Saturday, September 30, 2006

NYCBSDCon 2006

NYCBSDConThe New York City *BSD User Group is hosting the 2006 NYCBSDCon at Columbia University this year. And I'm going. This'll be my first BSD conference.

I'm looking forward to this year's speakers, many of them I see on the misc@ list:
  • Bob Beck
  • Jason Dixon
  • Todd Miller
  • Marco Peereboom
  • Jason Wright

Hope to see you there.

Sunday, September 10, 2006

The Book of Fate Party

Brad MeltzerOn Thursday, September 7, Warner Books/Hachette Books held a book signing party at the Headquarters of the Scottish Rite of Freemasonry in DC. This was an invitation only party during which Brad announced that if you're not part of his family or the publishing company, you're a friend -- you've been "part of the family" since the first book (Tenth Justice). And Holly and I have been.

I've read every single one of Brad's books and one of his comic books (Identity Crisis). He's an excellent writer and his books are real "page turners". I don't ever remember any slow spots but there are always points in each of his books where it's like that big, final hill on a rollercoaster: from that point, the pace picks up and you can't put it down.

After buying his new book, The Book of Fate (which I haven't started yet), Holly and I got in line to have him sign the book.

OpenBSD 3.9 Errata 011

OpenBSDThe OpenBSD team has released another patch for OpenBSD 3.9:

Due to incorrect PKCS#1 v1.5 padding validation in OpenSSL, it is possible for an attacker to construct an invalid signature which OpenSSL would accept as a valid PKCS#1 v1.5 signature. CVE-2006-4339

As always, I've created a binpatch.

Friday, September 8, 2006

OpenBSD 3.9 Errata 010

OpenBSDThe OpenBSD team has released another patch for OpenBSD 3.9:

Two Denial of Service issues have been found with BIND. An attacker who can perform recursive lookups on a DNS server and is able to send a sufficiently large number of recursive queries, or is able to get the DNS server to return more than one SIG(covered) RRsets can stop the functionality of the DNS service. An attacker querying an authoritative DNS server serving a RFC 2535 DNSSEC zone may be able to crash the DNS server. CVE-2006-4095, CVE-2006-4096

As always, I've created a binpatch.

Sunday, September 3, 2006


I remember watching a special on ESPN several years ago (or so) about Vince Papale - the native Philadelphian bar tender that tried out for the Eagles and made the team. I remember at the time thinking that it was a very inspirational story and pretty amazing that some "Joe" who didn't even play football in college would make an NFL team.

Earlier this year, I was in a movie theater and saw a trailer for Invincible, Disney's portrayal of Vince's story. Mark Wahlberg plays Vince and Greg Kinnear plays coach Dick Vermeil. This movie was fantastic!

OpenBSD Errata 009

OpenBSDThe OpenBSD team has released another kernel update for OpenBSD 3.9:

Due to the failure to correctly validate LCP configuration option lengths, it is possible for an attacker to send LCP packets via an sppp(4) connection causing the kernel to panic. CVE-2006-4304

As always, I've created a binpatch for the GENERIC kernel as well as GENERIC.MP, GENERIC + RAID and GENERIC.MP + RAID.