Theo de Raadt on OpenSSL vulnerabilities coming on the 19th

http://marc.info/?l=openbsd-misc&m=142654095813320&w=2

by bootload • 11 years ago

202 66 11 years ago

rikkus• 11 years ago

Not sure what he's saying. That the OpenSSL group are going to send the LibreSSL group vulnerabilities? That the LibreSSL group are about to disclose OpenSSL vulnerabilities? Just a bit confused!

Okay, a later story just appeared, I quote:

  "This or earlier LibreSSL releases may also address issues that are to be revealed
  by The OpenSSL Project Team on the 19th of March, 2015."

This story is probably redundant now, then.

tomaac• 11 years ago

He is referring to https://mta.openssl.org/pipermail/openssl-announce/2015-Marc...

bootload• 11 years ago

"This story is probably redundant now, then."

given obsd has/is doing a post heartbleed code review on OpenSSL since April 2014 to build LibreSSL [0] is it wise to assume this?

[0] http://arstechnica.com/information-technology/2014/04/openss...

noir_lord2• 11 years ago

The OpenSSL group do not tell the LibreSSL group about vulnerabilities that they are fixing in upcoming releases.
Why? Well, they just don't. That's the whole story.

Then the story sucks, security of core components underlying the internet is bigger than any one group.

Respect for end users would indicate that a simple heads up of a high severity bug to someone on the LibreSSL team would be the way to go.

detaro3• 11 years ago

Well, according to (also unsourced, so no clue what the "real" story is) comments on the sister submisson [1] it is because LibreSSL doesn't want to take part in the embargo on reported vulnerabilities.

[1] https://news.ycombinator.com/item?id=9216815

noir_lord2• 11 years ago

In which case and assuming that is accurate then

Why? Well, they just don't. That's the whole story.

Could have been

Why? Well, we'd have liked to but they don't embargo reported bugs and we do.

Clearer for everyone.

Assuming it's true.

Bluerise• 11 years ago

That is true. OpenBSD/Theo refuses to take part in embargos, which means they don't get a heads up. Don't have a citation right now, but Theo said that publicly when Hardbleed or so happened.

alecco3• 11 years ago

That's because they patch within a couple of days and don't want their systems unpatched for long (30 to 60 days!) when there is a known issue out in the wild. The flaws tend to get leaked, the temptation is big because there are huge money incentives.

I bet if the embargo were for 5 days they would reconsider. But good luck with that with members like Microsoft, Cisco, Oracle, which a terrible reputation of postponing things the maximum possible.

raverbashing• 11 years ago

Yeah, but based on the work of the LibreSSL team http://opensslrampage.org/ I wouldn't use OpenSSL for anything else if possible

themartorana• 11 years ago

OpenBSD's scorched earth policy regarding OpenSSL is so anti-community it's ridiculous. OpenSSL served the entire internet for years. I'm happy that it's been forked - nice that could even happen at all - and some of the cruft responsible for the recent flood of exploits will be fixed/removed, but the hate just seems petty.

rlpb3• 11 years ago

> Why? Well, they just don't. That's the whole story.

It's not the whole story. Here's the whole story:

http://lwn.net/Articles/601958/

"As it turns out, de Raadt had been asked if he wanted to join the distros list back in early May."

"[de Raadt:] So I'll decline."

alecco3• 11 years ago

Way to cherry pick of a cherry picking. Theo meant he has no time to join yet another mailing list where OpenSSL security issues are very likely way less an 1% of the messages. Also, it's a Linux mailing list and he maintains a BSD distro, not much in common. I remember back in 98 he said he processed about 2500 emails a day (using a custom set of emacs macros). "I'm more an email processing system than a developer, sigh" (paraphrasing)

Why can't OpenSSL have an simple early warning list like most other major software packages. It's only adding one CC field.

forgottenpass• 11 years ago

This argument has always bugged me. Even if the mailing list was openssl-private-security-announce-embargoed (which it isn't), shouldn't openssl still attempt to identify and notify the large downstream consumers of openssl even if they're not on the list?

This mailing list conversation sounds like a cartoon bureaucrat saying "Well, I'd LOVE to help you, but you didn't tick checkbox 16-A on your X-23 form last week."

bdg• 11 years ago

Theo has a reputation for this attitude. He's not entirely unlike Linus in that he's brilliant and people don't want to deal with him.

some_furry• 11 years ago

If the fix is already committed for any of the vulnerabilities, then the answer is a simple github search away:

https://github.com/openssl/openssl/compare/OpenSSL_1_0_1l......

https://github.com/openssl/openssl/compare/OpenSSL_1_0_2...O...

Some interesting commits:

https://github.com/openssl/openssl/commit/327de270d583e716bc...

https://github.com/openssl/openssl/commit/f5ee5213073870493a...

https://github.com/openssl/openssl/commit/51527f1e3564f210e9...

cjg_• 11 years ago

It is weird, two of them (CVE-2015-0288 and CVE-2015-0209) are listed here also with links to patches, https://security-tracker.debian.org/tracker/source-package/o... Why have embargo on the vulnerabilities if you publish patches anyway? Which makes me think that the patches has not been committed yet and that the embargoed are different ones than these.

geeknik• 11 years ago

I found an OpenSSL bug that was assigned CVE-2015-0208 and it is still embargoed near as I can tell.

onestone• 11 years ago

The situation seems to have changed (core LibreSSL developers have now had disclosure from OpenSSL):

http://marc.info/?l=openbsd-misc&m=142660009729096&w=2

kriro• 11 years ago

I can't say I feel comfortable with an announcement of "there's a vulnarability ranked high but we won't patch it until the 19th". I get why they do it that way and I prefer this announcement to nothing but it's still somewhat unsettling.

They obviously know a lot more about security than I do so I'll live with that decision.

TomMasz• 11 years ago

It's less than ideal but the obvious remediation is to update OpenSSL. Of course, if there are any other remediations it would be nice to know about them sooner. I know I'll have customers bugging me before Thursday.

tomjen32• 11 years ago

Oh great, egos is programming leading to worse security situations for everybody.

Yeah Theo they made a fork of your code because it was insecure - that doesn't mean you should hope for them to fail just so you can say "they had a bug too".

shiggerino• 11 years ago

Who exactly made a fork of Theo's code?

Also, I don't see how you can read any ill intent out of the email alone. It shouldn't be unreasonable for the OpenSSL devs to share vulnerabilities with LibreSSL. I don't think he would use it for any malicious purposes. Though I guess it makes you want to err on the side of caution when he comes up with such classics as declaring Apache 2.0 proprietary for no other reason that it has more lines of text than the previous version.

jdiez17• 11 years ago

I'd think tomjen3 meant "Yeah Theo made a fork of (...)" instead of "Yeah Theo they". Looks like he originally wrote "Yeah they made a fork (...)", then he rephrased and forgot to delete the "they".

Theo de Raadt on OpenSSL vulnerabilities coming on the 19th

Related Stories