***FlogHelper anonymity breach*** and Freenet 0.7.5 build 1441

Freenet 0.7.5 build 1441 is now available. Please upgrade, the changes are minimal but include a critical security fix for FlogHelper. If you have used FlogHelper and have published flogs with the "safe backups" option enabled, your hostname is visible to anyone who downloads flog.db4o. Sorry about this, we should have been more careful (it's an information leak inside db4o...). A more detailed warning will show up if you use it. Note that this may not affect you even if you do have a FlogHelper flog with backups turned on, if it hasn't been updated recently and the backup file is large enough not to be in the main container (in which case it may have fallen out).

Changes:
- Update the SSL certificate for the last resort update scripts.
- Catch more db4o errors on startup.
- Library v27.
- FlogHelper v29.
- Fix an NPE in non-persistent USK inserts.

ANONYMITY BREACH: Your flog "${title}" has leaked your hostname "${hostname}" for your WoT identity ${author}, in the backup file "flog.db4o". That means all your flogs, Sone posts, Freetalk posts, Freemail and anything else using that identity can be connected to "${hostname}". You could keep using this identity but bear in mind that it may be compromised, or you could delete the identity. Files on Freenet cannot be deleted, but if you upload a new version the old one may eventually become inaccessible, although somebody may have downloaded it already. You can delete the identity or create a new one on the Community menu under "Own anonymous identities". In case of any questions please contact us securely on Freenet Messaging System (FMS) board Freenet.

_______________________________________________
Devl mailing list
[email protected]
https://emu.freenetproject.org/cgi-bin/mailman/listinfo/devl

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEABEIAAYFAlGKaQUACgkQYUNbc3WUHYh/hACeJqFs1gkTFoeTxC2oufFaT4T8
/WMAn2TrBKoX81FVx3Vpim1AWTyLUNEe
=9Toe
-----END PGP SIGNATURE-----