OpenBSD and the latest OpenSSL bugs [LWN.net]

OpenBSD and the latest OpenSSL bugs

Posted Jun 12, 2014 3:24 UTC (Thu) by flewellyn (subscriber, #5047)
Parent article: OpenBSD and the latest OpenSSL bugs

I'm torn on this. On the one hand, it's really not okay for OpenSSL to have one special mailing list that they use to disclose vulnerabilities, especially when that mailing list is not obvious by its title and membership. I seem to recall the OpenSSL project having some other issues with communication in that regard, along the lines of "No, you silly, the listed email address for contacting us may be contact@openssl.org, but everybody knows that the REAL one that we read is actually someotheraddress@openssl.org!"

Or something like that. That kind of ad hoc organization obviously infects their codebase as much as their org itself, and that's not a good thing at all, especially for a security-focused project as critical as this one. OpenSSL doesn't have a good track record for communicating, or for that matter knowing what they are doing, if the LibreSSL commit logs are anything to go by.

On the other hand, wow, Theo does not merely burn his bridges, he nukes them from orbit. And sure, meritocracy, sure, show me the code first, sure, he still does great work...there's just a point at which behaving in such a hostile and unpredictable fashion towards others is going to start hurting your project, if you act like this. Especially if you are the project leader.

to post comments

OpenBSD and the latest OpenSSL bugs

Posted Jun 12, 2014 6:55 UTC (Thu) by nim-nim (subscriber, #34454) [Link] (3 responses)

The list does not seem to be a special openssl list, nor is it hosted @openssl, they seem to have done the right thing and use a common general-purpose security list instead of sprouting their own.

Unless I'm missing something.

OpenBSD and the latest OpenSSL bugs

Posted Jun 13, 2014 0:39 UTC (Fri) by misc (subscriber, #73730) [Link] (2 responses)

No it is not only for openssl. That's for various vendors, to organize big updates. The idea of embargo is a often debated one, but so far, it seems to work fine in practice. The list access is controlled, and you kinda have to show you are responsible of a product/distro security to be there.

And having a few weeks to work on the patch bring some benefit in term of testing, etc. For example, the first patches for openssl were indeed wrong and were corrected by Canonical and Red Hat, so we can see the power of collaboration. In turn, it avoid the rush of having to update twice in a row ( openssh 3.6 for example ). And funnily enough, openssh 5.0 release note do ask for responsible disclosure ( http://www.openssh.com/txt/release-5.0 ) due to a CVE found just after the 4.9 release. As they request the use of a private mailing list, I guess the team behind openssh have a more nuanced view on what is exactly "responsible disclosure" than Theo who seems to want to commit and release.

OpenBSD and the latest OpenSSL bugs

Posted Jun 13, 2014 1:20 UTC (Fri) by viro (subscriber, #7872) [Link] (1 responses)

You seem to use some strange definition of "to work fine". vendor-sec embargo rules are disgrace and quite a few of us flat-out refuse to have anything to do with that mess due to a _long_ history of deliberate abuse of said rules by PR-seeking wankstains^W^Wconscious security researchers. More often than not, v-s embargo is nothing but press release coordination, with the only goal being to drum up the publicity for something very overblown.

I unsubscribed from that FPOS after particularly egregious example of that sort (too long to retell and I doubt that I could stay anywhere near printable if I tried). No idea when Linus had decided that he had enough, but he's not there either, AFAIK - due to the same embargo policy. And no, it didn't get better since then - see e.g. the clusterfuck with enormous spew of trivial "fixes" in X libraries, oversold to hell and back _and_ actually broken and insufficiently reviewed exactly due to the embargo. Security by press release has a lot in common with science by press release; for more details ask the "arsenic DNA" crowd, or "Darwinius masillae" one, or...

OpenBSD and the latest OpenSSL bugs

Posted Jun 21, 2014 23:59 UTC (Sat) by BenHutchings (subscriber, #37955) [Link]

vendor-sec has been dead for years. I think the newer mailing lists (distros@ and linux-distros@vs.openwall.org) have more limited embargo periods (max. 19 days), though I'm not sure what the limit was for vendor-sec.

OpenBSD and the latest OpenSSL bugs

Posted Jun 12, 2014 13:22 UTC (Thu) by khim (subscriber, #9252) [Link] (2 responses)

The whole thing is just ridiculous. As Theo admitted himself when they find a security problem they just “commit and publish” which means that the whole world is forced to rush and apply patches in hurry without any advance warning. But when OpenBSD is treated in the same vein it's somehow a problem? Why? Is it because they treated differently? Sure, they are treated differently, but that's because the rules they apply to everyone are applied to OpenBSD! Payback is bitch, sure, but why complain about the situation you've created in the first place? Why anyone should offer you “early notice” when you categorically refuse to do the same for others?

OpenBSD and the latest OpenSSL bugs

Posted Jun 12, 2014 22:46 UTC (Thu) by rahvin (guest, #16953) [Link] (1 responses)

His annoyance is easy to identify IMO if you've followed the whole LibreSSL thing. He's been trying to use libressl as a fundraising drive for OBSD. This ties into his comment about being paid to read the security list.

Now because he didn't want to participate in the openSSL community and wanted to fork it for the financial benefits he's caught off guard by a security issue everyone else new about and he's concerned it could impact his fundraising via LibreSSL so he throws his typical hissyfit and blames everyone else.

This is the work he created for himself when he forked it. If he wasn't willing to make that work commitment he made a mistake. Don't think for minute this won't happen again. And the beauty of it is at some point down the road when he's fully forked the project there will be some issue found that's still in his code base that will bite him on the ass then as well and he'll still probably try to blame everyone else.

OpenBSD and the latest OpenSSL bugs

Posted Jun 13, 2014 0:28 UTC (Fri) by misc (subscriber, #73730) [Link]

Well, they indeed doesn't hide it :
http://www.openbsd.org/papers/bsdcan14-libressl/mgp00033....