Guten Morgen / Bonjour / Доброе утро / Good morning.

Guten Mittag, Bon midi, Хороший полдень, Good noon.

[illumos-gate] 15025 hald can't anymore receive events with newer glib versions than 2.63.4 -- Carsten Grzemba <cgrzemba⊙oo>

maybe I'll regret this, but I can't resist asking. What's "NIS+ extended Diffie-Hellman"?

(system/library/security/gss/diffie-hellman)

oh you will definitely regret asking that

it's a gss mech that publishes pubkeys for 1024-bit DH with a fixed group in NIS+

so it should have gone away with NIS+?

and uses them to establish TDEA (3 key 3DES) sessions

well, you can use it with the files backend as well

put the DH keys in /etc somewhere that momentarily escapes my memory

so you can actually test GSS with something that isn't krb5 haha

I actually use it for audit record sending, because it needs a GSS mech, the dummy one isn't built by default, and I don't actually care that much about the security level haha

it does also support 192-bit and 640-bit DH groups which is pretty amazing

you can probably break those in a couple of hours these days

you're right. I didn't want to know.

it feels like if you were able to do something less dh that might not be as bad?

also I say "session keys" but they're the same every time

and it takes them straight out of the DH output, not even any hashing

(same every time between a given pair of hosts)

so it's fixed-fixed DH, the worst kind

and capturing multiple sessions will probably let you do all sorts of nasty things

(so yeah it should probably go)

(learning about this thing was my inspiration for the tweet about making a gss mech plugin for the noise protocol)

(because it's kinda close to something useful, if it wasn't a cryptographic disaster zone -- wouldn't be that bad to be able to register host keys in a file or out of LDAP or whatever and use them to establish gss)

it also uses XDR, but in a kinda ugly way

anyway I would vote for deletion

suspect I'm the only one who has used it in the last 10 years, maybe 20

you'll probably also want to go remove or nop-out the bits of NSS which support getting the keys out of NIS/LDAP/files too

I haven't got further than going "What the heck is this?" while on an unrelated project jaunt

because even my non-crypto non-infosec brain said "God, these numbers after 'dh' are small"

but then the pkg checks decided to tell me something I got wrong _by inode number_

so I'm on a whole different angry journey