Search Results: "kolter"

24 June 2021

Louis-Philippe V ronneau: Hardening Weechat Relays Against RCE on Bullseye

I've been using weechat to connect to IRC since late 2016 and one of its killer feature is relays. They let use other frontends like the Weechat Android app or the amazing Glowing Bear (packaged in Debian Bullseye by yours truly). Sadly, relays also used to be somewhat of a security risk: anyone with access to a relay1 could run scripts on the machine running weechat by using commands such as /exec or /script. Not great. Since version 2.5 (Buster had version 2.3), you can mitigate this risk by setting a command allowlist for relays. Later versions implemented a sane default by blocking the following commands: Sadly, this default didn't make in into Bullseye. If you are running weechat and are using the relays feature, after upgrading to Bullseye, I would recommend you run the following commands in the weechat TUI:
/set relay.weechat.commands *,!exec,!fset,!set,!unset,!plugin,!script,!python,!perl,!ruby,!lua,!tcl,!guile,!javascript,!php,!secure,!upgrade,!quit
/save

  1. For example, someone steals your phone and connects to IRC via the Weechat app...

7 September 2011

Emmanuel Bouthenot: Sympa in Squeeze Backports

For those interested in Sympa, version 6.1.4 has been uploaded to squeeze-backports. This version fixes around two dozen bugs since the version present in squeeze (6.0.1). I strongly recommend to use this version with squeeze as it fixes some very annoying bugs. How to install it: For squeeze users Be sure to have squeeze-backports repository enabled in your sources.list as explained on Debian Backports website then:
apt-get -t squeeze-backports install sympa
For lenny users For lenny users with a running sympa installation who plan to upgrade to squeeze and use sympa from squeeze-backports, it is recommended to upgrade directly from the version 5.3.4 (lenny's version) to 6.1.4. To do so, you just need to add some apt pinning in /etc/apt/preferences (see below) and then dist-ugprade normally.
Package: sympa
Pin: version 6.1.4*
Pin-Priority: 500
Sympa 6.1.6 is already out and should be uploaded in unstable soon, it should also be backported to squeeze-backports if all goes fine. Special thanks to Gerfried (rhonda) and Alexander (formorer) for their work on Debian Backports.

31 December 2009

Debian News: New Debian Developers (December 2009)

The following developers got their Debian accounts in the last month: Congratulations!

3 November 2006

Julien Danjou: DeFuBu contest #4

Bug Welcome to this 4th issue of the DeFuBu contest, the monthly championship of the funniest bug reported to the Debian BTS. The challengers How the vote has been done Four Debian related people voted for these bugs, Philipp Kern, Florent Bayle, Cyril Brulebois and Gregory Colpart.
Mohammed Adn ne Trojette should vote quicker next time. Full ranking Bugs Challengers The winners Notes To participate, simply drop me an email with a bug number. About DeFuBu

25 August 2006

Julien Danjou: DeFuBu contest #2

Bug Welcome to this 2nd issue of the DeFuBu contest, the monthly championship of the funniest bug reported to the Debian BTS. The challengers How the vote has been done Five Debian related people voted for these bugs: Roland Mas, Alexis Sukrieh, Cl ment Stenac, kolter and Yves-Alexis Perez. Full ranking Bugs Challengers The winners Notes To participate, simply drop me an email with a bug number. About DeFuBu