Re: Ubuntu Loco Meeting 8/15/08 @ 8:00pm

My launchpad key had to be recreated because they removed it, I have no 
idea if it was a bad key or not, but I still had the hassle of getting a 
new key registered. But you raise a good point, I think they were playing 
better safe than sorry.

David Thomas




"Matthew Bowie" <[email protected]> 
Sent by: [email protected]
05/15/2008 03:08 PM
Please respond to
New Mexico Linux Users Group Mail List <[email protected]>


To
"New Mexico Linux Users Group Mail List" <[email protected]>
cc

Subject
Re: [NMLUG] Ubuntu Loco Meeting 8/15/08 @ 8:00pm






Did the OpenSSH issue actually affect you at all (other than having to
check your systems)?  I've checked my keys in use (most generated
during the affected time period), and haven't found any blacklisted
ones.  I read on one article that the uninitialized buffer (the code
for which was removed, causing this problem) was only used if
/dev/urandom was not available at the time the key was generated.  I
haven't checked the source to verify this though, anyone have an
informed answer about this?

Has anyone on this list actually find a vulnerable key on any of their
systems?  I'm beginning to think it was a colossal screw-up from a
technical and QA standpoint, but that it's not nearly as big a deal as
the media/bloggers/etc are making it out to be (since /dev/urandom is
available on a vast majority of systems, assuming the post I read was
correct).

Matt

> We have lots to talk about tonight like all the fun the OpenSSH issue 
has
> caused us.....hope to see you there.
>
>
>
> David Thomas
>
-- 
Matthew Bowie
Programmer/IT Consultant
[email protected]
_______________________________________________
NMLUG mailing list
[email protected]
http://lists.b9.com/cgi-bin/mailman/listinfo/nmlug

_______________________________________________
NMLUG mailing list
[email protected]
http://lists.b9.com/cgi-bin/mailman/listinfo/nmlug