Debian fixes serious crypto bug

...it's big of them to finally fix it :)

Crypto is one field hackers don't belong in. As Bruce Schneier says, any amateur can invent a crypto algorithm that said amateur can't break.

Yet another reason to run Slackware: sources modified only when absolutely necessary.

Quoting:Crypto is one field hackers don't belong in.

I take exception to that. It was the hacker mentality that finally allowed encryption to be used on computers for the Internet. Individuals rose up while the NSA sought to retain a monopoly on encryption in general.

Just because you're using it, doesn't mean you're in that line of work, developing it. Good crypto requires clear mathematical proofs, and if you aren't doing it for a living (or training for it), you probably don't belong in crypto development.

Point of history: The NSA sought a monopoly on strong encryption, which was basically anything stronger than 56-bit DES. They refused to take into account Moore's Law and international cyber-combat. It was the EFF's and distributed.net's 22-hour crack of DES in 1998, using hardware simulators in parallel, that exposed the folly of the NSA's position.

Have you read Levy's book on the subject?

No, I have not. I don't need him to tell me what I lived and what the stakes were.

Quoting:I don't need him to tell me what I lived and what the stakes were.

I'm sure hackers would tell you that they don't need you to tell them what they can and can not do!

So, who else here spent the day regenerating RSA keys and reinstalling them on oodles of servers?

Related: Do you guys even track where you install your id_rsa.pub files? I assume that even if you did delete your local id_rsa and id_rsa.pub files, an attacker could still log into a remote system that has your id_rsa.pub installed in it's authorized_keys2 file. If so, any way to easily revoke all such certificates (aside from tracking down all servers and editing the authorized_keys2 files)? Will non-debian based distros also include the sshkey blacklists?