From owner-freebsd-stable@FreeBSD.ORG  Mon May  5 12:59:46 2003
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id F348F37B401
	for <stable@freebsd.org>; Mon,  5 May 2003 12:59:45 -0700 (PDT)
Received: from ion.gank.org (ion.gank.org [198.78.66.164])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 721B043F85
	for <stable@freebsd.org>; Mon,  5 May 2003 12:59:45 -0700 (PDT)
	(envelope-from craig@xfoil.gank.org)
Received: from localhost (ion.gank.org [198.78.66.164])
	by ion.gank.org (GankMail) with ESMTP id 925852CFCA
	for <stable@freebsd.org>; Mon,  5 May 2003 14:59:44 -0500 (CDT)
Received: from ion.gank.org ([198.78.66.164])
 by localhost (ion.gank.org [198.78.66.164]) (amavisd-new, port 10024)
 with LMTP id 90114-02 for <stable@freebsd.org>;
 Mon,  5 May 2003 14:59:44 -0500 (CDT)
Received: from owen1492.uf.corelab.com (pix.corelab.com [12.45.169.2])
	by ion.gank.org (GankMail) with ESMTP id C5F3A2BBB7
	for <stable@freebsd.org>; Mon,  5 May 2003 14:59:43 -0500 (CDT)
From: Craig Boston <craig@xfoil.gank.org>
To: stable@freebsd.org
In-Reply-To: <200305051950.h45Jo5Pu026249@khavrinen.lcs.mit.edu>
References: <200305050845.h458j38c069038@grimreaper.grondar.org>
	 <20030505121050.GC21530@madman.celabo.org>
	 <20030505052615.R2996@znfgre.qbhto.arg>
	 <200305051950.h45Jo5Pu026249@khavrinen.lcs.mit.edu>
Content-Type: text/plain
Organization: 
Message-Id: <1052164783.38008.37.camel@owen1492.uf.corelab.com>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.2.4 
Date: 05 May 2003 14:59:43 -0500
Content-Transfer-Encoding: 7bit
Subject: Re: HEADS UP! Kerberos5/Heimdal now default!
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 05 May 2003 19:59:46 -0000

Sorry for the dupe Garrett, forgot to copy the list......

> What ``extremely colorful history of ... vulnerabilities''?  I can
> think of no more than five times I've had to rebuild my KDC in six
> years.

...and nearly every security advisory I've seen for Kerberos 5 in the
last year or two was actually for the Kerberos 4 compatibility code. 
One of the reasons I always build the port with "KRB5_KRB4_COMPAT=NO".

The only exception I can think of at the moment was the XDR/RPC buffer
overflow, which hit a LOT of software.

Craig