Hacker News Reader

Comment by mrweasel | Hacker News Reader

The OpenBSD developers are mad that Intel didn't inform them, or any of the other BSDs. Only Microsoft and Linux developers where included in the information that was under embargo. I don't think they're upset that Intel made a mistake, not more so that most others anyway.

View on HN

Don‘t they refuse to honor embargoes? That would be an explanation why they got no information privately.

Here's an LWN article that references Theo's position on embargoes: https://lwn.net/Articles/601958/

This article seems to suggest that of all the BSDs, only OpenBSD / Theo takes this position - at least in in the case of the OpenSSL problems, the others got advance notice and participated in the embargo.

It might be argued that the risk of the exploit making it into the wild would have been higher if the BSDs were notified, on account of the sort of accidental premature disclosure that actually happened. This would appear to be self-serving if stated by the embargo insiders, but it may still be valid, especially if my guesses that a) this problem's biggest potential impact is in cloud computing, and b) there is relatively little use of BSDs in cloud computing, are accurate.

To me, one of the interesting bits there is the accidental timing of a comment.

From https://www.krackattacks.com

> We notified OpenBSD of the vulnerability on 15 July 2017, before CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt replied and critiqued the tentative disclosure deadline: “In the open source world, if a person writes a diff and has to sit on it for a month, that is very discouraging”. Note that I wrote and included a suggested diff for OpenBSD already, and that at the time the tentative disclosure deadline was around the end of August. As a compromise, I allowed them to silently patch the vulnerability. In hindsight this was a bad decision, since others might rediscover the vulnerability by inspecting their silent patch. To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.

Note the date there that de Raadt was commenting on the discouragement of sitting on a fix for a month. What is the likelihood that he would be very discouraged to sit on it for six months? What if it was a three month embargo that changed to a six month embargo - when would the fix be released?

I would assume that those are questions that need to be asked prior to notifying a project.

They don't like embargoes but they don't go out of their way to break them. The only embargo I know of that OpenBSD broke was for OpenSSL, and that was an honest mistake, as explained here: https://www.tedunangst.com/flak/post/regarding-embargoes

There was another "incident" with the KRAK embargo, where OpenBSD got permission to silently patch it early and then the researcher who found it regretted giving them permission.

I think people put these two incidents together, combine it with the developers' attitudes towards embargoes and come out with: OpenBSD doesn't honour embargoes!

I guess if they made an explicit statement that they will comply with embargoes going forward, they'll be able to correct the record. But I don't see that that has happened. Lots of egos have to get out of the way, maybe?

They do, they break embargoes and that's why they are now paying the price for it.

This is why embargoes are stupid. Unless you're 'blessed' you get screwed. They only exist to give intangible benefits to large corporations at the expense of everyone else.

It's the technological version of insider trading

I think this is a valid opinion, but it its a bit circular.

'We don't respect embargoes' -> 'Company only releases to individuals who respect embargoes' -> repeat

Reply on news.ycombinator.com