fosstodon.org is one of the many independent Mastodon servers you can use to participate in the fediverse.
Fosstodon is an invite only Mastodon instance that is open to those who are interested in technology; particularly free & open source software. If you wish to join, contact us for an invite.

Administered by:

Server stats:

10K
active users

#rpki

1 post1 participant0 posts today
I submitted a Pull Request to update MacPorts' rpki-client to 9.5 here:

https://github.com/macports/macports-ports/pull/28128

GitHub Continuous Integration checks passed!

Update: Or at least I thought they did?

Now seeing this error:

"Creating port index in /Users/runner/work/macports-ports1597/macports-ports1597/ports
Adding port net/rpki-client
signal interp lost
ports/.github/workflows/bootstrap.sh: line 150: 2047 Abort trap: 6 portindex -e
Error: Process completed with exit code 134."

o.O

From: https://github.com/artkiver/macports-ports1597/actions/runs/14437970476

Even though previously in the GitHub UI, it showed all three checks as green. wtfh? I mean, I hate GitHub and have less than no reason to trust it, but that's a new one, even for me.

If I check: https://github.com/macports/macports-ports/pull/28128/checks

All is green there too. I am so confused.

Regardless, it's up to someone else with commit access to merge it.

Meanwhile, still no assistance regarding my request for help on the MacPorts' patches for OpenSSH 10.0p1/2 for ssh-agent.c and sshd-session.c, but someone else did open another Trac issue regarding OpenSSH's logging (or lack thereof) here:

https://trac.macports.org/ticket/72345

Though, they also observe the same behavior with the Apple shipped version, so they pontificate if it may be an issue upstream?

Ya think?

Sometimes, I think folks vastly overestimate what "maintainer" means or how much I might be using some of this software or what they expect me to do about it just because it is "assigned" to me.

For example: I basically do not run sshd on any macOS systems, since I only have Apple laptops which sleep a lot and are absolutely awful as anything that should be a server running daemonized software.

Did these folks not notice that Apple themselves discontinued their XServe hardware line circa 2004? Or that even their "OS X Server" product was discontinued from the App Store in 2022?

I guess they missed the memos, couldn't read the room or writing on the wall?

But then, they observed this in macOS Monterey, which itself is from 2021, so maybe they just prefer livin in the past? I have no idea.

I am not even sure how to meaningfully reply to that Trac issue.

#RPKI #rpkiーclient #MacPorts #macOS #BGP #OpenBGPD #OpenSource
Description

Type(s)


 bugfix
 enhancement
 security fix

Tested on

macOS 15.4 24E248 arm64
Command Line Tools 16.3.0.0.1.1742442376
Verification 
Have you

 followed our Commit Message Guideline...
GitHubrpki-client: update to 9.5 by artkiver · Pull Request #28128 · macports/macports-portsBy artkiver
Continued thread

also available in English:
Adoption of RPKI/ROV security protocol progressing very quickly -- Next step is implementation of ASPA

Although RPKI/ROV is being adopted very quickly, it's still early days for the other two RPKI-based protocols. Anyone now running RPKI with ROV will be able to take the next step to ASPA in the next few years. Where BGPsec is concerned, it's a question of waiting for the next generation of routing systems.

#RPKI#ASPA#BGPsec

op SIDN.nl:
RPKI/ROV-beveiligingsprotocol maakt razendsnelle adoptie door -- Volgende stap is implementatie van ASPA
sidn.nl/nieuws-en-blogs/rpki-r

Waar RPKI/ROV een heel snelle adoptie heeft doorgemaakt, is het voor de andere twee RPKI-gebaseerde protocollen nog net te vroeg. Wie nu RPKI met ROV heeft draaien, zal een dezer jaren de vervolgstap naar ASPA kunnen maken. Voor BGPsec is het wachten op de volgende generatie routersystemen.

#RPKI#ASPA#BGPsec

Did you know chrony, the #NTP implementation, sets up an administrative listener on the loopback interface using UDP/323 by default?

Unfortunately in the #RPKI rpki-rtr has TCP/323 registered with IANA (see IETF RFC 6810). UDP/323 is reserved. Reserving a transport that is unused by the assigned application is common practice these days.

chrony's choice can probably be chalked up to a historical accident since it came first and presumably picked 323 because it "looked" like 123 and was then unassigned.

Chrony should probably change their default imo, but maybe it's too late or not worth it now?

We are pleased to announce the latest release of Routinator, version 0.14.2 ‘Roll Initiative!’ This of our validator fixes an issue in the bundled UI that caused it to retrieve data from our own test instance rather than the actual Routinator instance. Users of the bundled UI should upgrade. github.com/NLnetLabs/routinato

GitHubRelease 0.14.2 ’Roll Initiative!’ · NLnetLabs/routinatorThis release fixes an issue in the bundled UI that caused it to retrieve data from our own test instance rather than the actual Routinator instance. Users of the bundled UI should upgrade. Other ch...
Replied to Named Bird

@namedbird @GuidoKostons

Goed dat je het gefixt hebt! Wel jammer dat je registrar niet helemaal bij de tijd is.

Voor andere *Europese* #DNS providers die -voor zover wij weten- allemaal #DNSSEC doen zie trouwens: european-alternatives.eu/categ

deSEC is zelfs een voor gebruikers kosteloze dienst: desec.io/

Welke #RPKI problemen zie je trouwens bij de mail forwarding via Cloudflare?

European AlternativesEuropean managed DNS providers | European AlternativesA managed DNS provider can be used to set DNS records for domains.

Nous venons d'implémenter un filtrage basé sur "Autonomous System Provider Authorization" (ASPA) sur un des RS de Lillix
(RS2).

Etant donné que ASPA n'est pas encore normalisé, on va attendre que ca soit fait pour l'implémenter sur RS1.
#RPKI
infos sur le blog d'@alarig (qui l'a implémenté chez Lillix):
swordarmor.fr/securisation-du-

www.swordarmor.frSécurisation du routage BGP en utilisant ASPA avec routinator et bird (cas de Breizh-IX)

We just released Routinator 0.14.1, fixing CVE-2025-0638, where non-ASCII characters in the file names listed in an manifest lead to a crash of Routinator:
nlnetlabs.nl/downloads/routina

You should also be aware of CVE-2024-12084, fixing a heap-based buffer overflow flaw was found in the rsync daemon:
nvd.nist.gov/vuln/detail/cve-2

Please make sure you update both Routinator and rsync. Lastly, because gzip is re-enabled, you’ll save up to 50% bandwidth.

nlnetlabs.nl/news/2025/Jan/22/

“… require contracted providers of Internet services to agencies to adopt and deploy Internet routing security technologies, including publishing Route Origin Authorizations and performing Route Origin Validation filtering."

In light of this Executive Order; if you need solutions that are continually developed, have a proven track record, are trusted by the world’s largest operators and are supported with a service-level agreement, we're here for you.

whitehouse.gov/briefing-room/p

The White House · Executive Order on Strengthening and Promoting Innovation in the Nation’s Cybersecurity | The White HouseBy the authority vested in me as President by the Constitution and the laws of the United States of America, including the International Emergency

Whoof, this "Executive Order on Strengthening and Promoting Innovation in the Nation’s Cybersecurity" is a lot of words:

whitehouse.gov/briefing-room/p

Notable:

"Within 120 days, publish #RPKI Route Origin Authorizations..."

"Within 180 days, enable encrypted DNS protocols..."

"Agencies shall implement PQC key establishment or hybrid key establishment including a PQC algorithm as soon as practicable..."

"Within 270 days, establish a program to use advanced AI models for cyber defense."

The White House · Executive Order on Strengthening and Promoting Innovation in the Nation’s Cybersecurity | The White HouseBy the authority vested in me as President by the Constitution and the laws of the United States of America, including the International Emergency