, since
they don't get in your way, and they don't slow you down all that
much. i've not seen...

does http://marc.info/?l=openbsd-misc&m=118649819926825&w=2 have any
implications for whether or not to use systrace?

i've found systrace to be a challenge to implement but it feels very
warm and fuzzy when it works.

--

You solve the problem a different way:

- You don't give the guy root access, but their own userid

- You set file permissions so this userid can read only the file of interest

- You use pf rules so that this user ID cannot send network packets

- If this guy needs root for something (e.g. to bind to port 80), then you
write a three-line setuid root wrapper which binds to port 80 for them.
If you have a lot of this to do, then consider an 'open server' which
returns the open file descrip...

Where do I get the ssh fingerprints of the CVS servers?

And if I use cvsync, where do I get fingerprints?

Best
Martin

I can.

But can we agree that packages are not digitally signed, patches are
not digitally signed and the methods used to distribute sources online
also don't use digital signatures? And that md5/sha1 and pgp are older
than OBSD?

And to further the flamefest: This is one area where most Linux
distros are better.

Best
Martin