Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

15 years later: remote code execution in qmail

qualys.com

Post reply on HN
Print view View original

41–50 of 164 posts

Re: 15 years later: remote code execution in qmail

#41

Post by SmallPeePeeMan »

linsomniac wrote: post #35
jedberg wrote: post #24

DJB makes great code, but it always leaves a sour taste to use his code, because he has such a big ego and refuses to admit when he makes a mistake. He can't admit that it's possible to be the best but still make mistakes. I really hate supporting that.

I once was talking to one of the household-name DNS guys and asked what he thought about djbdns and he said something along the lines of: "It's unfortunate that he's so abrasive, because he has some really great ideas that nobody will listen to because of it." I've more recently come a little bit to terms with this whole abrasive thing being a brain chemistry artifact, and not just being an asshole for assholes sake.…

> Not to excuse it, but to understand it.

Indeed. I don’t have to abide such people, and neither do you. Now if he had found a cure for cancer, would we have more tolerance?

Re: 15 years later: remote code execution in qmail

#42

Post by koheripbal »

dullgiulio wrote: post #10
DominoTree wrote: post #6

Serious question: Was there a legitimate reason they didn't patch this stuff when it was first discovered?

It's not "they", it's Daniel J. Bernstein. That's the reason :) (If you don't know: he is a top cryptographer that can amazingly correct code. However, he also has a very big ego...)

I don't understand. Most people with a big ego would not want a critical vulnerability associated with them. Can you elaborate?

Re: 15 years later: remote code execution in qmail

#43

Post by chasil »

kstrauser wrote: post #32
asveikau wrote: post #26

Earlier quoted context omitted.

I could see an argument (similar to for assert()) to omit such a check in most production builds. Maybe you could enable it for a small amount of hosts, so that if it does happen with any frequency, somebody sees it somewhere. But not every "unthinkable" case being reached represents a security problem as it does in this case. So in the general case of how to approach such assert-type checks, an abort might take down…

I didn't downvote you and I interpreted your comment the way you said you meant it. I do happen to disagree, though. For a project in a space that's notoriously vulnerability prone - I mean, when it was released it was competing with Sendmail - it seems very reasonably cautious to pepper the code with panic handlers in "impossible" places. They won't slow the code down any because they should never be evaluated, but…

Solaris also notably bundles 32-bit binaries for most everything in /bin with 64-bit distributions, and that begins to look like a wise choice.

I recently observed that SmartOS does the same.

Re: 15 years later: remote code execution in qmail

#44

Post by loeg »

koheripbal wrote: post #42
dullgiulio wrote: post #10

Earlier quoted context omitted.

It's not "they", it's Daniel J. Bernstein. That's the reason :) (If you don't know: he is a top cryptographer that can amazingly correct code. However, he also has a very big ego...)

I don't understand. Most people with a big ego would not want a critical vulnerability associated with them. Can you elaborate?

His ego has transcended objective reality and he claimed (in 2005, and continues to claim in 2020) it isn't a vulnerability.

Re: 15 years later: remote code execution in qmail

#45

Post by loeg »

allover wrote: post #15
friday99 wrote: post #13

Earlier quoted context omitted.

Yeah, it was denied. About our new discovery, Daniel J. Bernstein issues the following statement: "https://cr.yp.to/qmail/guarantee.html has for many years mentioned qmail's assumption that allocated array lengths fit comfortably into 32 bits. I run each qmail service under softlimit -m12345678, and I recommend the same for other installations." And from his "guarantee" In May 2005, Georgi Guninski claimed that some…

So the app is vulnerable by default, yet the author is claiming this doesn't matter, because he instructs how to run it in a safe way? Correct, or am I oversimplifying/missing something?

Correct.

Re: 15 years later: remote code execution in qmail

#46

Post by vinay_ys »

dullgiulio wrote: post #10
DominoTree wrote: post #6

Serious question: Was there a legitimate reason they didn't patch this stuff when it was first discovered?

It's not "they", it's Daniel J. Bernstein. That's the reason :) (If you don't know: he is a top cryptographer that can amazingly correct code. However, he also has a very big ego...)

http://cr.yp.to/talks/2007.11.02/slides.pdf I don't see ego in these slides. I see a brilliant programmer acknowledging his mistakes and learning from them. I really enjoyed running qmail in early 2000s and following djb's crypto work later. He is brilliant indeed.

Re: 15 years later: remote code execution in qmail

#48

Post by davidu »

dsl wrote: post #39
arbitrage wrote: post #23

Earlier quoted context omitted.

The original qMail author, Dan Berstein (DJB) was so convinced of the infallibility of his code that he put up a monetary reward for any exploits. This context came about because DJB, as a professor of Computer Science, maintained that it is completely within the realm of reality to write unbuggy, yet complicated and highly functional code. DJB welched on every claim at that bounty, and refused to pay out. He is an e…

DJB paid out $1,000 in 2009 to Matthew Dempsky for a djbdns security vulnerability. https://marc.info/?l=djbdns&m=123613000920446&w=2

I used to work with Matthew. He's next level smart, and very modest. We are very lucky he is a good hacker and not an evil hacker. :-)

Re: 15 years later: remote code execution in qmail

#49

Post by ergothus »

linsomniac wrote: post #35
jedberg wrote: post #24

DJB makes great code, but it always leaves a sour taste to use his code, because he has such a big ego and refuses to admit when he makes a mistake. He can't admit that it's possible to be the best but still make mistakes. I really hate supporting that.

I once was talking to one of the household-name DNS guys and asked what he thought about djbdns and he said something along the lines of: "It's unfortunate that he's so abrasive, because he has some really great ideas that nobody will listen to because of it." I've more recently come a little bit to terms with this whole abrasive thing being a brain chemistry artifact, and not just being an asshole for assholes sake.…

I'm not a psychologist so I should probably shut up, but I'll continue:

It seems like it does hit the tech field more often, yet overwhelmingly I see leading people in tech get softer, more empathetic, and more open to outside ideas the longer they work and the more experience they gain.

Perhaps this is selection bias (the people I see are the "popular" ones, so of course they are the ones with more social awareness), or perhaps there is no hard and fast "genius requires ego". Note: I'm aware you didn't say that it did, you only mentioned that abrasive-ness seems disproportionately frequent in the tech field.

I'm all for improving our understanding and ways of communication - I've definitely known people in the "asshole" category that were surprised and bothered to discover that was how they came across - but I'm not interested in normalizing abuse as a necessary cost. Which, again, you didn't say nor imply, but the concepts are related to what you've brought up, so I mention it here because the topic is interesting, not as a counterpoint.

Re: 15 years later: remote code execution in qmail

#50

Post by jacquesm »

tom_mellior wrote: post #28
dsr_ wrote: post #16

Earlier quoted context omitted.

Nothing, per se. But they don't set up softlimits or message size limits by default, both of which you should definitely do... it's just that the values you put in are specific to your situation.

If you have DJB's ego yelling at you that the default configuration is safe, why would you bother setting limits to fix it?

Because you care more about the users than about DJB's ego.
Post reply on HN