Хуй!

jmc@ modified usr.bin/sed/sed.1: posix does not count `!' as a separate function, and neither should we; instead, move the description of...

jmc@ modified usr.bin/sed/sed.1: the `P' function was crying out for a comma;

jmc@ modified usr.bin/sed/sed.1: rework the SED FUNCTIONS text;

ajacoutot@ modified www/webkit: Minor update to WebKit 2.4.3.

miod@ modified lib/libssl/src/ssl/d1_pkt.c: Make sure all error paths in dtls1_buffer_record() invoke SSLErr by factoring error handling....

jmc@ modified usr.bin/sed/sed.1: tweak the text for -a and function lists;

miod@ modified sys/arch/m88k/m88k/trap.c: Do not change the state of the carry bit in the psr when returning with ERESTART or EJUSTRETURN...

kettenis@ modified sys/arch: Replace some magic constants with appropriate defines.ok krw@, deraadt@

naddy@ changed x11/qt4: Fix a GNU-ism in a sed expression that gets copied into generated Makefiles.

halex@ modified etc/mtree/special: remove /usr/src. avoids useless whining from daily security mail.ok landry@ ajacoutot@

jasper@ modified sysutils/mcollective/Makefile: re-install NO_BUILD, but add ruby to BUILD_DEPENDS. noticed by several

rpe@ modified sysutils/ansible: Update ansible to 1.6.2OK aja@ landry@

miod@ modified lib/libssl/src/ssl/t1_lib.c: tls_decrypt_ticket(): memory leak and uncleaned EVP_CIPHER_CTX upon error.

miod@ modified lib/libssl/src: We don't really to keep history in constructs such as:#if 1 /* new with openssl 0.9.4 */ current code; #el...

miod@ modified lib/libssl/src/ssl/ssl_ciph.c: Unchecked malloc() return value in SSL_COMP_add_compression_method(), in the !OPENSSL_NO_CO...

miod@ modified lib/libssl/src/ssl: Replace the following logic:if (nothing to allocate) ptr = malloc(1) else { if ((ptr = malloc(size to...

bluhm@ changed net/p5-Net-DNS: - update p5-Net-DNS to 0.76 - remove patch, it has been fixed upstream

bluhm@ modified devel/p5-File-Find-Object-Rule: update p5-File-Find-Object-Rule to 0.0305

bluhm@ modified security/p5-Net_SSLeay: update p5-Net-SSLeay to 1.63

bluhm@ modified security/p5-IO-Socket-SSL: update p5-IO-Socket-SSL to 1.989

In
episode 241
of bsdtalk, Bob Beck (beck@) is interviewed about the OpenBSD Foundation, his ongoing OpenBSD hacking, hackathons, and, of course, LibreSSL. He even manages to work in some fresh lore concerning Theo's basement.
Interview at BSDCan 2014 with Bob Beck from the OpenBSD Project and the OpenBSD Foundation.Audio
[
mp3
|
ogg
]
Ссылка: http://undeadly.org/cgi?action=article&sid=20140526051427

td>p,td>ul,td>blockquote,td>font {margin-left:0.5ex;}
a:visited {color:#303030!important;}
p {margin-top:1ex;margin-bottom:0;}
blockquote>p:first-child {margin-top:0;}
blockquote>p:last-child {margin-bottom:0;}
blockquote { background-color:#e0e0e0; padding:0.5ex 0.5ex 0.5ex 0.5ex;
margin:0 0 0 3ex !important; }
p+ul,p>ul {margin:0.5ex 0 0 0;}
pre {margin:0;}
tt {background-color:#f0f0f0; padding:0px; font-weight:500;}
.bqcode { background-color: #ffffff; border:1px solid #999;
padding: 0px; padding-left: 1em; }
As described in an email from Errata-meister Tedu on OpenBSD-Announce,
from http://www.openbsd.org/errata55.html:
X Font Service Protocol & Font metadata file handling issues in libXfont
CVE-2014-0209: integer overflow of allocations in font metadata file parsing
CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies
CVE-2014-0211: integer overflows calculating memory needs for xfs repliesPlease see the advisory for more information.
http://lists.x.org/archives/xorg-announce/2014-May/002431.html
Check out the build details after the break.
Read more...
Ссылка: http://undeadly.org/cgi?action=article&sid=20140526075700

An Anonymous Coward writes in to tell us about sightings of secrets-related privsep in the wild:
The developer known by the pseudonym insane coder, who authored the popular pro-LibreSSL review LibreSSL: The good and the bad, has presented a solution for preventing common coding mistakes resulting in another Heartbleed:
To protect against exploiting such bugs, one should ensure that buffer overflows do not have access to memory containing private data. The memory containing private keys and similar kinds of data should be protected, meaning nothing should be allowed to read from them, not even the web server itself.
He then talks about using memory protection and process separation to isolate a server's private keys from anything which can be exploited to send them over the network.This technique has already been utilized in an stunnel-like server, and it remains to be seen when others will follow.
Thanks for the tip, Anonymous Coward!Astute readers will note that this technique has
already
been
utilized
in relayd(8) and smtpd(8).
Ссылка: http://undeadly.org/cgi?action=article&sid=20140526133341

сурово :)

td>p,td>ul,td>blockquote,td>font {margin-left:0.5ex;}
a:visited {color:#303030!important;}
p {margin-top:1ex;margin-bottom:0;}
blockquote>p:first-child {margin-top:0;}
blockquote>p:last-child {margin-bottom:0;}
blockquote { background-color:#e0e0e0; padding:0.5ex 0.5ex 0.5ex 0.5ex;
margin:0 0 0 3ex !important; }
p+ul,p>ul {margin:0.5ex 0 0 0;}
pre {margin:0;}
tt {background-color:#f0f0f0; padding:0px; font-weight:500;}
.bqcode { background-color: #ffffff; border:1px solid #999;
padding: 0px; padding-left: 1em; }
A bit late ourselves on a
late announcement,
but Theo de Raadt (deraadt@) and Bob Beck (beck@) will be giving a presentation in Calgary:
I'm sorry for the late public announcement...Tomorrow (Tuesday) Bob Beck will be hurtling down the Highway from
Edmonton to Calgary.Then in the evening, he and I will present at the local calgary unix
group meeting about recent changes in LibreSSL, OpenBSD, and how the
OpenBSD Foundation fits into this.http://www.cuug.ab.ca/
Anyone in the area who is able to attend probably should.
Ссылка: http://undeadly.org/cgi?action=article&sid=20140527060358

td>p,td>ul,td>blockquote,td>font {margin-left:0.5ex;}
a:visited {color:#303030!important;}
p {margin-top:1ex;margin-bottom:0;}
blockquote>p:first-child {margin-top:0;}
blockquote>p:last-child {margin-bottom:0;}
blockquote { background-color:#e0e0e0; padding:0.5ex 0.5ex 0.5ex 0.5ex;
margin:0 0 0 3ex !important; }
p+ul,p>ul {margin:0.5ex 0 0 0;}
pre {margin:0;}
tt {background-color:#f0f0f0; padding:0px; font-weight:500;}
.bqcode { background-color: #ffffff; border:1px solid #999;
padding: 0px; padding-left: 1em; }Stefan Wollny wrote in with this blocking by regions article:Every now and then the same question arises on the mailing-lists: "How to block traffic from a country altogether?" While this is a "no-go" in a business-minded environment this question may be valid for a private network. If you have not the slightest doubt that there has never been and will never be any contact to servers located e.g. in Belarus ever it might rightfully assumed that blocking IPs related to Belarus should not only do no harm but will a little bit improve the security of your home network.Read more...
Ссылка: http://undeadly.org/cgi?action=article&sid=20140527054301

td>p,td>ul,td>blockquote,td>font {margin-left:0.5ex;}
a:visited {color:#303030!important;}
p {margin-top:1ex;margin-bottom:0;}
blockquote>p:first-child {margin-top:0;}
blockquote>p:last-child {margin-bottom:0;}
blockquote { background-color:#e0e0e0; padding:0.5ex 0.5ex 0.5ex 0.5ex;
margin:0 0 0 3ex !important; }
p+ul,p>ul {margin:0.5ex 0 0 0;}
pre {margin:0;}
tt {background-color:#f0f0f0; padding:0px; font-weight:500;}
.bqcode { background-color: #ffffff; border:1px solid #999;
padding: 0px; padding-left: 1em; }

с этим можно что-то сделать? :(

td>p,td>ul,td>blockquote,td>font {margin-left:0.5ex;}
a:visited {color:#303030!important;}
p {margin-top:1ex;margin-bottom:0;}
blockquote>p:first-child {margin-top:0;}
blockquote>p:last-child {margin-bottom:0;}
blockquote { background-color:#e0e0e0; padding:0.5ex 0.5ex 0.5ex 0.5ex;
margin:0 0 0 3ex !important; }
p+ul,p>ul {margin:0.5ex 0 0 0;}
pre {margin:0;}
tt {background-color:#f0f0f0; padding:0px; font-weight:500;}
.bqcode { background-color: #ffffff; border:1px solid #999;
padding: 0px; padding-left: 1em; }Stefan Wollny wrote in with this blocking by regions article:Every now and then the same question arises on the mailing-lists: "How to block traffic from a country altogether?" While this is a "no-go" in a business-minded environment this question may be valid for a private network. If you have not the slightest doubt that there has never been and will never be any contact to servers located e.g. in Belarus ever it might rightfully assumed that blocking IPs related to Belarus should not only do no harm but will a little bit improve the security of your home network.Read more...
Ссылка: http://undeadly.org/cgi?action=article&sid=20140527054301

теперь эта статья приходит столько раз, сколько запустишь фетч :(

> с этим можно что-то сделать? :(
К сожалению, если держатель rss ленты пихает туда <style>css код</style> прямо в ленту, то ему уже ничего не поможет.

gate3 я закоменнтил, но где рсс от cvs?

> gate3 я закоменнтил, но где рсс от cvs?
Странно, выдаёт ошибку 500

Теперь работает, но нет самих новостей.

короче, надо идти по длинному пути. сделать ii популярным и модным, и тогда авторы сами будут выпрашивать пойнта и коммитить новости :)

ajacoutot@ modified sysutils/salt: Rm more files.

deraadt@ modified index.html: + LibreSSL link

jmc@ modified usr.bin/sed/sed.1: paste in an EXAMPLES section, from posix spec;

rpointel@ updated cvs/ports/graphics/py3-cairo/patches: Directory /cvs/ports/graphics/py3-cairo/patches added to the repository

rpointel@ changed graphics/py3-cairo: Permit to build py3-cairo with Python 3.4. tested in a bulkd build by landry@ (thanks).

miod@ modified lib/libssl/src/ssl: Remove redundant test introduced in s3_pkt.c on 20001225, which got cargo-culted (with an XXX comment,...

bcallah@ modified games/wtf: Update to 20140525.

sthen@ modified net/unifi: update to unifi-3.1.12

martynas@ modified gnu/usr.bin/gcc/gcc/toplev.c: Enable strong stack protector by default for GCC 3 architectures. Miod says all architec...

claudio@ modified sys/net/r*: Big refactoring of the radix code (mainly rn_addroute but also part of rn_delete was changed). The mpath co...

naddy@ modified audio/libao: Update to 1.2.0. No user-visible changes.

naddy@ modified shells/bash: update to 4.3 patchlevel 18

miod@ modified lib/libssl/src/ssl/ssl_locl.h: Remove unused defines.

kili@ changed print/lilypond: Update to lilypond-2.18.2.Initial diff and testing of the final diff on i386 and amd64 by Graeme Lee (thank...

juanfra@ modified fonts/fira-fonts: Update to fira 20140527.