Undisclosed hole in openssh on FreeBSD and Juniper?

http://thread.gmane.org/gmane.os.openbsd.tech/35722/focus=35731

by Xylakant • 12 years ago

48 46 12 years ago

thread.gmane.org

roeme• 12 years ago

Dupe.

Previously: https://news.ycombinator.com/item?id=7568059

willvarfar3• 12 years ago

If I parse Theo correctly, he clearly says that FreeBSD does have a hole.

Its really really hard to imagine he is lying.

fabulist5• 12 years ago

I'm guessing it is of modest severity, if they even feel they can _get away_ with keeping it to themselves. But its still deeply troubling.

davorb• 12 years ago

Please ask Kirk McKusick, he knows the story about why this is not being disclosed to FreeBSD

Could someone please explain this?

Xylakant3• 12 years ago

I'd be curious as well.

fabulist5• 12 years ago

What good reason could their possibly be for not disclosing a hole to FreeBSD? Especially if it effects networking infrastructure....

1. Government gag order? I'd call this a "good reason", but it wouldn't clear my conscience.

2. Disclosure to or interception by malicious parties? I can't imagine that the best solution would be STO.

Xylakant3• 12 years ago

Government gag order

I can't imagine a government gag order that allows you to publicly hint that there's a problem.

xeroxmalf• 12 years ago

It's not a good reason that they aren't disclosing, it's a personal reason.

willvarfar3• 12 years ago

It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSL consumers - only when they have a fix?

It could be best fixed in OpenSSL itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.

lholden8• 12 years ago

OpenSSH is a SSH client and server provided by the Open BSD Foundation.

OpenSSL is an encryption API maintained by an entirely different group of people.

EDIT: Modified my reply. OpenSSH at some point moved it's "restrictively licenced software" (RSA, DES, etc) out of it's codebase and now depends on OpenSSL according to it's license. http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENC...

asuffield• 12 years ago

I can see that you have not interacted with Theo before. Sometimes these things are just all personality.

fabulist5• 12 years ago

I've not yet had the pleasure, but despite the insight lholden's shared about the contentious relationship between the BSDs, I have a really hard time believing anyone in this industry would be so petty.

Its clear, however, that the only way to get to the bottom of this is to become a big contributor to OpenSSH.

lholden8• 12 years ago

Short Answer: Bitterness.

Long Answer: It's complicated and I do not understand the whole picture myself.

I can however outline two things that likely exasperate the situation.

a) OpenSSH is used by nearly everyone. Nearly every unix-like installation includes a copy of OpenSSH. Most companies which do business on the internet use a unix-like operating system in some way.

The OpenBSD Foundation has had trouble obtaining funding to cover operating costs in the past. Included in these operating costs is support and auditing of OpenSSH.

b) There has been a long and colored history between FreeBSD and OpenBSD. A lot of code and features developed under OpenBSD has been ported over to FreeBSD such as the OpenBSD Packet Filter (PF).

Juniper uses FreeBSD and PF in their routers and have donated in various ways to FreeBSD. For example, Juniper donated three EX3200s with full contracts to FreeBSD for use in their datacenter.

The OpenBSD Foundation on the other hand has not really seen the same support.

nnkh2• 12 years ago

Sure, De Raadt/OpenBSD are bitter about the lack of funding but that does not explain anything about this mysterious hole. This email can mean anything. Does Kirk McKusick know about this hole and has he pressured De Raadt not to disclose it (for what reason could that even be?), or is it a vague reference to a fallout he had with him earlier(making this an absurdly petty reason not to disclose it)?

Just dropping that hint is ambiguous drama baiting.

fabulist5• 12 years ago

Thank you for sharing your insight.

icantthinkofone• 12 years ago

Theo is Sloppy Mo: https://www.youtube.com/watch?v=zKvhVssO348

awakened• 12 years ago

Many years ago, I submitted a bug report to OpenBSD about an issue I had discovered with threads. I received a one line response from Theo. I still have the mail. He wrote:

   "Threads are for idiots."

At the time, I felt discounted and I was upset. I was younger then. Today, I realize what he meant and that he's right.

markild• 12 years ago

I realize what he meant and that he's right.

Could you please expand on this?

bananas3• 12 years ago

I think the rise of async/select based and privilege separated designs tend to suggest that threads don't work well for system programming.

yp_all• 12 years ago

Great story. It is good to know that some programmers do learn over time.

For every 1 story like yours there are probably 10 where someone is still traying to get "revenge" by saying nasty things about you know who.

Those more common stories get replicated through the wires and the end result is that no one cares about programming anymore; they are simply interested in discussing interpersonal relations.

Would you rather have your software written by a foolish programmer who is pleasantly tactful or a competent and conservative one who is tactless?

The answer of course varies depending on what you are really after.

JackC• 12 years ago

Would you rather have your software written by a foolish programmer who is pleasantly tactful or a competent and conservative one who is tactless?

This is a false dichotomy. Interpersonal skills are among the skills necessary to work on a project that involves more than one person. That covers most of the interesting ones. If there's a successful project with someone who lacks those skills, it's because other people are covering for them -- just like a successful project with a foolish programmer. Sometimes that person makes up for it with other things they bring to the table, and that's fine, but don't pretend a weakness is a virtue.

tptacek5• 12 years ago

This is vintage Theo. It has the virtue of sounding correct, but, because OpenBSD ships threaded libraries, it probably lacks the virtue of being correct.

I had a similar experience (note, though: I have a history with Theo, who I know/knew personally).

When I was at Arbor Networks, we shipped appliances that monitored ISP backbones that were based on OpenBSD. An analysis process that happened to allocate a lot of memory would occasionally lose a giant chunk of memory. I was able to produce a reduction of the bug and narrow down where in the VM subsystem the bug was happening, but I wasn't able to recommend a fix. Theo's response, to what was clearly a serious bug in OpenBSD, was "I'm not going to look at UVM; it's just Chuck Cranor's thesis project".

I lobbied for a switch to FreeBSD, but the monkey.org people that ran the place were dyed-in-the-wool for OpenBSD. :)

Flow• 12 years ago

What happened next? Did the bug get fixed? Did you do a work-around somehow? Don't leave stories unfinished like this :)

gypsyharlot• 12 years ago

I don't see how his response was unreasonable.

pvg2• 12 years ago

In the beginning, when Theo was cast out of NetBSD, someone rewrote this thing

http://www.skrause.org/humor/poohgoesapeshit.shtml

with Theo and other BSD-ish personalities as the characters. There are many stories of prickly people mellowing with age. It's unlikely there'll be such a story about him.

egwynn• 12 years ago

This is unsettling, to be sure. If there's anything to this, I'd really love to hear a response from the actual FreeBSD folks.

But it should be noted that this guy has a relatively rocky history with *BSD, and his nearly context-free, ambiguous trash-talking of FreeBSD should be taken with a grain of salt.

jmnicolas• 12 years ago

Why would he say that and not reveal the vulnerability ?

pvg2• 12 years ago

Dupe of https://news.ycombinator.com/item?id=7568059 and still flag button fodder.

Undisclosed hole in openssh on FreeBSD and Juniper?

Related Stories