• OpenBSD 7.6 released, Oct 8, 2024 (2/2)

    From Theo de Raadt@21:1/5 to All on Tue Oct 8 16:27:06 2024
    [continued from previous message]

    output by default, still accessible verbatim by using whois
    -S.
    - Removed obsolete whois(1) contact handle support.
    - Made spamd(8) advertise SMTPUTF8 and 8BITMIME extensions in
    EHLO, fixing potential interoperability issues when the real
    MTA supports those extensions.
    - Prevented TOCTOU issues in httpd(8) static file serving and
    auto index generation.
    - Added a "log" option to relayd.conf(5) rules.
    - Made relayd(8) host handle disable/enable commands from
    relayctl(8) correctly in case multiple redirect instances use
    the same host in relayd(8) tables.
    - Improved config validation in relayd(8) to prevent
    incompatibility with the length of names of redirects and
    tags in pf(4).
    - Made ftp(1) send HTTP 'Accept */*' headers.
    - Made ftp(1) send Host: headers with CONNECT requests when
    tunneling TLS over an HTTP proxy.
    - Added the 2024 root zone trust anchor to unwind(8).
    - Made netstat(1) display statistics about expensive mbuf
    operations, counting operations used to allocate mbufs or
    copy memory when memory layout is not optimal to find
    possible optimizations.

    - tmux(1) improvements and bug fixes:
    o Reduced tmux(1) escape-time default to 10 milliseconds (from 500).
    o Added display-menu -M to tmux(1) to always turn mouse on in a
    menu.
    o Added tmux(1) option allow-set-title to forbid applications from
    changing the pane title.
    o Prevented a crash if focusing a pane in tmux(1) that is exiting.
    o Added "N" to search backwards in tmux(1) tree modes.
    o Added tmux(1) "refresh-client -r" for control mode clients to
    provide OSC 10 and 11 responses to tmux so they can set the
    default foreground and background colors.
    o Changed tmux(1) extended-keys behavior to allow applications to
    enter mode 2 but not turn extended keys off entirely.
    o Added a tmux(1) prefix-timeout option to allow setting a period
    after which to ignore the prefix key if no others are pressed.
    o Ignored tmux(1) mouse move keys to prevent accidental prefix
    cancelation.
    o Displayed hyperlinks in tmux(1) copy mode and added
    copy_cursor_hyperlink format to get the hyperlink under the
    cursor.
    o Added search_count and search_count_partial formats in tmux(1)
    copy mode.
    o Revamped tmux(1) extended keys support to more closely match
    xterm1 and support mode 2 as well as mode 1.
    o Added mirrored versions of the main-horizontal and main-vertical
    layouts when the tmux(1) main pane is bottom or right instead of
    top or left.
    o Allowed REP to work with Unicode characters in tmux(1).

    - LibreSSL version 4.0.0
    o Portable changes
    - Added initial Emscripten support in CMake builds.
    - Removed timegm() compatibility layer since all uses were
    replaced with OPENSSL_timegm(). Cleaned up the corresponding
    test harness.
    - The mips32 platform is no longer actively supported.
    o Internal improvements
    - Cleaned up parts of the conf directory. Simplified some
    logic, fixed memory leaks.
    - Simplified X509_check_trust() internals to be somewhat
    readable.
    - Removed last internal uses of gmtime() and timegm() and
    replaced them with BoringSSL's POSIX time conversion API.
    - Removed unnecessary stat calls in by_dir.
    - Split parsing and processing of TLS extensions to ensure that
    extension callbacks are called in a predefined order.
    - Cleaned up the MD4 and MD5 implementations.
    - Assembly functions are no longer exposed in the public API,
    they are all wrapped by C functions.
    - Removed assembly implementations of legacy ciphers on legacy
    architectures.
    - Merged most multi-file implementations of ciphers into one or
    two C files.
    - Removed the cache of certificate validity. This was added for
    performance reasons which no longer apply since BoringSSL's
    time conversion API isn't slow. Also, a recently added error
    check led to obscure, undesirable validation failures.
    - Stopped calling OPENSSL_cpuid_setup() from the .init section
    on amd64 and i386.
    - Rewrote various BN conversion functions.
    - Improved certification request internals.
    - Removed unused DSA methods.
    - Improved X.509v3 extension internals. Fixed various bugs and
    leaks in X509V3_add1_i2d() and X509V3_get_d2i(). Their
    implementations now vaguely resemble code.
    - Rewrote BN_bn2mpi() using CBB.
    - Made most error string tables const.
    - Removed handling for SSLv2 client hello messages.
    - Improvements in the openssl(1) speed app's signal handler.
    - Cleaned up various X509v3_* extension API.
    - Unified the X.509v3 extension methods.
    - Cleaned up cipher handling in SSL_SESSION.
    - Removed get_cipher from SSL_METHOD.
    - Rewrote CRYPTO_EX_DATA from scratch. The only intentional
    change of behavior is that there is now a hard limit on the
    number of indexes that can be allocated.
    - Removed bogus connect() call from netcat.
    - Uses of atoi() and strtol() in libcrypto were replaced with
    strtonum().
    - Introduced crypto_arch.h which will contain the architecture
    dependent code and defines rather than the public
    opensslconf.h.
    - OPENSSL_cpu_caps() is now architecture independent.
    - Reorganized the DES implementation to use fewer files and
    removed optimizations for ancient processors and compilers.
    o New features
    - Added CRLfile option to the cms command of openssl(1) to
    specify additional CRLs for use during verification.
    o Documentation improvements
    - Removed documentation of no longer existing API.
    - Unified the description of the obsolete ENGINE parameter that
    needs to remain in many functions and should always be NULL.
    o Compatibility changes
    - Protocol parsing in libtls was changed. The unsupported
    TLSv1.1 and TLSv1.0 protocols are ignored and no longer
    enable or disable TLSv1.2 in surprising ways.
    - The dangerous EVP_PKEY*_check(3) family of functions was
    removed. The openssl(1) pkey and pkeyparam commands no longer
    support the -check and -pubcheck flags.
    - The one-step hashing functions, MD4(), MD5(), RIPEMD160(),
    SHA1(), all SHA-2, and HMAC() no longer support returning a
    static buffer. Callers must pass in a correctly sized buffer.
    - Support for Whirlpool was removed. Applications still using
    this should honor OPENSSL_NO_WHIRLPOOL.
    - Removed workaround for F5 middle boxes.
    - Removed the useless pem2.h, a public header that was added
    since it was too hard to add a single prototype to one file.
    - Removed conf_api.h and the public API therein.
    - Removed ssl2.h, ssl23.h and ui_compat.h.
    - Numerous conf and attribute functions were removed. Some
    unused types were removed, others were made opaque.
    - Removed the deprecated HMAC_Init() function.
    - Removed OPENSSL_load_builtin_modules().
    - Removed X509_REQ_{get,set}_extension_nids().
    - X509_check_trust() and was removed, X509_VAL was made opaque.
    - Only specified versions can be set on certs, CRLs and CSRs.
    - Removed unused PEM_USER and PEM_CTX types from pem.h.
    - Removed typedefs for COMP_CTX, COMP_METHOD, X509_CRL_METHOD,
    STORE, STORE_METHOD, and SSL_AEAD_CTX.
    - i2d_ASN1_OBJECT() now returns -1 on error like most other
    i2d_*.
    - SPKAC support was removed from openssl(1).
    - Added TLS1-PRF support to the EVP interface.
    - Support for attributes in EVP_PKEYs was removed.
    - The X509at_* API is no longer public.
    - SSL_CTX_set1_cert_store() and
    SSL_CIPHER_get_handshake_digest() were added to libssl.
    - The completely broken UI_UTIL password API was removed.
    - The OpenSSL pkcs12 command and PKCS12_create() no longer
    support setting the Microsoft-specific Local Key Set and
    Cryptographic Service Provider attributes.
    o Bug fixes
    - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509()
    match their documentation. They always set an RFC 5280
    conformant time.
    - Improved standards compliance for supported groups and key
    shares extensions:
    - Duplicate key shares are disallowed.
    - Duplicate supported groups are disallowed.
    - Key shares must be sent in the order of supported groups.
    - Key shares will only be selected if they match the most
    preferred supported group by client preference order.
    - Fixed signed integer overflow in bnrand().
    - Prevent negative zero from being created via BN_clear_bit()
    and BN_mask_bits(). Avoids a one byte overread in
    BN_bn2mpi().
    - Add guard to avoid contracting the number linear hash buckets
    to zero, which could lead to a crash due to accessing a zero
    sized allocation.
    - Fixed i2d_ASN1_OBJECT() with an output buffer pointing to
    NULL.
    - Implemented RSA key exchange in constant time. This is done
    by decrypting with RSA_NO_PADDING and checking the padding in
    libssl in constant time. This is possible because the
    pre-master secret is of known length based on the size of the
    RSA key.
    - Rewrote SSL_select_next_proto() using CBS, also fixing a
    buffer overread that wasn't reachable when used as intended
    from an ALPN callback.
    - Avoid pushing a spurious error onto the error stack in
    ssl_sigalg_select().
    - Made fatal alerts fatal in QUIC.

    - OpenSSH 9.8 and OpenSSH 9.9
    o Security fixes
    - Fix a critical race condition in sshd(8) that could be used
    to obtain remote code execution.
    - Fix a logic error in ssh(1) that rendered the
    ObscureKeystrokeTiming option ineffective.
    o New features
    - ssh(1) and sshd(8) now support a new hybrid post-Quantum key
    exchange algorithm "mlkem768x25519-sha256" based on the
    recently-standardised FIPS 203 Module-Lattice Key
    Encapsulation Mechanism (ML-KEM) with ECDH using the X25519
    group.
    - Support for DSA keys is now disabled at compile time in all
    OpenSSH tools.
    - Support for pre-authentication compression has been removed
    from ssh(1) (it was removed from the server a long time ago).
    - The existing default post-quantum key exchange
    "sntrup761x25519-sha512@openssh.com" is now significantly
    faster in both ssh(1) and sshd(8), and is now available under
    the assigned name "sntrup761x25519-sha512".
    - Split sshd(8) into two separate processes: a listener binary
    and a new sshd-session binary that handles each connection.
    - sshd(8) will now penalise clients that connect without
    completing authentication, crash the server or perform other
    unwelcome activities. This behaviour is controlled via the
    PerSourcePenalties and PerSourcePenaltyExemptList
    sshd_config(5) options.
    - ssh(1) now allows the HostkeyAlgorithms option to disable the
    implicit fallback from certificate host keys to plain host
    keys.
    - The ssh_config(5) Include directive can now expand
    environment variables as well as the same set of %-tokens
    that are accepted for "Match Exec".
    - Add a new RefuseConnection directive to ssh_config(5) that
    will cause the connection to be immediately refused, and a
    corresponding "refuseconnection" penalty class that allows
    clients that have connections so refused to be penalised.
    - Add a new sshd_config(5) "invalid-user" Match predicate that
    allows matching on invalid usernames, e.g. to allow
    penalisation of account/password guessers.
    - Add additional protection to private keys from being included
    in core dumps.
    o Bugfixes
    - Many bugfixes. Please see the release notes at
    https://www.openssh.com/releasenotes.html#9.9 for the full
    list.

    - Ports and packages:
    o Pre-built packages are available for the following architectures on
    the day of release:
    - aarch64 (arm64): 12148
    - amd64: 12312
    - i386: 10534
    - mips64: 8629
    - powerpc64: 8314
    - sparc64: 8797
    o Packages for the following architectures will be made available as
    their builds complete:
    - arm
    - powerpc
    - riscv64

    - Some highlights:

    o Asterisk 16.30.1, 18.24.3 and o Mozilla Firefox 130.0.1 and
    20.9.3 ESR 128.2.0
    o Audacity 3.6.3 o Mozilla Thunderbird 128.2.3
    o CMake 3.30.1 o Mutt 2.2.13 and NeoMutt 20240425
    o Chromium 128.0.6613.137 o Node.js 20.17.0
    o Emacs 29.4 o OCaml 4.14.2
    o FFmpeg 4.4.5 o OpenLDAP 2.6.8
    o GCC 8.4.0 and 11.2.0 o PHP 8.1.29, 8.2.23 and 8.3.11
    o GHC 9.6.6 o Postfix 3.9.0
    o GNOME 46 o PostgreSQL 16.4
    o Go 1.23.1 o Python 2.7.18 and 3.11.10
    o JDK 8u402, 11.0.24, 17.0.12 o Qt 5.15.13 (+ kde patches) and
    and 21.0.4 6.6.3
    o KDE Applications 24.05.2 o R 4.4.1
    o KDE Frameworks 6.5.0 o Ruby 3.1.6, 3.2.5 and 3.3.5
    o KDE Plasma 6.1.4 o Rust 1.81.0
    o Krita 5.2.3 o SQLite 3.44.2
    o LLVM/Clang 13.0.0, 16.0.6 and o Shotcut 24.04.28
    17.0.6 o Sudo 1.9.15.5
    o LibreOffice 24.8.1.2 o Suricata 7.0.6
    o Lua 5.1.5, 5.2.4, 5.3.6 and o Tcl/Tk 8.5.19 and 8.6.13
    5.4.7 o TeX Live 2023
    o MariaDB 10.9.8 o Vim 9.1.707 and Neovim 0.10.1
    o Mono 6.12.0.199 o Xfce 4.18.1

    - As usual, steady improvements in manual pages and other documentation.

    - The system includes the following major components from outside suppliers:
    o Xenocara (based on X.Org 7.7 with xserver 21.1.13 + patches,
    freetype 2.13.2, fontconfig 2.14.2, Mesa 23.3.6, xterm 393,
    xkeyboard-config 2.20, fonttosfnt 1.2.3, and more)
    o LLVM/Clang 16.0.6 (+ patches)
    o GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
    o Perl 5.38.2 (+ patches)
    o NSD 4.9.1
    o Unbound 1.21.0
    o Ncurses 6.4
    o Binutils 2.17 (+ patches)
    o Gdb 6.3 (+ patches)
    o Awk July 28, 2024 version
    o Expat 2.6.3
    o zlib 1.3.1 (+ patches)

    ------------------------------------------------------------------------
    - SECURITY AND ERRATA --------------------------------------------------

    We provide patches for known security threats and other important
    issues discovered after each release. Our continued research into
    security means we will find new security problems -- and we always
    provide patches as soon as possible. Therefore, we advise regular
    visits to

    https://www.OpenBSD.org/security.html
    and
    https://www.OpenBSD.org/errata.html

    ------------------------------------------------------------------------
    - MAILING LISTS AND FAQ ------------------------------------------------

    Mailing lists are an important means of communication among users and developers of OpenBSD. For information on OpenBSD mailing lists, please
    see:

    https://www.OpenBSD.org/mail.html

    You are also encouraged to read the Frequently Asked Questions (FAQ) at:

    https://www.OpenBSD.org/faq/

    ------------------------------------------------------------------------
    - DONATIONS ------------------------------------------------------------

    The OpenBSD Project is a volunteer-driven software group funded by
    donations. Besides OpenBSD itself, we also develop important software
    like OpenSSH, LibreSSL, OpenNTPD, OpenSMTPD, the ubiquitous pf packet
    filter, the quality work of our ports development process, and many
    others. This ecosystem is all handled under the same funding umbrella.

    We hope our quality software will result in contributions that maintain
    our build/development infrastructure, pay our electrical/internet costs,
    and allow us to continue operating very productive developer hackathon
    events.

    All of our developers strongly urge you to donate and support our future efforts. Donations to the project are highly appreciated, and are
    described in more detail at:

    https://www.OpenBSD.org/donations.html

    ------------------------------------------------------------------------
    - OPENBSD FOUNDATION ---------------------------------------------------

    For those unable to make their contributions as straightforward gifts,
    the OpenBSD Foundation (https://www.openbsdfoundation.org) is a Canadian not-for-profit corporation that can accept larger contributions and
    issue receipts. In some situations, their receipt may qualify as a
    business expense write-off, so this is certainly a consideration for
    some organizations or businesses.

    There may also be exposure benefits since the Foundation may be
    interested in participating in press releases. In turn, the Foundation
    then uses these contributions to assist OpenBSD's infrastructure needs.
    Contact the foundation directors at directors@openbsdfoundation.org for
    more information.

    ------------------------------------------------------------------------
    - HTTPS INSTALLS -------------------------------------------------------

    OpenBSD can be easily installed via HTTPS downloads. Typically you need
    a single small piece of boot media (e.g., a USB flash drive) and then
    the rest of the files can be installed from a number of locations,
    including directly off the Internet. Follow this simple set of
    instructions to ensure that you find all of the documentation you will
    need while performing an install via HTTPS.

    1) Read either of the following two files for a list of HTTPS mirrors
    which provide OpenBSD, then choose one near you:

    https://www.OpenBSD.org/ftp.html
    https://ftp.openbsd.org/pub/OpenBSD/ftplist

    As of October 8, 2024, the following HTTPS mirror sites have the
    7.6 release:

    https://cdn.openbsd.org/pub/OpenBSD/7.6/ Global
    https://ftp.eu.openbsd.org/pub/OpenBSD/7.6/ Stockholm, Sweden
    https://ftp.hostserver.de/pub/OpenBSD/7.6/ Frankfurt, Germany
    https://ftp.bytemine.net/pub/OpenBSD/7.6/ Oldenburg, Germany
    https://ftp.fr.openbsd.org/pub/OpenBSD/7.6/ Paris, France
    https://mirror.aarnet.edu.au/pub/OpenBSD/7.6/ Brisbane, Australia
    https://ftp.usa.openbsd.org/pub/OpenBSD/7.6/ CO, USA
    https://ftp5.usa.openbsd.org/pub/OpenBSD/7.6/ CA, USA
    https://mirror.esc7.net/pub/OpenBSD/7.6/ TX, USA
    https://openbsd.cs.toronto.edu/pub/OpenBSD/7.6/ Toronto, Canada
    https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.6/ Global
    https://fastly.cdn.openbsd.org/pub/OpenBSD/7.6/ Global

    The release is also available at the master site:

    https://ftp.openbsd.org/pub/OpenBSD/7.6/ Alberta, Canada

    However it is strongly suggested you use a mirror.

    Other mirror sites may take a day or two to update.

    2) Connect to that HTTPS mirror site and go into the directory
    pub/OpenBSD/7.6/ which contains these files and directories.
    This is a list of what you will see:

    ANNOUNCEMENT armv7/ octeon/ root.mail
    README hppa/ openbsd-76-base.pub sparc64/
    SHA256 i386/ packages/ src.tar.gz
    SHA256.sig landisk/ packages-stable/ sys.tar.gz
    alpha/ loongson/ ports.tar.gz xenocara.tar.gz
    amd64/ luna88k/ powerpc64/
    arm64/ macppc/ riscv64/

    It is quite likely that you will want at LEAST the following
    files which apply to all the architectures OpenBSD supports.

    README - generic README
    root.mail - a copy of root's mail at initial login.
    (This is really worthwhile reading).

    3) Read the README file. It is short, and a quick read will make
    sure you understand what else you need to fetch.

    4) Next, go into the directory that applies to your architecture,
    for example, amd64. This is a list of what you will see:

    BOOTIA32.EFI* bsd* floppy76.img pxeboot*
    BOOTX64.EFI* bsd.mp* game76.tgz xbase76.tgz
    BUILDINFO bsd.rd* index.txt xfont76.tgz
    INSTALL.amd64 cd76.iso install76.img xserv76.tgz
    SHA256 cdboot* install76.iso xshare76.tgz
    SHA256.sig cdbr* man76.tgz
    base76.tgz comp76.tgz miniroot76.img

    If you are new to OpenBSD, fetch _at least_ the file INSTALL.amd64
    and install76.iso. The install76.iso file (roughly 702MB in size)
    is a one-step ISO-format install CD image which contains the various
    *.tgz files so you do not need to fetch them separately.

    If you prefer to use a USB flash drive, fetch install76.img and
    follow the instructions in INSTALL.amd64.

    5) If you are an expert, follow the instructions in the file called
    README; otherwise, use the more complete instructions in the
    file called INSTALL.amd64. INSTALL.amd64 may tell you that you
    need to fetch other files.

    6) Just in case, take a peek at:

    https://www.OpenBSD.org/errata.html

    This is the page where we talk about the mistakes we made while
    creating the 7.6 release, or the significant bugs we fixed
    post-release which we think our users should have fixes for.
    Patches and workarounds are clearly described there.

    ------------------------------------------------------------------------
    - X.ORG FOR MOST ARCHITECTURES -----------------------------------------

    X.Org has been integrated more closely into the system. This release
    contains X.Org 7.7. Most of our architectures ship with X.Org, including amd64, sparc64 and macppc. During installation, you can install X.Org
    quite easily using xenodm(1), our simplified X11 display manager forked
    from xdm(1).

    ------------------------------------------------------------------------
    - PACKAGES AND PORTS ---------------------------------------------------

    Many third party software applications have been ported to OpenBSD and
    can be installed as pre-compiled binary packages on the various OpenBSD architectures. Please see https://www.openbsd.org/faq/faq15.html for
    more information on working with packages and ports.

    Note: a few popular ports, e.g., NSD, Unbound, and several X
    applications, come standard with OpenBSD and do not need to be installed separately.

    ------------------------------------------------------------------------
    - SYSTEM SOURCE CODE ---------------------------------------------------

    The source code for all four subsystems can be found in the
    pub/OpenBSD/7.6/ directory:

    xenocara.tar.gz ports.tar.gz src.tar.gz sys.tar.gz

    The README (https://ftp.OpenBSD.org/pub/OpenBSD/7.6/README) file
    explains how to deal with these source files.

    ------------------------------------------------------------------------
    - THANKS ---------------------------------------------------------------

    Ports tree and package building by Jeremie Courreges-Anglas,
    Visa Hankala, Stuart Henderson, Peter Hessler, George Koehler,
    Kurt Mosiejczuk, and Christian Weisgerber. Base and X system builds by
    Kenji Aoyama, Theo de Raadt, and Miod Vallat. Release art by
    Sue Doeksen.

    We would like to thank all of the people who sent in bug reports, bug
    fixes, donation cheques, and hardware that we use. We would also like
    to thank those who bought our previous CD sets. Those who did not
    support us financially have still helped us with our goal of improving
    the quality of the software.

    Our developers are:

    Aaron Bieber, Adam Wolk, Aisha Tammy, Alexander Bluhm,
    Alexander Hall, Alexandr Nedvedicky, Alexandr Shadchin,
    Alexandre Ratchov, Andrew Fresh, Anil Madhavapeddy,
    Anthony J. Bentley, Antoine Jacoutot, Anton Lindqvist, Asou Masato,
    Ayaka Koshibe, Benoit Lecocq, Bjorn Ketelaars, Bob Beck,
    Brandon Mercer, Brent Cook, Brian Callahan, Bryan Steele,
    Can Erkin Acar, Caspar Schutijser, Charlene Wendling,
    Charles Longeau, Chris Cappuccio, Christian Weisgerber,
    Christopher Zimmermann, Claudio Jeker, Dale Rahn, Damien Miller,
    Daniel Dickman, Daniel Jakots, Darren Tucker, Dave Voutila,
    David Coppa, David Gwynne, David Hill, Denis Fondras, Edd Barrett,
    Eric Faurot, Florian Obser, Florian Riehm, Frederic Cambus,
    George Koehler, Gerhard Roth, Giannis Tsaraias, Gilles Chehade,
    Giovanni Bechis, Gleydson Soares, Gonzalo L. Rodriguez, Greg Steuck,
    Helg Bredow, Henning Brauer, Ian Darwin, Ian Sutton, Igor Sobrado,
    Ingo Feinerer, Ingo Schwarze, Inoguchi Kinichiro, James Hastings,
    James Turner, Jan Klemkow, Jason McIntyre,
    Jasper Lievisse Adriaanse, Jeremie Courreges-Anglas, Jeremy Evans,
    Job Snijders, Joel Sing, Joerg Jung, Jonathan Armani, Jonathan Gray,
    Jonathan Matthew, Jordan Hargrave, Josh Rickmar, Joshua Sing,
    Joshua Stein, Juan Francisco Cantero Hurtado, Kazuya Goda,
    Kenji Aoyama, Kenneth R Westerback, Kent R. Spillner, Kevin Lo,
    Kirill Bychkov, Klemens Nanni, Kurt Miller, Kurt Mosiejczuk,
    Landry Breuil, Lawrence Teo, Lucas Gabriel Vuotto, Lucas Raab,
    Marcus Glocker, Mark Kettenis, Mark Lumsden, Markus Friedl,
    Martijn van Duren, Martin Natano, Martin Pieuchot, Martin Reindl,
    Martynas Venckus, Matthew Dempsky, Matthias Kilian, Matthieu Herrb,
    Michael Mikonos, Mike Belopuhov, Mike Larkin, Miod Vallat,
    Moritz Buhl, Nam Nguyen, Nayden Markatchev, Nicholas Marriott,
    Nigel Taylor, Okan Demirmen, Omar Polo, Ori Bernstein,
    Otto Moerbeek, Paco Esteban, Pamela Mosiejczuk, Pascal Stumpf,
    Patrick Wildt, Paul Irofti, Pavel Korovin, Peter Hessler,
    Philip Guenther, Pierre-Emmanuel Andre, Pratik Vyas,
    Rafael Sadowski, Rafael Zalamena, Raphael Graf, Remi Locherer,
    Remi Pointel, Renato Westphal, Ricardo Mestre, Richard Procter,
    Rob Pierce, Robert Nagy, Sasano Takayoshi, Scott Soule Cheloha,
    Sebastian Benoit, Sebastian Reitenbach, Sebastien Marie,
    Solene Rapenne, Stefan Fritsch, Stefan Hagen, Stefan Kempf,
    Stefan Sperling, Steven Mestdagh, Stuart Cassoff, Stuart Henderson,
    Sunil Nimmagadda, T.J. Townsend, Ted Unangst, Theo Buehler,
    Theo de Raadt, Thomas Frohwein, Tim van der Molen, Tobias Heider,
    Tobias Stoeckmann, Todd C. Miller, Todd Mortimer, Tom Cosgrove,
    Tracey Emery, Ulf Brosziewski, Uwe Stuehler, Vadim Zhukov,
    Vincent Gross, Visa Hankala, Vitaliy Makkoveev, Volker Schlecht,
    Yasuoka Masahiko, Yojiro Uo

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)