since Debian broke it
|
| Author | Content |
|---|---|
| tuxchick May 13, 2008 2:26 PM EDT |
...it's big of them to finally fix it :) |
| gus3 May 13, 2008 8:45 PM EDT |
Crypto is one field hackers don't belong in. As Bruce Schneier says, any amateur can invent a crypto algorithm that said amateur can't break. Yet another reason to run Slackware: sources modified only when absolutely necessary. |
| thenixedreport May 13, 2008 8:54 PM EDT |
Quoting:Crypto is one field hackers don't belong in. I take exception to that. It was the hacker mentality that finally allowed encryption to be used on computers for the Internet. Individuals rose up while the NSA sought to retain a monopoly on encryption in general. |
| gus3 May 13, 2008 9:38 PM EDT |
Just because you're using it, doesn't mean you're in that line of work, developing it. Good crypto requires clear mathematical proofs, and if you aren't doing it for a living (or training for it), you probably don't belong in crypto development. Point of history: The NSA sought a monopoly on strong encryption, which was basically anything stronger than 56-bit DES. They refused to take into account Moore's Law and international cyber-combat. It was the EFF's and distributed.net's 22-hour crack of DES in 1998, using hardware simulators in parallel, that exposed the folly of the NSA's position. |
| thenixedreport May 13, 2008 10:28 PM EDT |
Have you read Levy's book on the subject? |
| gus3 May 14, 2008 8:20 AM EDT |
No, I have not. I don't need him to tell me what I lived and what the stakes were. |
| thenixedreport May 14, 2008 12:12 PM EDT |
Quoting:I don't need him to tell me what I lived and what the stakes were. I'm sure hackers would tell you that they don't need you to tell them what they can and can not do! |
| Sander_Marechal May 14, 2008 2:47 PM EDT |
So, who else here spent the day regenerating RSA keys and reinstalling them on oodles of servers? Related: Do you guys even track where you install your id_rsa.pub files? I assume that even if you did delete your local id_rsa and id_rsa.pub files, an attacker could still log into a remote system that has your id_rsa.pub installed in it's authorized_keys2 file. If so, any way to easily revoke all such certificates (aside from tracking down all servers and editing the authorized_keys2 files)? Will non-debian based distros also include the sshkey blacklists? |
Posting in this forum is limited to members of the group: [ForumMods, SITEADMINS, MEMBERS.]
Becoming a member of LXer is easy and free. Join Us!