Undisclosed hole in openssh on FreeBSD and Juniper?
thread.gmane.org
thread.gmane.org
"Threads are for idiots."
Could you please expand on this?
I'm not suggesting they are sounder but I'm suggesting that async designs are simpler and simplicity rules when it comes to safety. sync designs tend to evolve into complexity over time to maintain performance (IIS for example which is a behemoth of threaded privsep pain).
And in my experience (so totally an anecdote and I accept that), it's not easier to privsep a synchronous program. On top of the IPC concerns of isolation, you still have all the problems associated with threading. It's just pain.
(I've written a fair number of both types of systems - none open source unfortunately)
For every 1 story like yours there are probably 10 where someone is still traying to get "revenge" by saying nasty things about you know who.
Those more common stories get replicated through the wires and the end result is that no one cares about programming anymore; they are simply interested in discussing interpersonal relations.
Would you rather have your software written by a foolish programmer who is pleasantly tactful or a competent and conservative one who is tactless?
The answer of course varies depending on what you are really after.
This is a false dichotomy. Interpersonal skills are among the skills necessary to work on a project that involves more than one person. That covers most of the interesting ones. If there's a successful project with someone who lacks those skills, it's because other people are covering for them -- just like a successful project with a foolish programmer. Sometimes that person makes up for it with other things they bring to the table, and that's fine, but don't pretend a weakness is a virtue.
I had a similar experience (note, though: I have a history with Theo, who I know/knew personally).
When I was at Arbor Networks, we shipped appliances that monitored ISP backbones that were based on OpenBSD. An analysis process that happened to allocate a lot of memory would occasionally lose a giant chunk of memory. I was able to produce a reduction of the bug and narrow down where in the VM subsystem the bug was happening, but I wasn't able to recommend a fix. Theo's response, to what was clearly a serious bug in OpenBSD, was "I'm not going to look at UVM; it's just Chuck Cranor's thesis project".
I lobbied for a switch to FreeBSD, but the monkey.org people that ran the place were dyed-in-the-wool for OpenBSD. :)
That being said, thats a petty and ridiculous reason not to deal with someone's code. This gentleman strikes be as a builder, not a maintainer; someone who wants to breeze through town like a cowboy, bring cool ideas to fruition, and move on to the next conquest while someone else keeps the system from falling apart. Thats not a judgment, we need people like that, but they probably shouldn't be the ones fielding emails.
http://www.skrause.org/humor/poohgoesapeshit.shtml
with Theo and other BSD-ish personalities as the characters. There are many stories of prickly people mellowing with age. It's unlikely there'll be such a story about him.
Could someone please explain this?
1. Government gag order? I'd call this a "good reason", but it wouldn't clear my conscience.
2. Disclosure to or interception by malicious parties? I can't imagine that the best solution would be STO.
I can't imagine a government gag order that allows you to publicly hint that there's a problem.
It could be best fixed in OpenSSL itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.
OpenSSL is an encryption API maintained by an entirely different group of people.
EDIT: Modified my reply. OpenSSH at some point moved it's "restrictively licenced software" (RSA, DES, etc) out of it's codebase and now depends on OpenSSL according to it's license. http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENC...
It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSH consumers - only when they have a fix?
It could be best fixed in OpenSSH itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.
DSA I believe is still patent encumbered.
NIST made the DSA patent available worldwide royalty-free. In fact, DSA was unencumbered by patents before RSA, which is why SSH version 2 incorporated it.
I want to say that I would have done the same thing. At the same time though... doing so with a security application assumes that the team supporting the software you depend on is competent enough to properly audit and test their code.
I have a feeling that OpenSSL will be leaving a bad taste in peoples mouths for a while. :/
Its clear, however, that the only way to get to the bottom of this is to become a big contributor to OpenSSH.
Long Answer: It's complicated and I do not understand the whole picture myself.
I can however outline two things that likely exasperate the situation.
a) OpenSSH is used by nearly everyone. Nearly every unix-like installation includes a copy of OpenSSH. Most companies which do business on the internet use a unix-like operating system in some way.
The OpenBSD Foundation has had trouble obtaining funding to cover operating costs in the past. Included in these operating costs is support and auditing of OpenSSH.
b) There has been a long and colored history between FreeBSD and OpenBSD. A lot of code and features developed under OpenBSD has been ported over to FreeBSD such as the OpenBSD Packet Filter (PF).
Juniper uses FreeBSD and PF in their routers and have donated in various ways to FreeBSD. For example, Juniper donated three EX3200s with full contracts to FreeBSD for use in their datacenter.
The OpenBSD Foundation on the other hand has not really seen the same support.
Just dropping that hint is ambiguous drama baiting.
I have a feeling it has less to do with something sinister, and more to do with Theo's very vocal stance on the security situation in FreeBSD.
http://www.itwire.com/business-it-news/open-source/62641-cry...
Most likely the FreeBSD kernel or libraries are doing something in a certain way that Theo finds insecure/insufficient. (Justified or not)
It really does seem like De Raadt's just being really petty to me. But if this is an actual hole and he doesn't want to say what it is, that is worrisome. Doesn't he insinuate the rest of FreeBSD does not know about the hole?
It's possible that he knows of a real exploitable problem.
It's possible that he is trying to boast about his prowess with things "security".
It's possible the "hole" is a design feature in FreeBSD that he just doesn't like. (And hence, considers to be a security problem.)
It's possible that he is bitter that FreeBSD has gotten more attention than OpenBSD.
It's possible that he said it to spur FreeBSD take more interest in security. (Justifiably or not...)
It's possible that he wanted to cause a commotion.
It's possible that more than one of the above is true. :) He is under no obligation to make a disclosure of an exploit that he finds. Does it make him a bad net-denizen? Perhaps. But it's his prerogative.
Previously: https://news.ycombinator.com/item?id=7568059
Its really really hard to imagine he is lying.
But it should be noted that this guy has a relatively rocky history with *BSD, and his nearly context-free, ambiguous trash-talking of FreeBSD should be taken with a grain of salt.