Re: Scripts that run insecurely-downloaded code

Path	csiph.com!aioe.org!bofh.it!news.nic.it!robomod
From	estellnb@elstel.org
Newsgroups	linux.debian.security
Subject	Re: Scripts that run insecurely-downloaded code
Date	Sat, 02 May 2020 19:30:01 +0200
Message-ID	<A247D-41o-3@gated-at.bofh.it> (permalink)
References	<A1Jmy-7Xm-25@gated-at.bofh.it> <A1JFT-84L-7@gated-at.bofh.it> <A1KiC-58-1@gated-at.bofh.it> <A1Vxo-7og-9@gated-at.bofh.it> <A22Se-3lI-7@gated-at.bofh.it> <A23EB-3Bw-3@gated-at.bofh.it>
X-Mailbox-Line	From debian-security-request@lists.debian.org Sat May 2 17:21:54 2020
Old-Return-Path	<estellnb@elstel.org>
X-Amavis-Spam-Status	No, score=-7.899 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, LDO_WHITELIST=-5, RCVD_IN_DNSWL_LOW=-0.7, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
X-Policyd-Weight	using cached result; rate: -5.5
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=elstel.org; s=dotplex-mailout-200425; t=1588440100; bh=Vf3DvA0v2Nn8f3s5Ik3Hy48LMmw+WwULp49hth3y6wA=; h=Date:From:To:Subject:In-Reply-To:References:From; b=L0XXoV7R0g6ITxJnpLg0pKbQiY4jFX4d1y+qxmckBhmzCVjEE3FocO8fbhkZFnOiD zNNs+Hn/Qv4guNVenIciLzOu2HIxDXDPLUkQ+nCFF2YrQBaG1n7+OnsdOCh1SAgPgC 5w0+sknTELpEp6JQQRUz9AOpEuMqB/zYgpkn2BIsq1VxpYoslof25I6KREZ/y/nj6g Ndsm4AX8SEUX7IXzdkXU8/IOE0SCOZF9sfx9IzO+z/nqMrTS65S1LZodxeWni/VdWO 8z/xkZ4rUISKv6I5HnJ2eXibrCIG4jafVxqtR3UlYcdqfpPqooPtfxnsjbJeSrwXCZ 3PQIdSMYA1Eig==
MIME-Version	1.0
X-Sender	estellnb@elstel.org
User-Agent	dotplex Webmail
Content-Type	text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding	7bit
X-Mailing-List	<debian-security@lists.debian.org> archive/latest/28954
List-ID	<debian-security.lists.debian.org>
List-URL	<https://lists.debian.org/debian-security/>
List-Archive	https://lists.debian.org/msgid-search/fdaf4510f40939879adb2131691b967e@elstel.org
Approved	robomod@news.nic.it
Lines	10
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Sat, 02 May 2020 19:21:40 +0200
X-Original-Message-ID	<fdaf4510f40939879adb2131691b967e@elstel.org>
X-Original-References	<a5aded84-6cff-8ceb-6b6b-6dd88b66c4dc@zoho.com> <3fc09223-2566-fb68-00ab-65c277d8e86c@elstel.org> <369e1054-8c41-7d96-b7f8-44fcd987b6a5@zoho.com> <7a9e5815-2491-b77d-001f-c5514f17cd4c@gmail.com> <5f9ca12a474dc3c6fff945d6af2eb377@elstel.org> <ed512d4899610029aa7c8004c66b220b6c5ba5e0.camel@thefnords.org>
Xref	csiph.com linux.debian.security:5825

Show key headers only | View raw

> I've seen this before with Firefox.  Basically Firefox has disabled
> weaker certificates from
> working, where Chrome and IE still accept ones with 128bit encryption,
> they do show an error (at
> least in Chrome) if you dig into the SSL debug screen.  Firefox just
> refuses to view it.

   Ah, I have read somewhere on the internet that AES-256 would be less 
secure than AES-128 because the AES algorithm has been designed for 
128bit.

Thread

Scripts that run insecurely-downloaded code "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2020-05-01 21:20 +0200
  Re: Scripts that run insecurely-downloaded code Elmar Stellnberger <estellnb@elstel.org> - 2020-05-01 21:40 +0200
    Re: Scripts that run insecurely-downloaded code "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2020-05-01 22:20 +0200
      Re: Scripts that run insecurely-downloaded code Paul Wise <pabs@debian.org> - 2020-05-02 03:00 +0200
        Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 18:10 +0200
      Re: Scripts that run insecurely-downloaded code Davide Prina <davide.prina@gmail.com> - 2020-05-02 10:20 +0200
        Re: Scripts that run insecurely-downloaded code "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2020-05-02 11:10 +0200
        Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 18:30 +0200
          Re: Scripts that run insecurely-downloaded code Jason Fergus <leech@thefnords.org> - 2020-05-02 19:00 +0200
            Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 19:30 +0200
        Re: Scripts that run insecurely-downloaded code Celejar <celejar@gmail.com> - 2020-05-03 16:40 +0200
    Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 18:20 +0200
  Re: Scripts that run insecurely-downloaded code Paul Wise <pabs@debian.org> - 2020-05-02 03:20 +0200

csiph-web