- WLUG - wlug.mailman3.com

Sr Software Engineer - C++, Linux contract opening in MA

by John Spencer

Connected Systems has a client in the Lowell, MA area with a long-term contract opening (9+ months) for a Sr Software Engineer with strong C++ and Linux application design and development experience. Must be a US Citizen or US Perm resident Work is to be performed at the client site. Design and develop software applications that will control embedded products Work with other engineering groups to successfully design, develop, test and release products to customers Must have 7+ years of successful C++ software design and development experience building embedded products/devices/machines. Must have strong OOD and multi-threaded development experience. Must have experience writing software that interfaces with products with moving parts. Any experience designing and developing mobile/hand held applications is a plus Please call or email me with your resume and any questions. Regards, John Spencer Connected Systems Partners Office: (978) 455-5550 x208 Cell: (978) 621-9743 jspencer(a)connectedsp.com<mailto:jspencer@connectedsp.com> www.connectedsp.com<http://www.connectedsp.com/> GET CONNECTED! All information in this email, unless indicated otherwise in the body of the email, is considered confidential and intended for the view and use of the recipient(s) only.

Jan. 19, 2018

Reminder: WLUG Meeting Tomorrow Jan 18th, 2018 Topic: Spectre and Meltdown!

by Tim Keller

We've got a meeting this week! Short Topic: Spectre and Meltdown. What it is, what it does, etc. I figure this is pretty topical as many of us are starting to wrap our heads around the performance implications as well as the tackling the task of patching many systems. Location: Campus Center, Mid Century Rm 331 Time: 7pm Snacks and Refreshments will be provided. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Jan. 18, 2018

Meeting This Week! Jan 18th 2018!

by Tim Keller

We've got a meeting this week! Short Topic: Spectre and Meltdown. What it is, what it does, etc. I figure this is pretty topical as many of us are starting to wrap our heads around the performance implications as well as the tackling the task of patching many systems. Location: Campus Center, Mid Century Rm 331 Time: 7pm Snacks and Refreshments will be provided. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Jan. 16, 2018

Re: [Wlug] Spectre and Meltdown.

by thinkbrown＠gmail.com

The xkcd comic is basically how I explain it to my parents :P Not the most useful from a technical standpoint though. Logan On Wed, Jan 10, 2018 at 10:18 AM, Higgins, Benjamin J <bjhiggins(a)wpi.edu> wrote: > Really – I found XKCD really nailed it > > https://xkcd.com/1938/ > > > > > > *From:* wlug-bounces(a)mail.wlug.org [mailto:wlug-bounces@mail.wlug.org] *On > Behalf Of %2Athinkbrown(a)gmail.com > *Sent:* Wednesday, January 10, 2018 10:14 AM > *To:* Worcester Linux Users Group <wlug(a)mail.wlug.org> > *Subject:* Re: [Wlug] Spectre and Meltdown. > > > > I found the Raspberry Pi Foundation's explanation the most useful: > https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable- > to-spectre-or-meltdown/ > > > > I found some of the non-computer based metaphors a little lacking - they > didn't really fit my mental model of the computer. > > The Raspberry Pi article explains it in a way that people familiar with > basic Python (or almost any procedural language) will be familiar with. > > > > Logan > > > > On Tue, Jan 9, 2018 at 2:13 PM, Sweetser, Frank E <fs(a)wpi.edu> wrote: > > This one is my own personal favorite out of what I've seen so far: > > > > https://ds9a.nl/articles/posts/spectre-meltdown/ > > > > Frank Sweetser > Director of Network Operations > Worcester Polytechnic Institute > "For every problem, there is a solution that is simple, elegant, and > wrong." - HL Mencken > > > ------------------------------ > > *From:* wlug-bounces(a)mail.wlug.org <wlug-bounces(a)mail.wlug.org> on behalf > of Tim Keller <turbofx(a)gmail.com> > *Sent:* Tuesday, January 9, 2018 12:27 PM > *To:* Worcester Linux Users Group > *Subject:* [Wlug] Spectre and Meltdown. > > > > There seems to be a HUGE amount of woo regarding spectre and meltdown. > This *seems* to me to be the most concise explanation I've heard so far. > > > > https://arstechnica.com/gadgets/2018/01/meltdown-and- > spectre-heres-what-intel-apple-microsoft-others-are-doing-about-it/ > > > > Feel free to argue that it's not. > > > > Thanks, > > Tim. > > > > -- > > I am leery of the allegiances of any politician who refers to their > constituents as "consumers". > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Jan. 10, 2018

Re: [Wlug] Spectre and Meltdown.

by Higgins, Benjamin J

Really – I found XKCD really nailed it https://xkcd.com/1938/ From: wlug-bounces(a)mail.wlug.org [mailto:wlug-bounces@mail.wlug.org] On Behalf Of thinkbrown(a)gmail.com Sent: Wednesday, January 10, 2018 10:14 AM To: Worcester Linux Users Group <wlug(a)mail.wlug.org> Subject: Re: [Wlug] Spectre and Meltdown. I found the Raspberry Pi Foundation's explanation the most useful: https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectr… I found some of the non-computer based metaphors a little lacking - they didn't really fit my mental model of the computer. The Raspberry Pi article explains it in a way that people familiar with basic Python (or almost any procedural language) will be familiar with. Logan On Tue, Jan 9, 2018 at 2:13 PM, Sweetser, Frank E <fs(a)wpi.edu<mailto:fs@wpi.edu>> wrote: This one is my own personal favorite out of what I've seen so far: https://ds9a.nl/articles/posts/spectre-meltdown/ Frank Sweetser Director of Network Operations Worcester Polytechnic Institute "For every problem, there is a solution that is simple, elegant, and wrong." - HL Mencken ________________________________ From: wlug-bounces(a)mail.wlug.org<mailto:wlug-bounces@mail.wlug.org> <wlug-bounces(a)mail.wlug.org<mailto:wlug-bounces@mail.wlug.org>> on behalf of Tim Keller <turbofx(a)gmail.com<mailto:turbofx@gmail.com>> Sent: Tuesday, January 9, 2018 12:27 PM To: Worcester Linux Users Group Subject: [Wlug] Spectre and Meltdown. There seems to be a HUGE amount of woo regarding spectre and meltdown. This *seems* to me to be the most concise explanation I've heard so far. https://arstechnica.com/gadgets/2018/01/meltdown-and-spectre-heres-what-int… Feel free to argue that it's not. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers". _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org<mailto:Wlug@mail.wlug.org> http://mail.wlug.org/mailman/listinfo/wlug

Jan. 10, 2018

Re: [Wlug] Spectre and Meltdown.

by thinkbrown＠gmail.com

I found the Raspberry Pi Foundation's explanation the most useful: https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectr… I found some of the non-computer based metaphors a little lacking - they didn't really fit my mental model of the computer. The Raspberry Pi article explains it in a way that people familiar with basic Python (or almost any procedural language) will be familiar with. Logan On Tue, Jan 9, 2018 at 2:13 PM, Sweetser, Frank E <fs(a)wpi.edu> wrote: > This one is my own personal favorite out of what I've seen so far: > > > https://ds9a.nl/articles/posts/spectre-meltdown/ > > > Frank Sweetser > Director of Network Operations > Worcester Polytechnic Institute > "For every problem, there is a solution that is simple, elegant, and > wrong." - HL Mencken > > > ------------------------------ > *From:* wlug-bounces(a)mail.wlug.org <wlug-bounces(a)mail.wlug.org> on behalf > of Tim Keller <turbofx(a)gmail.com> > *Sent:* Tuesday, January 9, 2018 12:27 PM > *To:* Worcester Linux Users Group > *Subject:* [Wlug] Spectre and Meltdown. > > There seems to be a HUGE amount of woo regarding spectre and meltdown. > This *seems* to me to be the most concise explanation I've heard so far. > > https://arstechnica.com/gadgets/2018/01/meltdown-and- > spectre-heres-what-intel-apple-microsoft-others-are-doing-about-it/ > > Feel free to argue that it's not. > > Thanks, > Tim. > > -- > I am leery of the allegiances of any politician who refers to their > constituents as "consumers". > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Jan. 10, 2018

Re: [Wlug] Spectre and Meltdown.

by Sweetser, Frank E

This one is my own personal favorite out of what I've seen so far: https://ds9a.nl/articles/posts/spectre-meltdown/ Frank Sweetser Director of Network Operations Worcester Polytechnic Institute "For every problem, there is a solution that is simple, elegant, and wrong." - HL Mencken ________________________________ From: wlug-bounces(a)mail.wlug.org <wlug-bounces(a)mail.wlug.org> on behalf of Tim Keller <turbofx(a)gmail.com> Sent: Tuesday, January 9, 2018 12:27 PM To: Worcester Linux Users Group Subject: [Wlug] Spectre and Meltdown. There seems to be a HUGE amount of woo regarding spectre and meltdown. This *seems* to me to be the most concise explanation I've heard so far. https://arstechnica.com/gadgets/2018/01/meltdown-and-spectre-heres-what-int… Feel free to argue that it's not. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Jan. 9, 2018

Spectre and Meltdown.

by Tim Keller

There seems to be a HUGE amount of woo regarding spectre and meltdown. This *seems* to me to be the most concise explanation I've heard so far. https://arstechnica.com/gadgets/2018/01/meltdown-and-spectre-heres-what-int… Feel free to argue that it's not. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Jan. 9, 2018

Meeting Moved to Next Thursday (1 / 18 / 2018)

by Tim Keller

Hey Gang, We *normally* would have a meeting this week, but I've decided to move it to next Thursday in light of everybody having a busy holiday and getting back into the swing of things. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Jan. 8, 2018

Fusion power.

by Tim Keller

Last night we got on a tangent and got talking about Fusion power. I mentioned Isaac Arthur's awesome channel. Here's his youtube about Fusion: https://www.youtube.com/watch?v=8Pmgr6FtYcY Later, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Dec. 15, 2017

Reminder! WLUG Meeting tonight!!!

by Tim Keller

Hey Gang, We've got a WLUG meeting tonight! Time: 7pm Location: WPI Student Center Rm 128 (Taylor Rm) Topic: I can talk about NGINX for a couple of minutes of people are interested. Then I thought I'd open up the floor for a general conversation and we can talk about what we'd like to do for topics and speakers for next year. As usual I'll have snacks and refreshments and we'll head down to Tech or the Boyton for dinner and to continue the conversation. Later, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Dec. 14, 2017

Re: [Wlug] Reminder! WLUG Meeting Dec 14th 2017! NOTE! Different Change!!!

by Tim Keller

Yup! Note, the room change for this meeting! On Tuesday, December 12, 2017, Richard Klein <rich(a)richardklein.org> wrote: > I haven't been in a while. We start at 7, right? > On Tue, Dec 12, 2017 at 5:46 PM, Tim Keller <turbofx(a)gmail.com> wrote: >> >> Hey Gang, >> Just a reminder we've got a meeting on the 14th! >> Topic: I think this will be an open topic meeting, though if there's something people want to talk about I'm game. We could talk about what we want to do with WLUG next year! >> Location: Taylor Room Campus Center Rm 128 >> Snacks and refreshments will be provided. Afterwards we'll head down to Tech Pizza or the Boyton. >> Later, >> Tim. >> >> -- >> I am leery of the allegiances of any politician who refers to their constituents as "consumers". >> _______________________________________________ >> Wlug mailing list >> Wlug(a)mail.wlug.org >> http://mail.wlug.org/mailman/listinfo/wlug >> > > -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Dec. 13, 2017

Re: [Wlug] Reminder! WLUG Meeting Dec 14th 2017! NOTE! Different Change!!!

by Richard Klein

I haven't been in a while. We start at 7, right? On Tue, Dec 12, 2017 at 5:46 PM, Tim Keller <turbofx(a)gmail.com> wrote: > Hey Gang, > > Just a reminder we've got a meeting on the 14th! > > Topic: I think this will be an open topic meeting, though if there's > something people want to talk about I'm game. We could talk about what we > want to do with WLUG next year! > > Location: Taylor Room Campus Center Rm 128 > > Snacks and refreshments will be provided. Afterwards we'll head down to > Tech Pizza or the Boyton. > > Later, > Tim. > > -- > I am leery of the allegiances of any politician who refers to their > constituents as "consumers". > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Dec. 12, 2017

Reminder! WLUG Meeting Dec 14th 2017! NOTE! Different Change!!!

by Tim Keller

Hey Gang, Just a reminder we've got a meeting on the 14th! Topic: I think this will be an open topic meeting, though if there's something people want to talk about I'm game. We could talk about what we want to do with WLUG next year! Location: Taylor Room Campus Center Rm 128 Snacks and refreshments will be provided. Afterwards we'll head down to Tech Pizza or the Boyton. Later, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Dec. 12, 2017

Next WLUG meeting Dec. 14th 2017 Topic: TBD

by Tim Keller

Hey Gang, What would people like to talk about this month? I'd love some ideas. Now that we've all been priced out of bitcoin, a conversation about mining rigs for other cryto currencies might be interesting. I recently setup a nginx SSL gateway so I could talk about that. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Dec. 1, 2017

Re: [Wlug] HOWTO create ISO that is both BIOS and UEFI bootable

by John Platt

This information might help: http://www.syslinux.org/wiki/index.php?title=Isohybrid On Fri, Nov 10, 2017 at 8:28 PM, Andy Stewart <kb1oiq(a)mval.net> wrote: > > Hi everybody, > > I've noticed that the Ubuntu 16.04 ISO is bootable on systems with BIOS > as well as UEFI. From scratch, I've remastered Ubuntu, but my ISO file > is only bootable via BIOS. I'd like to remedy that situation by > figuring out what magic is needed so that my ISO file can be booted > either way. > > I have a chroot directory in which my files live. I have scripts that > convert all of that into an ISO file. My guess is that I need a > new/modified incantation of mkisofs plus some additional files for UEFI. > > Despite a lot of searching, I've not yet found the info that I need. > > If you have definitive information, please let me know. > > Thanks! > > Andy > > -- > Andy Stewart (KB1OIQ) > Founder: Worcester Linux Users' Group > Founder: Chelmsford Linux Meetup Group > President: PART of Westford, MA (WB1GOF) > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Nov. 11, 2017

HOWTO create ISO that is both BIOS and UEFI bootable

by Andy Stewart

Hi everybody, I've noticed that the Ubuntu 16.04 ISO is bootable on systems with BIOS as well as UEFI. From scratch, I've remastered Ubuntu, but my ISO file is only bootable via BIOS. I'd like to remedy that situation by figuring out what magic is needed so that my ISO file can be booted either way. I have a chroot directory in which my files live. I have scripts that convert all of that into an ISO file. My guess is that I need a new/modified incantation of mkisofs plus some additional files for UEFI. Despite a lot of searching, I've not yet found the info that I need. If you have definitive information, please let me know. Thanks! Andy -- Andy Stewart (KB1OIQ) Founder: Worcester Linux Users' Group Founder: Chelmsford Linux Meetup Group President: PART of Westford, MA (WB1GOF)

Nov. 11, 2017

Linux Admin/kernel contract opening in MA

by John Spencer

We have a client in the Lowell, MA area with a 6-12 month contract opening for a Linux Admin/Linux kernel engineer. My client needs someone who has experience with Linux admin, building Linux kernel and modules. Must be able to configure the kernel and manage Linux build environment Must have experience setting up repository mirrors Must have set up regression test environments Please call or email me with if you are interested or have any questions. Regards, John Spencer Connected Systems Partners Office: (978) 455-5550 x208 Cell: (978) 621-9743 jspencer(a)connectedsp.com www.connectedsp.com GET CONNECTED! All information in this email, unless indicated otherwise in the body of the email, is considered confidential and intended for the view and use of the recipient(s) only.

Nov. 9, 2017

Re: [Wlug] Reminder: Meeting Nov. 9th 2017: Location: WPI Student Center Rm 331

by Robert Schwein

Stuck in Ohio. Darn. I would have liked to have heard about that 3D printer/software. Bob On Wed, Nov 8, 2017 at 9:34 PM, Tim Keller <turbofx(a)gmail.com> wrote: > Hey Gang, > > We've got a meeting, tomorrow night. > > Location: WPI Mid Century Rm 331. > Time: 7pm > Subject: 3d Printing FOSS software. > > I'll be doing a quick talk about software that I've been using to > interface with my 3d printer. > I *might* bring the printer... I'm currently having some electrical issues > with it... but in either case I can give a quick demo of FreeCAD and Cura. > > As usual, there will be snacks and refreshments and then we'll head down > to Tech for pizza. > > Thanks, > Tim. > > -- > I am leery of the allegiances of any politician who refers to their > constituents as "consumers". > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Nov. 9, 2017

Reminder: Meeting Nov. 9th 2017: Location: WPI Student Center Rm 331

by Tim Keller

Hey Gang, We've got a meeting, tomorrow night. Location: WPI Mid Century Rm 331. Time: 7pm Subject: 3d Printing FOSS software. I'll be doing a quick talk about software that I've been using to interface with my 3d printer. I *might* bring the printer... I'm currently having some electrical issues with it... but in either case I can give a quick demo of FreeCAD and Cura. As usual, there will be snacks and refreshments and then we'll head down to Tech for pizza. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Nov. 9, 2017

WLUG meeting Nov. 9th 2017! Location: WPI Mid Century Room 331

by Tim Keller

Hey Gang, Sorry for the short notice! We've got a meeting on Thursday! Topic: We'll, I'm in the midst of building a 3d printer! I *might* have it done for Thursday! I've done a lot of talking lately, but if people are interested, I've managed "figure" out freecad for the most part. Is this something people are interested in or does someone else have something they'd like to talk about. Location: WPI Mid-Century Room 331 As usual snacks and refreshments will be provided. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Nov. 6, 2017

Re: [Wlug] Major WPA2 Vulnerability

by Chuck Anderson

On Wed, Oct 18, 2017 at 02:29:56PM -0400, Keith Wright wrote: > This is very embarrassing for the authors of the > standard, but is it really a big problem? Several > meetings ago, somebody brought a device to the > WLUG meeting that, as I understood it, pretends > to be a wireless router and interposes itself > into any nearby connection. If things like that > exist, why care about encryption vulnerability? Because with properly configured wireless and patched clients, you can be sure you are connecting to the trusted network, not a Man-in-the-Middle. It requires mutual authentication, which happens for example on the WPI wireless network by using EAP-TLS certificates. The client is supposed to verify the server's certificate and the server of course verifies the client's certificate. Unfortunately, most networks don't use EAP but rather use Pre-Shared Keys (WPA2-PSK). > If you need to patch both sides to be secure, > then you are not secure in the coffee shop no > matter what you do. In any case, if you are > using the wireless to connect to a web site > or "cloud" server, then the wireless connection > is the least of your insecurities. In the strictest sense this is true, but as far as the KRACK attack goes, the wireless AP side is much less likely to be a problem, because the vulnerabilities are in parts of the standards that are not often used (802.11r "Fast Roaming" for example). The client-side vulnerabilities, especially in Linux/Android, are much more serious. On Linux, the client can be tricked into using a null session key. However, in a coffee shop KRACK is moot because most coffee shops don't use encryption at all to begin with. In any case, WPI's recommendation to use the VPN if you are not sure of your device's or the network's immunity to KRACK is sound, because even if there was a M-i-t-M, they still would not be able to decrypt the VPN traffic. Security is helpful in layers. Belt-and-suspenders.

Oct. 18, 2017

Re: [Wlug] Major WPA2 Vulnerability

by Keith Wright

"Sweetser, Frank E" <fs(a)WPI.EDU> writes: > Nothing so simple, unfortunately. This class of vulnerability is > actually a collection of 10 CVEs, which encompass both the AP side and > client side. If you've patched the AP side, for example, the attacker > may still be able to compromise the set of session keys on the client > side, and decrypt all of the client sent traffic. > You've got to patch both sides to be fully secure. You've got to avoid computers to be fully secure. But let's not get that paranoid. I pulled Cat 5 cable through the house years ago and never use wireless, but WPI has its hair on fire, and sent Professor Diane email (through Microsoft cloud service) to install "upgrades" immediately. I told her to at least wait until she has her computer back in the office and plugged into WPI cable. I have a friend who has been without a computer for a month or two because he tried to upgrade firmware and could not re-boot. This is very embarrassing for the authors of the standard, but is it really a big problem? Several meetings ago, somebody brought a device to the WLUG meeting that, as I understood it, pretends to be a wireless router and interposes itself into any nearby connection. If things like that exist, why care about encryption vulnerability? If you need to patch both sides to be secure, then you are not secure in the coffee shop no matter what you do. In any case, if you are using the wireless to connect to a web site or "cloud" server, then the wireless connection is the least of your insecurities. -- Keith

Oct. 18, 2017

Re: [Wlug] Major WPA2 Vulnerability

by Sweetser, Frank E

Nothing so simple, unfortunately. This class of vulnerability is actually a collection of 10 CVEs, which encompass both the AP side and client side. If you've patched the AP side, for example, the attacker may still be able to compromise the set of session keys on the client side, and decrypt all of the client sent traffic. You've got to patch both sides to be fully secure. """ The direction in which packets can be decrypted (and possibly forged) depends on the handshake being attacked. Simplified, when attacking the 4-way handshake, we can decrypt (and forge) packets sent by the client. When attacking the Fast BSS Transition (FT) handshake, we can decrypt (and forge) packets sent towards the client. Finally, most of our attacks also allow the replay of unicast, broadcast, and multicast frames. For further details, see Section 6 of our research paper<https://www.krackattacks.com/#paper>. """ Frank Sweetser Director of Network Operations Worcester Polytechnic Institute "For every problem, there is a solution that is simple, elegant, and wrong." - HL Mencken ________________________________ From: wlug-bounces(a)mail.wlug.org <wlug-bounces(a)mail.wlug.org> on behalf of Theo Van Dinter <felicity(a)kluge.net> Sent: Monday, October 16, 2017 3:30 PM To: Worcester Linux Users Group Subject: Re: [Wlug] Major WPA2 Vulnerability fwiw, my understanding is that the vulnerability is on the client side. therefore, I'm not sure what patches would get applied to an access point, though presumably if you use bridging (and maybe extension?) functionality then maybe there's an issue there. iow, I think patching access points isn't necessary or at least is a low priority if you're not using a feature that turns the device into a client. """ What if there are no security updates for my router? Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details. In general though, you can try to mitigate attacks against routers and access points by disabling client functionality (which is for example used in repeater modes) and disabling 802.11r (fast roaming). For ordinary home users, your priority should be updating clients such as laptops and smartphones. """ On Mon, Oct 16, 2017 at 3:21 PM, Michael C Voorhis <mvoorhis(a)cs.wpi.edu<mailto:mvoorhis@cs.wpi.edu>> wrote: Chuck Anderson writes: > Because none of Fedora's updates aren't actually released yet. They > are built and undergoing pushing/testing now, but being a public > distro, anyone can get them if they know where to look: Ubuntu released a bunch of WPA-related patches a little after noontime today, it appears. John Stoffel: > I'm using DD-WRT on my APs at home, but god do the web pages and > forums suck for actually figuring out what version to run and > whether it's patched or not. Sigh... Ditto for OpenWRT, it appears the project is still alive, but you'd never know, looking at their website. I may switch to LEDE, which confusingly appears to be a fork of OpenWRT which is trying to merge back with OpenWRT....? --MCV. _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org<mailto:Wlug@mail.wlug.org> http://mail.wlug.org/mailman/listinfo/wlug

Oct. 16, 2017

Re: [Wlug] Major WPA2 Vulnerability

by Theo Van Dinter

fwiw, my understanding is that the vulnerability is on the client side. therefore, I'm not sure what patches would get applied to an access point, though presumably if you use bridging (and maybe extension?) functionality then maybe there's an issue there. iow, I think patching access points isn't necessary or at least is a low priority if you're not using a feature that turns the device into a client. """ What if there are no security updates for my router? Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details. In general though, you can try to mitigate attacks against routers and access points by disabling client functionality (which is for example used in repeater modes) and disabling 802.11r (fast roaming). For ordinary home users, your priority should be updating clients such as laptops and smartphones. """ On Mon, Oct 16, 2017 at 3:21 PM, Michael C Voorhis <mvoorhis(a)cs.wpi.edu> wrote: > Chuck Anderson writes: > > Because none of Fedora's updates aren't actually released yet. They > > are built and undergoing pushing/testing now, but being a public > > distro, anyone can get them if they know where to look: > > Ubuntu released a bunch of WPA-related patches a little after noontime > today, it appears. > > John Stoffel: > > I'm using DD-WRT on my APs at home, but god do the web pages and > > forums suck for actually figuring out what version to run and > > whether it's patched or not. Sigh... > > Ditto for OpenWRT, it appears the project is still alive, but you'd > never know, looking at their website. I may switch to LEDE, which > confusingly appears to be a fork of OpenWRT which is trying to merge > back with OpenWRT....? > > --MCV. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Oct. 16, 2017