linuxdcpp-team team mailing list archive

[poy <991342@xxxxxxxxxxxxxxxxxx>]

thanks for clarifying the side points. on #e, i seem to remember cryptic
error messages because the connection never went far enough to reach
that message. is it possible to transfer it to a better place, along
with queue source removal? and i agree with the TODO; i think user
objects have a flag that can be used to check (without needing to find
the right hub etc).

the big chunk that remains is keyp validation, for which tests would be
very useful.

let's wait until the end of the week if anyone has objections then this
can go in.

-- 
You received this bug notification because you are a member of
Dcplusplus-team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/991342

Title:
  KEYP Vulnerability

Status in DC++:
  New

Bug description:
  With the current vulnerability with DC++'s current KEYP implementation
  the underlying issue seems to be this ...

  [2012-04-26 09:24] <Crise> anyways, the thing with keyp is entirely
  different problem... which is basically that it only verifies keyp on
  the peer level certificate and not on the whole chain as it should

  Crise has stated he has another source who knows the exploit but will
  not divulge in who he is.

To manage notifications about this bug go to:
https://bugs.launchpad.net/dcplusplus/+bug/991342/+subscriptions