Invisible wrote:

> It appears the report was written by somebody other than the author. But 
> then, comments like "OpenVPN seems to be using SSL" make me suspicious. 
> As does the fact that SSL and TLS both run over TCP, yet OpenVPN seems 
> to be using UPD. That looks like a big enough deviation from the 
> standard that I'm left wondering how many design decisions have been 
> made with potential security implications.
> 
> It's not like OpenVPN just calls the OpenSSH crypto library to do its 
> bidding; it looks like a complete new implementation.

Wikipedia claims OpenVPN uses the OpenSSL library.

http://en.wikipedia.org/wiki/OpenVPN

Still unclear how it runs SSL over UDP...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Tue, 08 Jul 2008 15:59:53 +0100, Invisible wrote:

> Invisible wrote:
> 
>> It appears the report was written by somebody other than the author.
>> But then, comments like "OpenVPN seems to be using SSL" make me
>> suspicious. As does the fact that SSL and TLS both run over TCP, yet
>> OpenVPN seems to be using UPD. That looks like a big enough deviation
>> from the standard that I'm left wondering how many design decisions
>> have been made with potential security implications.
>> 
>> It's not like OpenVPN just calls the OpenSSH crypto library to do its
>> bidding; it looks like a complete new implementation.
> 
> Wikipedia claims OpenVPN uses the OpenSSL library.

http://openvpn.net/index.php/documentation/manuals/openvpn-21.html - 
under "Description":

"OpenVPN is tightly bound to the OpenSSL library, and derives much of its 
crypto capabilities from it."

> http://en.wikipedia.org/wiki/OpenVPN
> 
> Still unclear how it runs SSL over UDP...

From the above quote, it maybe doesn't, but instead uses the crypto from 
openSSL.

Jim

Post a reply to this message

On Tue, 08 Jul 2008 07:32:56 -0500, Mike Raiford wrote:

> Jim Henderson wrote:
> 
>>> Before you put oil in the pan, a quick touch of the surface will tell
>>> you if it's hot enough. Don't do it after you put oil in the pan,
>>> though.. that'll land you squarely in the burn ward.
>> 
>> An IR thermometer will also tell you if it's hot enough or not - and
>> won't even singe your fingers. :-)
>> 
>> Jim
> 
> That's a cool idea, but where's the fun in that? :)

Well, if you consider going to the ER for burns fun, then have at it.  I 
have different ideas of what constitutes "fun", and not being burned is a 
part of all of them. ;-)

> Hmm... This part of the thread has strayed way off topic. o.O Just
> noticed the title had something to do with cryptography...

Oh no!  Thread drift! :-)

Jim

Post a reply to this message

On Tue, 08 Jul 2008 09:00:45 +0100, Invisible wrote:

>>> UK is 30 people, HQ is about 300. Don't know about the other sites.
>> 
>> That explains a lot about management's attitudes....small sites are
>> very easy to not include in planning, especially when they're 10% the
>> size of the main site.
>> 
>> That also makes it more challenging to be heard.
> 
> Oh, it's hard enough to make my voice heard within the UK site. The new
> UK management sees the IT guys at HQ as gods, and considers me to be
> little more than the tea boy. If I say one thing and HQ say another, I
> am always ignored. Actually, scrub that. I am always ignored. Everybody
> just assumes I don't know what I'm talking about.

Then you need to make your voice heard.  Tell the auditor "HQ won't let 
me - I've tried telling them and they don't listen to me - so talk to 
them" and then wait.

One of two possible outcomes:  The boss will start listening to you, or 
the boss will get pissed off and sack you (which means you don't have to 
do the 6 month notice thing or find your own replacement, right?) so 
you're free to find something else to do.

Jim

Post a reply to this message

Invisible wrote:
>>> An IR thermometer will also tell you if it's hot enough or not - and 
>>> won't even singe your fingers. :-)
>>
>> That's a cool idea, but where's the fun in that? :)
> 
> http://blog.orphi.me.uk/about/temperatures
> 

Hmmm. I want one.

Post a reply to this message

On 08-Jul-08 10:04, Phil Cook wrote:
> And lo on Mon, 07 Jul 2008 17:07:00 +0100, Stephen <mcavoysAT@aolDOTcom> 
> did spake, saying:
> 
>> On Mon, 07 Jul 2008 14:24:50 +0100, "Phil Cook"
>> <phi### [at] nospamrocainfreeservecouk> wrote:
>>
>>>> I take it that you have a metal handle, lucky you.
>>>
>>> Yep, best way to gauge the heat of the pan.
>>>
>> It sure is ;)
> 
> On a coincidental note BBC2 had a Chinese cooking program on last night. 
> Her tip for the best type of wok - carbon steel with a wooden handle; 
> guess what type I've got :-)
> 
wooden with a carbon steel handle?

Post a reply to this message

>> http://blog.orphi.me.uk/about/temperatures
> 
> Hmmm. I want one.

...and another victim succumbs to my viral marketing, muhuhuhuh!!!

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

>> Still unclear how it runs SSL over UDP...
> 
> From the above quote, it maybe doesn't, but instead uses the crypto from 
> openSSL.

Well, the documentation claims that OpenVPN is "an SSL VPN". But since 
SSL is defined to work over TCP... hmm. ;-)

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

And lo on Tue, 08 Jul 2008 20:17:21 +0100, andrel  
<a_l### [at] hotmailcom> did spake, saying:

> On 08-Jul-08 10:04, Phil Cook wrote:
>> And lo on Mon, 07 Jul 2008 17:07:00 +0100, Stephen  
>> <mcavoysAT@aolDOTcom> did spake, saying:
>>
>>> On Mon, 07 Jul 2008 14:24:50 +0100, "Phil Cook"
>>> <phi### [at] nospamrocainfreeservecouk> wrote:
>>>
>>>>> I take it that you have a metal handle, lucky you.
>>>>
>>>> Yep, best way to gauge the heat of the pan.
>>>>
>>> It sure is ;)
>>  On a coincidental note BBC2 had a Chinese cooking program on last  
>> night. Her tip for the best type of wok - carbon steel with a wooden  
>> handle; guess what type I've got :-)
>>
> wooden with a carbon steel handle?

A type O Rh + infused aluminium pan with a wooden base and a plastic  
handle with carbon steel insert.

[side-note - damn Opera I deleted a load of boojummed messages and it's  
lost my threading. Note to self 'delete prior to posting']

-- 
Phil Cook

--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com

Post a reply to this message

On Wed, 09 Jul 2008 09:00:48 +0100, Invisible wrote:

>>> Still unclear how it runs SSL over UDP...
>> 
>> From the above quote, it maybe doesn't, but instead uses the crypto
>> from openSSL.
> 
> Well, the documentation claims that OpenVPN is "an SSL VPN". But since
> SSL is defined to work over TCP... hmm. ;-)

Well, I've also seen other SSL VPN solutions that work quite well, I'm 
not sure as well how it handles it.

Jim

Post a reply to this message