On Sep 25, 2026, at 11:15 AM, Brian Julin <BJulin@clarku.edu> wrote:
Fantastic! Our initial fiddling with v4 on a test server has been very promising. (RadSec not being a blocker for us, actually.)
Yes, there are a lot of people who don't need RadSec. Or at least, don't need it immediately.
I was actually able to use the detach feature to pre-cache AD group and CPPM RBAC attribute lookups while TLS negotiation was still ongoing for a client. Should be a very welcome speed improvement and untangle a bit of unnecessary and cretinous proxy daisy chaining.
Nice! There are a _ton_ of new features in v4 which make it almost magical. Once RadSec is done, it should be trivial to do bizarre things like DNS over TLS. I'm not entirely sure why we'd do that, but it would be trivial to do.
We're looking forward to it very enthusiastically.
Did get one segv, but only when the server was badly misconfigured.
:( If you can report SEGVs, that would help. Even with various static analysis / AI analysis / fuzzers, there are still issues. As an FYI, while many Open Source projects are getting hammered by AI bug reports, we're not. We spent quite a bit of time in February frantically fixing v3 and v4, in expectation of getting flooded with third-party AI reports. The result is that we've received about 10 AI security reports in the last six months. So that's a pretty good track record. Alan DeKok.