Have a suggestion?

Click here to suggest a blog item.

Newsletters Archive

Catch up with DonationCoder by browsing our past newsletters, which collect the most interesting discussions on our site: here.

Editorial Integrity

DonationCoder does not accept paid promotions. We have a strict policy of not accepting gifts of any kind in exchange for placing content in our blogs or newsletters, or on our forum. The content and recommendations you see on our site reflect our genuine personal interests and nothing more.

Latest News

July 2, 2024
Server Migrations Coming

  • Donationcoder server migration is slowly proceeding, expect some hiccups as we get all our ducks in a row..

July 19, 2022
Software Update

Jan 3, 2022
Event Results

May 13, 2020
Software Updates

Mar 24, 2020
Mini Newsletter

Dec 30, 2019
Software Updates

Jan 22, 2020
Software Updates

Jan 12, 2020
Newsletter

Jan 3, 2020
Event Results

Jan 2, 2020
Software Updates

Dec 30, 2019
Software Updates

April 27, 2019
Software Updates

Feb 26, 2019
Software Updates

Feb 23, 2019
Software Updates

Feb 14, 2019
Software Updates

Jan 6, 2019
Event Results

Dec 2, 2018
Software Updates

Nov 13, 2018
Software Releases

July 30, 2018
Software Updates

June 24, 2018
Software Updates

June 6, 2018
Software Updates

Apr 2, 2018
Fundraiser Celebration

Apr 2, 2018
Software Updates

Feb 24, 2018
Software Updates

Jan 14, 2018
Major Site News

Jan 10, 2018
Event Results

Latest Forum Posts
New Apps for the New Year 2009
New Apps for the New Year (NANY) is the motto of the Nany Challenge over at Donation Coder. It's already the second year of the challenge and lots of new software programs have been released during that challenge. To be precise: 35 new and free software programs have been released which more than doubled the count of last year. Each application can be downloaded right away from the Donation Coder website and works without registration or other inconveniences.. Comparer is a file comparison tool that can compare (among other things) all file properties. File Replicator is another interesting program. It can search for a certain file in a selected folder and replace that file with another one. Think of updating files that reside in multiple locations on the computer's hard drive.. I do not want to spoil the fun of exploring all those new programs.. It is definitely worth a visit; And who knows, maybe you find the program there that you have been searching for all of your life.

Read more…

gHacks.net Blog
gHacks.net Blog image

Our daily Blog

This page spotlights the most interesting posts collected from our forum every day.

You are viewing a specific blog item. Click here to return to the main blog page.

OpenSSL Vulnerability?

Screenshot - 5_16_2008 , 11_45_43 AM_thumb.png
This sounds awful..  Anyone with a better background in security want to jump in and tell us how big a deal this is in practice?

Almost two years ago in 2006 Debian decided to clean up their OpenSSL implementation. They found a few lines of code that were causing Valgrind and Purify to complain about access to uninitialized memory. Without a major investigation into the purpose of the suspect lines of code they were simply removed.
...
For the purposes of all the OpenSSL algorithms there was no deficiency. Encryption and decryption and hashes would be calculated correctly. The problem was that the PRNG used for generating keys by the OpenSSL library had been crippled when those critical lines were removed back in 2006. This was not discovered until just this week when Luciano Bello discovered that without those lines the only ‘random’ data used to seed the PRNG was the PID of the OpenSSL process. On many Linux systems the PID is limited to a positive signed 16 bit value. This means there are only 32,767 possibilities. When new keys and certificates were generated by OpenSSL they relied on this number to provide all of their entropy.

http://www.avertlabs...-cleanup-gone-wrong/

ps. I should say that I have come to loathe McAfee in terms of their shoddy and sloppy false positive behavior, but this security blog they have is consistently good.
posted by mouser donate to mouser
(permalink) (read 6 comments)


Share on Facebook
submit to reddit