figdev: I genuinely don't know what you are talking about. I usually don't get on dev1galaxy much (or at all). I'm here more or less by chance, and will most probably disappear again for several months. Fora have never been my cookie.  Whatever it is, I am sure it can be solved/clarified by more active forum members ;-)

HTH

Siva, please not that they say that the attack is based on the *symmetric* part of the encryption, not on the *asymmetric* part (that is the part that involved private and public keys). The factual error is in the description of how *asymmetric* encryption works in OpenPGP. And it is not relevant to the attack (and they say that in the article).

In general, publishing a paper does not mean publishing a truth. Especially if the paper had not been peer-reviewed yet (and this does not seem to have been peer reviewed yet, or at least not with proper attention)...

This is the latest evidence that security is not at all an automatic thing (if we ever needed one more), and that FUD spreads faster than real news.

The article is really misleading, and the way it has been advertised is even more misleading. Please avoid to spread FUD: It's not PGP or OpenPGP to have been exploited, rather the uncanny behaviour of sending, receiving, and automatically visualising multipart emails containing external references (e.g., HTML tags which are interpreted by the MUA).

OpenPGP is *not* flawed: the MUAs  which visualise external content without asking the user are flawed and broken. The usage of HTML emails is flawed and broken.

PGP/OpenPGP/GPG are *safe*. Please continue encrypting and signing your emails. Just use a *sane* client. If you can't use one, then just disable the automagic visualisation of HTML parts, and disable the references to external content.

I have always sourced only "/etc/bash_completion" (which, BTW, sources /usr/share/bash-completion/bash_completion, which in turns loads all the completions under /usr/share/bash-completion/completions/ ...) and I don't use apt :-)

Hi All,

official Devuan installers based on d-i (debian installer) have always included non-free firmware. This is a choice made by Devuan developers. Non-free firmware packages are also available in live images (desktop-live and minimal-live), and there you have the option to remove them. This does not mean that non-free software is automatically installed or that non-free repos are automatically added to your sources.list during installation (which is something that has come up in this and other threads, and is wrong and misleading).
The only case in which "non-free" is silently added to sources.list is when you install non-free firmware during installation, and it is added only to the deb entry corresponding to the install medium (CDROM or DVD). The reason is that the non-free component on the install medium contains exclusively packages for non-free firmware, which you already chose to install anyway.

Please notice that an explicit reference to the presence of non-free firmware in Devuan install media is included in the files README.txt and README.html shipped with NETINST, DVD, and CD since Devuan ASCII RC.

If you use a network mirror at install time, you are always asked if you want to include "contrib" and/or "non-free" or not [1]. If you don't use a network mirror, there is no way you can install any non-free software except for the firmware referred to above, since non-free firmware packages are the only non-free packages shipped with Devuan install media.

My personal understanding is that there is no compelling reason to change this default, since it is reasonable enough and accommodates the needs of all Devuan users.

HND

KatolaZ

[1] Please notice that the installer of Devuan ASCII Beta had a bug which included "contrib"  and/or "non-free" in every line of sources.list. That was a genuine bug (http://bugs.devuan.org/190), not an intentional addition as a few contributors here have suggested. The bug was fixed in Devuan ASCII RC.

I am not sure I fully understand your question, but the sources of all the packages are available from the corresponding deb-src repos (as in Debian).  Moreover, all the packages forked by Devuan are available at https://git.devuan.org/devuan-packages  You can download the source or each package and rebuild it on your own if you like. Moreover, it's git, so you have the whole change history there.

You are sure that the packages installed in your system through dpkg/apt/apt-get/aptitude/synaptic/ come actually from the original Devuan repository because the Release files in the repo are signed with the Devuan archive signing key (the corresponsding public key is distributed within the devuan-keyring package and is available under /usr/share/keyrings/devuan-archive.gpg). apt checks if the Release files you download from a mirror are signed with one of the configured keys. If the signatures are not valid, apt will exit and refuse to install anything.Each Release file contains the SHA256SUMs of all the Packages.gz files in the corresponding suite. Those Packages.gz files contain an RFC822 stanza for each package, and one of the fields in the stanza is the SHA256SUM of the corresponding binary package. That SHA256SUM is checked by dpkg/apt/apt-get/aptitude/synaptic before actually installing the package. If it does not match, the package is not installed. 

In a word: if you trust strong encryption and strong hash functions, you should be almost certain that the stuff you have in your system comes from Devuan. If you don't trust Devuan, you can always download the source and build the packages on your own. If this is still not enough, you'd better try another distro :-)

HTH

KatolaZ

Sorry, I genuinely didn't mean to sound accusative in my post, so please accept my apologies if it sounded
anywhere close to that.
I am always grateful for any kind of help people can give to Devuan, without distinction.

The thing is that Devuan genuinely needs to transform appreciation of users into concrete
help, of any kind

Thanks, and sorry again!

KatolaZ

Hi,

the best way to "thank" Devuan is to help making it survive, grow, and prosper. Please consider whether you can contribute with any of the things indicated in the "wishlist" here:

  https://devuan.org/os/debian-fork/stabl … nce-050517

under the section "Anyone can help Devuan". Hang out on the IRC channel #devuan (freenode) to find fellow Devuaners, or roll your sleeves up and shout on #devuan-dev to get in touch with devs and offer your help.

Devuan is not much about "making a point", rather about "drawing a new path". And everyone is responsible for making this new path become real
;-)

HND

KatolaZ