> Why? Well, they just don't. That's the whole story.
Then the story sucks, security of core components underlying the internet is bigger than any one group.
Respect for end users would indicate that a simple heads up of a high severity bug to someone on the LibreSSL team would be the way to go.
> Why? Well, they just don't. That's the whole story.
Could have been
> Why? Well, we'd have liked to but they don't embargo reported bugs and we do.
Clearer for everyone.
Assuming it's true.
I bet if the embargo were for 5 days they would reconsider. But good luck with that with members like Microsoft, Cisco, Oracle, which a terrible reputation of postponing things the maximum possible.
Here's a page describing the list in question:
http://oss-security.openwall.org/wiki/mailing-lists/distros
Here's the embargo policy:
> Please note that the maximum acceptable embargo period for issues disclosed to these lists is 14 to 19 days .... In fact, embargo periods shorter than 7 days are preferable.
At least it would minimize the risk of zero-daying LibreSSL users.
... but I guess, this isn't where the problem is?
OpenBSD is making the gamble that either a) they can pressure the adults doing coordinated disclosure to stop doing that via their excellent people skills, or b) that they are so awesome that they can find the problems before everyone else.
NB: I love OpenBSD from a security POV, but that doesn't mean what the leaders of the project do is always correct for security.
Didn't people find traces of hearthbleed attacks that happened months before it was published?
There are good arguments for very short embargo periods, especially if you mostly care about the security of your users. (of course, in a perfect world every vendor would be willing/able to release patches after 24 h or so, and it wouldn't matter, but we don't have one of those...)
It's not the whole story. Here's the whole story:
http://lwn.net/Articles/601958/
"As it turns out, de Raadt had been asked if he wanted to join the distros list back in early May."
"[de Raadt:] So I'll decline."
Why can't OpenSSL have an simple early warning list like most other major software packages. It's only adding one CC field.
He just complains that they don't give him access, when in fact they offered him access.
> Theo meant he has no time to join yet another mailing list where OpenSSL security issues are very likely way less an 1% of the messages.
Is it really that hard to filter for /openssl/i/?
Nevertheless, it should be doable for OpenSSL to also mail LibreSSL; it is a bit of a special case, after all.
The amount of mails sounds like a strange argument to me. I can't imagine that they couldn't find one of the regular consumers of the mailing list willing to pass relevant ones on, assuming it were clear that LibreSSL is an accepted recipient of the information.
That said, I don't expect much in the way of goodwill or willingness to compromise on any side here.
Indeed, this is the main point, OpenBSD developers are proponents of full-disclosure:
http://www.openbsd.org/security.html
This paragraph summarizes it very well:
Security information moves very fast in cracker circles. On the other hand, our experience is that coding and releasing of proper security fixes typically requires about an hour of work -- very fast fix turnaround is possible. Thus we think that full disclosure helps the people who really care about security.
No, you're thinking of linux-distros@. linux-distros@ is where issues that affect Linux only go. distros@ covers issues that are relevant to both BSD and Linux - distros@ membership is FreeBSD+NetBSD+linux-distros@.
This mailing list conversation sounds like a cartoon bureaucrat saying "Well, I'd LOVE to help you, but you didn't tick checkbox 16-A on your X-23 form last week."
My employer repackages Ubuntu into a virtual appliance, but since we're firmly downstream and haven't yet had the time to get deeply involved in upstream security work, we're not allowed on the distros list. (We haven't asked, but the policy is pretty clear.) I think that's pretty fair, even if I personally dislike that end result.
See for instance, the disastrous handling around Shellshock, where no details were given on the distros list, the announcement went public, and it took a few days (in public) for people, mostly people on distros@, to realize that the patch was incomplete and two more patches were needed. It's not clear the distros list worked any better than a public announcement would have.
The other argument is that embargoes always get harder to enforce as you add more people to them. The distros list is the successor of the old vendor-sec list, which was more lenient about membership and always had suspicions of leaks (until someone broke into the mail server....). See, for instance, the messy handling of Heartbleed's embargo:
http://www.theage.com.au/it-pro/security-it/heartbleed-discl...
I think that if there's going to be a private disclosure process at all, it's better that it's bureaucratic instead of friends telling their friends at CloudFlare and Akamai, under the table, that they should patch.
Well, it gave the entire Internet a false sense of security for years, at least.
> …the hate just seems petty.
Have you read some of the cruft that the LibreSSL guys removed? OpenSSL has been a horrid mess. Sometimes you gotta admit that a Yugo is a really, really, really bad car.
So now, the OpenBSD guys come in with their almighty attitude, while they knew about it for years and didn't bother to do anything about it before. No one wanted to do that job before Heartbleed, so yeah, it's really uncalled for to be that rude. We should all be grateful the OpenSSL team did what they did for so long.
PolarSSL (now "mbed TLS") is the best, to the best definition of best.
Still better than OpenSSL, which was known to be fast but insecure and poorly managed, are the stacks used the biggest clients:
* NSS used by Chrome, Mozilla, et al
* GnuTLS used by exim, GNOME, et al.
I think it would have been better had OpenSSL just been straight up fixed rather than forked, but can you legitimately see a way for that to have happened?
To my knowledge, the OpenBSD guys have not hated on the OpenSSL guys in any way, they have hated on the code itself, which was objectively bad code with many latent bugs. Any comments about not knowing how to write secure code resulted from what was produced: insecure code.
Nothing. But no one said anything about removing bad code.
Have you looked at that page? Their comments are extremely rude:
"So the OpenSSL codebase does “get the time, add it as a random seed” in a bunch of places inside the TLS engine, to try to keep entropy high. I wonder if their moto is “If you can’t solve a problem, at least try to do it badly”."
"Old news, but OpenSSL doesn’t give a fuck whether or not memory was freed. It’s all good."
It's hostile, unprofessional, and unnecessary. I understand these kinds of comments in a private IRC channel or something, but publicly ridiculing someone else's software, especially mission critical software that's been used for years across many platforms, is uncalled for.
It really gave me a bad taste for the LibreSSL project, and all just for some petty sniping.
It might be "unprofessional" which is to say, it's not polite (and since they're giving it away - why would it be "professional" -- they're not (necessarily) getting paid for the work) -- but it's not really disproportionately hostile, and most of all, I disagree that it's "unnecessary".
As evidenced in part by recent security issues, and in part by what the libressl project has dug up/cut away: the code base was horrid for the purpose (providing authentication and confidentiality). Much worse than merely "not good".
I think the (rightfully) hostile attitude helps others realize just how bad things were/are. And I welcome it. I'm sure a few developers are hurt by the comments, but all of your quotes above are pretty much factual and concrete: it's not name calling for the sake of being rude; it's a wake-up call. I'd be surprised if not a few "victims" of those comments aren't also glad that errors are both found and pointed out. Just as if you hacked together a not-quite working break system for a car, you'd prefer being called out as a hack, and someone fixing it, rather than having lots of people get hurt. The stakes involving openssl can actually be life or death.
Looking at the long history of openbsd and some similar projects, I think being rude like that is what you do when you're too far on to the spectrum to effectively articulate an argument. It probably has something to do with lack of empathy as well... There are very real reasons why their project and user base is the size it is.
No, being direct is what you do if it's important. I agree that the above quotes aren't polite, but I don't think they're terribly rude. If I publish half-assed code that is hopelessly structured (even if there are reasons for it; "There's too much old cruft", "I don't have time to ...") -- I wouldn't mind getting called on my bullshit. If you suck, and someone point out to you, that you do, in fact suck -- then you should thank that someone.
Sure, it might be nicer if they're polite about it -- but it's really not that big of a deal.
But those who follow the commits know that the developers like to express their minds in the commit messages whether it is bad code written by one of them or somebody else. They're not targetting and publicly shaming some project while throwing insults straight at developers.
Would you have known that parts of the OpenSSL code base was so badly (and unprofessionally ) implemented if the OpenBSD developers hadn't been somewhat aggressive?
Well I guess you do what's normal when you think someone is being unprofessional: stop buying their products and stop doing business with them.
Oh wait...