FreeBSD OpenSSH Hole?

http://article.gmane.org/gmane.os.openbsd.tech/35731

by conformal • 12 years ago

50 12 12 years ago

article.gmane.org

Demiurge2• 12 years ago

Sometimes I feel a bit sorry for them (and for him), but then the next minute I don't feel sorry because there's damn good reasons they won't be told about what I found.

This is hard to believe, is this the leader of the OpenBSD project saying he won't tell anyone at FreeBSD if he finds a hole that affects every FreeBSD installation? Or am I misunderstanding that message?

jnbiche• 12 years ago

Yeah, what is the world is this about? Can anyone clue us in?

matthewmacleod• 12 years ago

Pretty straightforward — Theo De Raadt is quite a well-known "controversial" character, and he's pretty blunt with it, too. Remember, he's the guy who was punted from NetBSD for "[a] long history of rudeness towards and abuse of users and developers," and the guy who Linus Torvards described as "difficult."

He's also an astoundingly capable, effective and security-focused developer. This means that there's probably a hole in the FreeBSD distribution of OpenSSH that he's aware of any has not disclosed. Dickish behaviour, but that's his MO, so there's little to be surprised about.

aspidistra• 12 years ago

Here's some previous, from de Raadt, Dec 2013:

"Basically, it is 10 years of FreeBSD stupidity. They don't know a thing about security. They even ignore relevant research in all fields, not just from us, but from everyone."

http://www.itwire.com/business-it-news/open-source/62641-cry...

Demiurge2• 12 years ago

He might think they're stupid, that's not hard to believe. What's hard to believe is that he's altruistic enough to work on a huge open source project, but not enough to inform someone else of a hole that would affect a lot of people.

Sprint• 12 years ago

No, just someone crumpy about lack of funding.

pyvpx• 12 years ago

yeah, I'd be grumpy too if everyone uses your SSH implementation and can't even be arse'd to buy a friggin' CD or a t-shirt...then pooh-pooh the entire OpenBSD project, probably over that very SSH implementation.

don't let reality hurt your tender sensibilities ;)

pvg• 12 years ago

Context-free mailing list drama (starring Theo de Raadt)? Seems perfectly flagworthy.

jlgaddis• 12 years ago

See this e-mail from Bob Beck (of the OpenBSD Foundation):

http://article.gmane.org/gmane.os.openbsd.tech/35728

There is no security hole, he says.

roeme• 12 years ago

This mail dates earlier than the OP linked. See http://thread.gmane.org/gmane.os.openbsd.tech/35722/ for a threaded view.

icantthinkofone• 12 years ago

Theo is Sloppy Mo: https://www.youtube.com/watch?v=MnXZB9SkS44

FreeBSD OpenSSH Hole?

Related Stories