From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([209.51.188.92]:52760) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hQNx5-0003Bi-A0 for guix-patches@gnu.org; Mon, 13 May 2019 23:18:04 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hQNx4-0007Fs-6K for guix-patches@gnu.org; Mon, 13 May 2019 23:18:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:33291) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hQNx3-0007F1-S1 for guix-patches@gnu.org; Mon, 13 May 2019 23:18:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1hQNx3-0007et-LS for guix-patches@gnu.org; Mon, 13 May 2019 23:18:01 -0400 Subject: [bug#34632] [PATCH 0/2] Change from GSS to MIT-KRB5. Resent-Message-ID: From: Maxim Cournoyer References: <20190223162042.18168-1-mbakke@fastmail.com> <20190226045813.GA29580@jasmine.lan> <87tvg323ak.fsf@gnu.org> <87o96bqyap.fsf@gmail.com> <20190317182705.GD1410@jasmine.lan> Date: Mon, 13 May 2019 23:17:17 -0400 In-Reply-To: <20190317182705.GD1410@jasmine.lan> (Leo Famulari's message of "Sun, 17 Mar 2019 14:27:05 -0400") Message-ID: <87o9457miq.fsf@gmail.com> MIME-Version: 1.0 Content-Type: text/plain List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: Leo Famulari Cc: 34632@debbugs.gnu.org Hello, Leo Famulari writes: > On Fri, Mar 15, 2019 at 11:43:26PM -0400, Maxim Cournoyer wrote: >> Unmaintained on what ground? The website doesn't list fresh news, >> but the latest release was made in 2014 [1], and the maintainer has made >> changes to the Debian package last time in 2017 [2]. I wouldn't say it's >> unmaintained until the maintainer says so or CVEs pile up unfixed (which >> there aren't). > > Considering the rate of vulnerability discovery in MIT Kerberos [0] I > think that, if GSS was being examined to the same degree, we would learn > of many serious bugs. Any significant C codebase of this age will have > such bugs. But unfortunately GSS hasn't received as much scrutiny. > > [0] > https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=krb5 Just FYI, I had ping'd the GSS mailing list with this message: http://lists.gnu.org/archive/html/help-gss/2019-03/msg00001.html, but there haven't been a reply (yet). So it looks like it was a wise decision to make the switch! Sorry for doubting, eh! Maxim