Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4690 > unrolled thread

Re: [SECURITY] [DSA 3547-1] imagemagick security update

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-12 13:40 +0200
    Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-12 14:00 +0200
      Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-13 07:40 +0200
        Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-13 07:50 +0200
          Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-13 08:20 +0200
    Re: [SECURITY] [DSA 3547-1] imagemagick security update Luciano Bello <luciano@debian.org> - 2016-04-12 14:20 +0200
      Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-12 17:10 +0200
        Re: [SECURITY] [DSA 3547-1] imagemagick security update Drake Wilson <drake@dasyatidae.net> - 2016-04-12 17:40 +0200
        Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-12 17:40 +0200
          Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-12 19:10 +0200
            Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-12 19:40 +0200
              Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-12 21:20 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Michael Stone <mstone@debian.org> - 2016-04-12 21:40 +0200
                  Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 01:30 +0200
                    Re: [SECURITY] [DSA 3547-1] imagemagick security update Julien Cristau <jcristau@debian.org> - 2016-04-13 11:00 +0200
                      Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 14:50 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-12 21:50 +0200
                  Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 02:00 +0200
                    Re: [SECURITY] [DSA 3547-1] imagemagick security update Michael Stone <mstone@debian.org> - 2016-04-13 04:20 +0200
                      Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-13 07:40 +0200
                        Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 15:00 +0200
                          Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-14 11:10 +0200
            Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-12 19:40 +0200
            Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-13 08:10 +0200
              Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-13 09:00 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Alexander Neilson <alexander@neilson.net.nz> - 2016-04-13 12:30 +0200
                  Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-14 11:20 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 14:50 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Scott Blaydes <scott@nettek.io> - 2016-04-13 15:10 +0200
                  Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-14 11:20 +0200

Page 1 of 2  [1] 2  Next page →

#4690 — Re: [SECURITY] [DSA 3547-1] imagemagick security update

Hi again,

Imagemagick  version 8:6.7.7.10-5+deb7u4 is STILL NOT AVAILABLE at the 
http://security.debian.org/ server.

I'm very concerned about this.  Will the updated version be uploaded soon?

Yours sincerely,
Bjoern.


On 12/04/16 03:12, Luciano Bello wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> - -------------------------------------------------------------------------
> Debian Security Advisory DSA-3547-1                   security@debian.org
> https://www.debian.org/security/                            Luciano Bello
> April 11, 2016                        https://www.debian.org/security/faq
> - -------------------------------------------------------------------------
>
> Package        : imagemagick
> Debian Bug     : 811308
>
> Several vulnerabilities were discovered in Imagemagick, a program suite for
> image manipulation. This update fixes a large number of potential security
> problems such as null-pointer access and buffer-overflows that might lead
> to memory leaks or denial of service. Any of these security problems have
> a CVE number assigned.
>
> For the oldstable distribution (wheezy), this problem has been fixed
> in version 8:6.7.7.10-5+deb7u4.
>
> For the stable distribution (jessie), this problem was already fixed in
> version 8:6.8.9.9-5+deb8u1, in the last point release.
>
> We recommend that you upgrade your imagemagick packages.
>
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
>
> Mailing list: debian-security-announce@lists.debian.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBCAAGBQJXC/ZEAAoJEG7C3vaP/jd0yjAP/RJ3GHiMQDNYXsilOf/hBssm
> 6PRuYeH0XSjX37PsDzvOCt3A8POiOTJPOXPIU1Mmsqtd3B3VzXmwXIbfVW1dTSeT
> TrxlCfvFfdF16ckrzvcv136BIBAQTnQ8UG6z8o+8FSwVBvdjeo4Iim5gS6zepzhK
> xDokj924lCNbnwTiy2vQ0EgVW2EeZaa3ntRyldQ9ZC1Zo62hg6abNFBwdkB/giGx
> zqdMw9kXqvsiQiZqEVrMhfjAEpFZ3JceVMs80L2yBK5VuFVUirgPgBdH8ySZ8exW
> Fr1Yllu6G2nkzGKSiHGzRMd1lrzM3lV7LLrWq/jlQ7rI2ogEZ+4HHgQJLjpYJBuq
> KkTxWhIGsXjDOrQlZZ2xx4V8jn2naQCbYTXcB1LKvcktKsp9D2SFYUC6rWDA2k1J
> JD7tMTGq4JIQspP/bJ61mvtDp9v4z+9/Uwjt5S/eawdY/n9FT2Z71UlC226GxU8/
> IgbGw4wH3VCM3zsZsxyqINVFLT48AxbkW7bkxjJVpm7Ic2CcIwlewodkkdWMdSA2
> pj0lABOphaClhnNtHOQ2YwqYrPxOXjl5PeMoVIymKdx9h7eSWO6pLfGVuKljN2XK
> CeuR/5R0mubPrnrGB6AVEOjEYVRQ1YvGfEm1/ox7q51MZYdCT9+TTQEXOHGSoQGk
> aSM2D/rhnJ/VT0RkYlF4
> =a1rj
> -----END PGP SIGNATURE-----
>

[toc] | [next] | [standalone]

#4691

On 2016-04-12 12:21, Bjoern Nyjorden wrote:
> Hi again,
> 
> Imagemagick  version 8:6.7.7.10-5+deb7u4 is STILL NOT AVAILABLE at the
> http://security.debian.org/ server.
> 
> I'm very concerned about this.  Will the updated version be uploaded 
> soon?

What IP address does security.debian.org resolve to for you?

 From the UK, where security.debian.org is currently 212.211.132.32, it 
certainly is available:

adam@fhlostonparadise:~$ apt-cache policy imagemagick
imagemagick:
   Installed: (none)
   Candidate: 8:6.7.7.10-5+deb7u4
   Version table:
      8:6.7.7.10-5+deb7u4 0
         500 http://security.debian.org/ wheezy/updates/main amd64 
Packages
      8:6.7.7.10-5+deb7u3 0
         500 http://ftp.uk.debian.org/debian/ wheezy/main amd64 Packages

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#4706

Hi Adam,

The reason there has been a delay in my reply to your email below:

  * 1. Although my inbox has the time stamp of 19:50 +0800 (12:50 
+0100); the email below did not show up in my inbox until 23:40 +0800 
(16:40 +0100) - the time my ISP reports receiving the mail.  It 
certainly was not in my inbox when I sent my previous email complaining 
about the non-existent upload at this end of the world.

  * 2. I was sleeping at the time the email below arrived.  Western 
Australia is in the timezone; +0800.

I hope the above provides an explanation.

I will reply to your questions below in a reply to your last email to 
me, if I may.

Yours sincerely,
Bjoern.


On 12/04/16 19:50, Adam D. Barratt wrote:
> On 2016-04-12 12:21, Bjoern Nyjorden wrote:
>> Hi again,
>>
>> Imagemagick  version 8:6.7.7.10-5+deb7u4 is STILL NOT AVAILABLE at the
>> http://security.debian.org/ server.
>>
>> I'm very concerned about this.  Will the updated version be uploaded
>> soon?
>
> What IP address does security.debian.org resolve to for you?
>
>  From the UK, where security.debian.org is currently 212.211.132.32, it
> certainly is available:
>
> adam@fhlostonparadise:~$ apt-cache policy imagemagick
> imagemagick:
>    Installed: (none)
>    Candidate: 8:6.7.7.10-5+deb7u4
>    Version table:
>       8:6.7.7.10-5+deb7u4 0
>          500 http://security.debian.org/ wheezy/updates/main amd64 Packages
>       8:6.7.7.10-5+deb7u3 0
>          500 http://ftp.uk.debian.org/debian/ wheezy/main amd64 Packages
>
> Regards,
>
> Adam

[toc] | [prev] | [next] | [standalone]

#4708

On Wed, 2016-04-13 at 13:21 +0800, Bjoern Nyjorden wrote:
>   * 1. Although my inbox has the time stamp of 19:50 +0800 (12:50 
> +0100); the email below did not show up in my inbox until 23:40 +0800 
> (16:40 +0100) - the time my ISP reports receiving the mail.  It 
> certainly was not in my inbox when I sent my previous email complaining 
> about the non-existent upload at this end of the world.

Looking through my mail log, it appears that for some reason the server
was unable to resolve DNS for iinet.net.au for a while yesterday
afternoon (UTC); once it could, there was also a brief period where the
servers returned by DNS didn't respond to SMTP connections, at least
from my server.

I guess we've all got used to mail basically just working. :)

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#4710

Free as in "freedom" operating systems, and a free-ish and open internet 
are global, vital and empowering assets that I guess a lot of us tend to 
take for granted.

Keep up the good work.  I hope to be in a better position in the future, 
to have something worthwhile to contribute to the Debian, and FOSS 
community.

Kind regards all,
Bjoern.

On 13/04/16 13:42, Adam D. Barratt wrote:
> On Wed, 2016-04-13 at 13:21 +0800, Bjoern Nyjorden wrote:
>>    * 1. Although my inbox has the time stamp of 19:50 +0800 (12:50
>> +0100); the email below did not show up in my inbox until 23:40 +0800
>> (16:40 +0100) - the time my ISP reports receiving the mail.  It
>> certainly was not in my inbox when I sent my previous email complaining
>> about the non-existent upload at this end of the world.
>
> Looking through my mail log, it appears that for some reason the server
> was unable to resolve DNS for iinet.net.au for a while yesterday
> afternoon (UTC); once it could, there was also a brief period where the
> servers returned by DNS didn't respond to SMTP connections, at least
> from my server.
>
> I guess we've all got used to mail basically just working. :)
>
> Regards,
>
> Adam
>

[toc] | [prev] | [next] | [standalone]

#4692

On Tuesday 12 April 2016 19.21.57 Bjoern Nyjorden wrote:
> Imagemagick  version 8:6.7.7.10-5+deb7u4 is STILL NOT AVAILABLE at the 
> http://security.debian.org/ server.
> 
> I'm very concerned about this.  Will the updated version be uploaded soon?

It should be now. It appears in https://tracker.debian.org/pkg/imagemagick

Cheers, luciano

[toc] | [prev] | [next] | [standalone]

#4693

Hi Luciano and others,

AS AT: 2230(+0800) (1430(+0000)):

   * Imagemagick  version 8:6.7.7.10-5+deb7u4 is STILL NOT AVAILABLE at:

 
http://security.debian.org/debian-security/pool/updates/main/i/imagemagick/

   * Aptitude (or apt-get) is unable to update as a result

Can you please ensure that the packages are at the correct location!!!

Does it have to be this hard?

Kind regards,
Bjoern.

On 12/04/16 19:52, Luciano Bello wrote:
> On Tuesday 12 April 2016 19.21.57 Bjoern Nyjorden wrote:
>> Imagemagick  version 8:6.7.7.10-5+deb7u4 is STILL NOT AVAILABLE at the
>> http://security.debian.org/ server.
>>
>> I'm very concerned about this.  Will the updated version be uploaded soon?
>
> It should be now. It appears in https://tracker.debian.org/pkg/imagemagick
>
> Cheers, luciano
>

[toc] | [prev] | [next] | [standalone]

#4694

Bjoern Nyjorden wrote:
> Hi Luciano and others,
> 
> AS AT: 2230(+0800) (1430(+0000)):
> 
>   * Imagemagick  version 8:6.7.7.10-5+deb7u4 is STILL NOT AVAILABLE at:
> 
> 
> http://security.debian.org/debian-security/pool/updates/main/i/imagemagick/

They look good to me at the moment (2016-04-12T15:32:46Z), but I don't have a
log of when I first saw them appear.

Are you sure you don't have a strange transparent HTTP cache or something between
you and security.debian.org which might be ignoring the cache-control headers?
With what client software and from what network location are you accessing that
URL, and have you tried with a different client or from a different host?

   ---> Drake Wilson

[toc] | [prev] | [next] | [standalone]

#4695

On 2016-04-12 15:42, Bjoern Nyjorden wrote:
> Hi Luciano and others,
> 
> AS AT: 2230(+0800) (1430(+0000)):
> 
>   * Imagemagick  version 8:6.7.7.10-5+deb7u4 is STILL NOT AVAILABLE at:
> 
> 
> http://security.debian.org/debian-security/pool/updates/main/i/imagemagick/
> 
>   * Aptitude (or apt-get) is unable to update as a result

You could answer the question I asked a few hours ago...

> Can you please ensure that the packages are at the correct location!!!

They are, so far as I can tell.

> Does it have to be this hard?

It's difficult to work out what the issue is without your providing more 
information to try and debug.

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#4696

On 2016-04-12 16:35, Adam D. Barratt wrote:
> On 2016-04-12 15:42, Bjoern Nyjorden wrote:
>> Hi Luciano and others,
>> 
>> AS AT: 2230(+0800) (1430(+0000)):
>> 
>>   * Imagemagick  version 8:6.7.7.10-5+deb7u4 is STILL NOT AVAILABLE 
>> at:
>> 
>> 
>> http://security.debian.org/debian-security/pool/updates/main/i/imagemagick/
>> 
>>   * Aptitude (or apt-get) is unable to update as a result
> 
> You could answer the question I asked a few hours ago...

Judging from your e-mail address, I'm going to assume that the answer is 
that security.debian.org resolved to 150.203.164.61.

Apparently there was an issue with syncing to that mirror. The sysadmin 
team have triggered a manual sync, so things should be up-to-date now.

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#4697

On Tue, 12 Apr 2016, Henrique de Moraes Holschuh wrote:

> On Tue, Apr 12, 2016, at 14:06, Adam D. Barratt wrote:
> > Judging from your e-mail address, I'm going to assume that the answer is 
> > that security.debian.org resolved to 150.203.164.61.
> > 
> > Apparently there was an issue with syncing to that mirror. The sysadmin 
> > team have triggered a manual sync, so things should be up-to-date now.
> 
> Other (leaf ?) .au mirrors also seem to be stale:
> mirror.aarnet.edu.au, mirror.cse.unsw.edu.au
> 
> Either those mirrors are not refreshing at an acceptable rate for
> something that carries /debian-security, or we have a wider issue than a
> single .au mirror missing a push.
> 
> We don't have leaf (non-push) mirrors in the geo-ip list for
> security.debian.org, do we?

We don't support 3rd party security mirrors.  In fact, we actively
discourage them.  Don't use them.

-- 
                            |  .''`.       ** Debian **
      Peter Palfrader       | : :' :      The  universal
 https://www.palfrader.org/ | `. `'      Operating System
                            |   `-    https://www.debian.org/

[toc] | [prev] | [next] | [standalone]

#4699

On Tue, Apr 12, 2016, at 14:32, Peter Palfrader wrote:
> On Tue, 12 Apr 2016, Henrique de Moraes Holschuh wrote:
> > On Tue, Apr 12, 2016, at 14:06, Adam D. Barratt wrote:
> > > Judging from your e-mail address, I'm going to assume that the answer is 
> > > that security.debian.org resolved to 150.203.164.61.
> > > 
> > > Apparently there was an issue with syncing to that mirror. The sysadmin 
> > > team have triggered a manual sync, so things should be up-to-date now.
> > 
> > Other (leaf ?) .au mirrors also seem to be stale:
> > mirror.aarnet.edu.au, mirror.cse.unsw.edu.au
> > 
> > Either those mirrors are not refreshing at an acceptable rate for
> > something that carries /debian-security, or we have a wider issue than a
> > single .au mirror missing a push.
> > 
> > We don't have leaf (non-push) mirrors in the geo-ip list for
> > security.debian.org, do we?
> 
> We don't support 3rd party security mirrors.  In fact, we actively
> discourage them.  Don't use them.

We list several mirrors carrying debian security updates in
https://www.debian.org/mirror/list-full, but only some of them are
members of the security.debian.org pool, and not every member of the
security.debian.org mirror pool is present in that list either.  The
australian mirror that was stale doesn't appear to be, for example.

We don't disclose which mirrors are members of the security.debian.org
pool anywhere (that I could find), so we are currently hiding everything
behind security.debian.org. This wasn't a problem when a DNS lookup for
security.debian.org would return a RR-SET with several A and AAAA
records, but geo-ip changed that to return a single A record.  When
geo-ip points security.debian.org to a broken or stale mirror for
someone, it is a pain to work around it for the duration.

And if you need to access security.debian.org over IPv6, "too bad".

This clearly is suboptimal.  So, please excuse me if I don't agree that
we actively discourage 3rd party public security mirrors, IMHO we do it
half-heartedly.  And I don't think this is bad either, since it looks
like we don't do that well at providing alternate access to the security
archive either.

Alternate access URIs for several of the security.debian.org pool
members *do* exist, but that information seems not to be clearly
displayed anywhere.

A good starting point would be to provide a list of official security
mirrors (potential members of the security.debian.org pool) that can be
accessed directly when geo-ip is directing an user to a pool member that
is stale. This does mean such mirrors need to expose the security
archive outside of the security.debian.org named vhost, of course.
/debian-security seems to be the preferred pattern, and at least one
push-primary mirror that is a member of the security.debian.org pool
does it that way.

And if that list of official security mirrors that can be accessed
through alternate URIs does exist, I couldn't find it. IMHO that
information needs to be somewhere in
https://www.debian.org/mirror/official, along with whatever strong
recommendations we want to make about it.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique de Moraes Holschuh <hmh@debian.org>

[toc] | [prev] | [next] | [standalone]

#4700

On Tue, Apr 12, 2016 at 04:19:20PM -0300, Henrique de Moraes Holschuh wrote:
>We don't disclose which mirrors are members of the security.debian.org
>pool anywhere (that I could find), so we are currently hiding everything
>behind security.debian.org. This wasn't a problem when a DNS lookup for
>security.debian.org would return a RR-SET with several A and AAAA
>records, but geo-ip changed that to return a single A record.  When
>geo-ip points security.debian.org to a broken or stale mirror for
>someone, it is a pain to work around it for the duration.
>
>And if you need to access security.debian.org over IPv6, "too bad".

Huh?

Huh?

> host security.debian.org
security.debian.org has address 149.20.20.19
security.debian.org has address 128.61.240.73
security.debian.org has address 128.101.240.215
security.debian.org has address 128.31.0.63
security.debian.org has IPv6 address 2607:ea00:101:3c0b::1deb:215
security.debian.org has IPv6 address 2001:4f8:8:36::1deb:19
security.debian.org has IPv6 address 2610:148:1f10:3::73

Mike Stone

[toc] | [prev] | [next] | [standalone]

#4703

On Tue, Apr 12, 2016, at 16:37, Michael Stone wrote:
> On Tue, Apr 12, 2016 at 04:19:20PM -0300, Henrique de Moraes Holschuh
> wrote:
> >We don't disclose which mirrors are members of the security.debian.org
> >pool anywhere (that I could find), so we are currently hiding everything
> >behind security.debian.org. This wasn't a problem when a DNS lookup for
> >security.debian.org would return a RR-SET with several A and AAAA
> >records, but geo-ip changed that to return a single A record.  When
> >geo-ip points security.debian.org to a broken or stale mirror for
> >someone, it is a pain to work around it for the duration.
> >
> >And if you need to access security.debian.org over IPv6, "too bad".
> 
> Huh?
> 
> Huh?
> 
> > host security.debian.org
> security.debian.org has address 149.20.20.19
> security.debian.org has address 128.61.240.73
> security.debian.org has address 128.101.240.215
> security.debian.org has address 128.31.0.63
> security.debian.org has IPv6 address 2607:ea00:101:3c0b::1deb:215
> security.debian.org has IPv6 address 2001:4f8:8:36::1deb:19
> security.debian.org has IPv6 address 2610:148:1f10:3::73

Not here. All I get is a single A record.

But that explains a lot more about how full of surprises is that black
box than I ever expected. I wonder why I don't get at least one AAAA as
well, though.  The mirror it returns has it.

Still, I am happy to know our geoip supports IPv6 and will even give you
multiple records if you are somewhere it considers more
connectivity-blessed. Thanks for the good news :)

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique de Moraes Holschuh <hmh@debian.org>

[toc] | [prev] | [next] | [standalone]

#4712

On Tue, Apr 12, 2016 at 20:29:21 -0300, Henrique de Moraes Holschuh wrote:

> On Tue, Apr 12, 2016, at 16:37, Michael Stone wrote:
> > On Tue, Apr 12, 2016 at 04:19:20PM -0300, Henrique de Moraes Holschuh
> > wrote:
> > >And if you need to access security.debian.org over IPv6, "too bad".
> > 
> > Huh?
> > 
> > Huh?
> > 
> > > host security.debian.org
> > security.debian.org has address 149.20.20.19
> > security.debian.org has address 128.61.240.73
> > security.debian.org has address 128.101.240.215
> > security.debian.org has address 128.31.0.63
> > security.debian.org has IPv6 address 2607:ea00:101:3c0b::1deb:215
> > security.debian.org has IPv6 address 2001:4f8:8:36::1deb:19
> > security.debian.org has IPv6 address 2610:148:1f10:3::73
> 
> Not here. All I get is a single A record.
> 
> But that explains a lot more about how full of surprises is that black
> box than I ever expected. I wonder why I don't get at least one AAAA as
> well, though.  The mirror it returns has it.
> 
I'm guessing "here" means the South America zone?  I've added
santoro.d.o's ipv6 address to the security.debian.org rotation now, let
us know if it works out.

Cheers,
Julien

[toc] | [prev] | [next] | [standalone]

#4714

On Wed, Apr 13, 2016, at 05:50, Julien Cristau wrote:
> On Tue, Apr 12, 2016 at 20:29:21 -0300, Henrique de Moraes Holschuh
> wrote:
> > On Tue, Apr 12, 2016, at 16:37, Michael Stone wrote:
> > > On Tue, Apr 12, 2016 at 04:19:20PM -0300, Henrique de Moraes Holschuh
> > > wrote:
> > > >And if you need to access security.debian.org over IPv6, "too bad".
> > > 
> > > Huh?
> > > 
> > > Huh?
> > > 
> > > > host security.debian.org
> > > security.debian.org has address 149.20.20.19
> > > security.debian.org has address 128.61.240.73
> > > security.debian.org has address 128.101.240.215
> > > security.debian.org has address 128.31.0.63
> > > security.debian.org has IPv6 address 2607:ea00:101:3c0b::1deb:215
> > > security.debian.org has IPv6 address 2001:4f8:8:36::1deb:19
> > > security.debian.org has IPv6 address 2610:148:1f10:3::73
> > 
> > Not here. All I get is a single A record.
> > 
> > But that explains a lot more about how full of surprises is that black
> > box than I ever expected. I wonder why I don't get at least one AAAA as
> > well, though.  The mirror it returns has it.
> > 
> I'm guessing "here" means the South America zone?  I've added
> santoro.d.o's ipv6 address to the security.debian.org rotation now, let
> us know if it works out.

Yep, it worked.  Thank you!

host security.debian.org
security.debian.org has address 200.17.202.197
security.debian.org has IPv6 address
2801:82:80ff:8009:e61f:13ff:fe63:8e88

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique de Moraes Holschuh <hmh@debian.org>

[toc] | [prev] | [next] | [standalone]

#4701

On Tue, 12 Apr 2016, Henrique de Moraes Holschuh wrote:

> We list several mirrors carrying debian security updates in
> https://www.debian.org/mirror/list-full

I think we shouldn't.

> We don't disclose which mirrors are members of the security.debian.org

https://anonscm.debian.org/cgit/mirror/dsa-auto-dns.git/tree/zones/security.debian.org.zone

is the file that the security.d.o zone is generated from.

> Alternate access URIs for several of the security.debian.org pool
> members *do* exist, but that information seems not to be clearly
> displayed anywhere.

They do?  Anything we actually tell people to use?

> A good starting point would be to provide a list of official security
> mirrors (potential members of the security.debian.org pool) that can be
> accessed directly when geo-ip is directing an user to a pool member that
> is stale.

No.  We derotate mirrors regularly for maintenance work.  We don't want
users to pick their security.d.o mirror.

-- 
                            |  .''`.       ** Debian **
      Peter Palfrader       | : :' :      The  universal
 https://www.palfrader.org/ | `. `'      Operating System
                            |   `-    https://www.debian.org/

[toc] | [prev] | [next] | [standalone]

#4704

On Tue, Apr 12, 2016, at 16:47, Peter Palfrader wrote:
> On Tue, 12 Apr 2016, Henrique de Moraes Holschuh wrote:
> 
> > We list several mirrors carrying debian security updates in
> > https://www.debian.org/mirror/list-full
> 
> I think we shouldn't.

Well, we do, regardless of whether we should or shouldn't.

And, unless we add an alternate-security.d.o or do something else to
offer a backup access for those that get a single choice out of geoip,
it is probably best to not hide that information IMO.

> > We don't disclose which mirrors are members of the security.debian.org
> 
> https://anonscm.debian.org/cgit/mirror/dsa-auto-dns.git/tree/zones/security.debian.org.zone
> 
> is the file that the security.d.o zone is generated from.

Thanks. That helps.

> > Alternate access URIs for several of the security.debian.org pool
> > members *do* exist, but that information seems not to be clearly
> > displayed anywhere.
> 
> They do?  Anything we actually tell people to use?

Yes, they do. And no, we don't tell people to use them.

It is not any sort of a secret, but since you guys don't want people who
doesn't know better pointing apt to them, I am not naming them here.

> > A good starting point would be to provide a list of official security
> > mirrors (potential members of the security.debian.org pool) that can be
> > accessed directly when geo-ip is directing an user to a pool member that
> > is stale.
> 
> No.  We derotate mirrors regularly for maintenance work.  We don't want
> users to pick their security.d.o mirror.

Then, maybe we should consider a better way to deal with areas where you
get only one choice out of geoip?

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique de Moraes Holschuh <hmh@debian.org>

[toc] | [prev] | [next] | [standalone]

#4705

On Tue, Apr 12, 2016 at 08:56:35PM -0300, Henrique de Moraes Holschuh wrote:
>Then, maybe we should consider a better way to deal with areas where you
>get only one choice out of geoip?

Reach out to the relevant team outlining your issues (e.g., lack of IPv6 
connectivity)? Advising people to hard code security mirrors isn't the 
right solution.

Mike Stone

[toc] | [prev] | [next] | [standalone]

#4707

On Tue, 12 Apr 2016, Michael Stone wrote:

> On Tue, Apr 12, 2016 at 08:56:35PM -0300, Henrique de Moraes Holschuh wrote:
> >Then, maybe we should consider a better way to deal with areas where you
> >get only one choice out of geoip?
> 
> Reach out to the relevant team outlining your issues (e.g., lack of IPv6
> connectivity)? Advising people to hard code security mirrors isn't the right
> solution.

There's also nothing inherently wrong with just having a single address
in an RRSet.

-- 
                            |  .''`.       ** Debian **
      Peter Palfrader       | : :' :      The  universal
 https://www.palfrader.org/ | `. `'      Operating System
                            |   `-    https://www.debian.org/

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.security

csiph-web