| 4 Jul 2022 |
|  lassulus joined the room. | 13:33:52 |
 dotlambda | In reply to @linus:schreibt.jetzt
lassulus: django <- typogrify <- gi-docgen <- librsvg https://github.com/NixOS/nixpkgs/pull/180120 | 14:19:51 |
|  ar joined the room. | 16:44:27 |
|  Andrea Pascal joined the room. | 18:01:32 |
| 5 Jul 2022 |
 @pennae:matrix.eno.space | oh, there's been an issue closing spree for 21.11 cves :D | 00:52:55 |
 hexa | https://github.com/NixOS/nixpkgs/issues/174764 | 01:31:15 |
| hexa | sure … don't care about security issues for two months and then close it | 01:31:29 |
| hexa | I'm not pleased. | 01:31:43 |
 Alyssa Ross | I wonder what to do about that GnuPG patch | 06:16:10 |
| Alyssa Ross | unlike the last one, it hasn't been merged yet | 06:16:22 |
| Alyssa Ross | and "werner removed a reviewer: werner." | 06:16:28 |
| Alyssa Ross | so it wouldn't surprise me if there's been a falling out and it won't be, at least not any time soon… | 06:16:51 |
| Alyssa Ross | (a falling out due to the disclosure of the previous issue, I maen) | 06:17:04 |
|  bdd joined the room. | 06:39:48 |
|  arno joined the room. | 08:18:08 |
|  stigo joined the room. | 08:51:58 |
| Alyssa Ross | hexa: did I accidentally take on OpenSSL responsibility by renaming the package? :P | 15:26:41 |
| 6 Jul 2022 |
|  deep6 joined the room. | 08:00:25 |
| stigo | Added Demi Marie's patch from the last oss-sec post in a PR https://github.com/NixOS/nixpkgs/pull/180336 | 12:17:03 |
| stigo | It seems legit to me, but I'm not sure if we should wait from some info from upstream.. | 12:18:46 |
| stigo | it's a bit annoying that it hasn't gotten a CVE (yet), not sure what to search for to see other discussions about the issue. | 12:26:28 |
 @linus:schreibt.jetzt | Hm, signatures wouldn't actually be compressible anyway, right? | 13:56:06 |
| stigo | They can, it seems | 13:56:44 |
| hexa | https://cr.yp.to/sigs/compress.html | 13:56:53 |
| stigo | Or, they can be put in a compressed packet | 13:57:32 |
| stigo | "By concatenating the
same signature to itself a very large number of times, and then wrapping
them in a compressed packet, I am able to cause GnuPG to take over a
minute to process an input that is less than 5KB armored." | 13:59:51 |
| @linus:schreibt.jetzt | right, but compressed packets are compressed with generic data compression, which is different from what djb describes, and generic data compression wouldn't work well on cryptographic sigs, so disallowing it Should Be Fine™️... right? | 14:02:41 |
