Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Undisclosed hole in openssh on FreeBSD and Juniper?

thread.gmane.org

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Undisclosed hole in openssh on FreeBSD and Juniper?

#21

Post by lholden »

willvarfar wrote: post #16
lholden wrote: post #15

Earlier quoted context omitted.

OpenSSH is a SSH client and server provided by the Open BSD Foundation. OpenSSL is an encryption API maintained by an entirely different group of people. EDIT: Modified my reply. OpenSSH at some point moved it's "restrictively licenced software" (RSA, DES, etc) out of it's codebase and now depends on OpenSSL according to it's license. http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENC...

Quite right, my typo, and if I could still 'edit' my post I'd correct it. I meant OpenSSH: It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSH consumers - only when they have a fix? It could be best fixed in OpenSSH itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.

No worries. My reply turned out ot be not entirely correct either so :D

Re: Undisclosed hole in openssh on FreeBSD and Juniper?

#22

Post by lholden »

nnkh wrote: post #20
lholden wrote: post #19

Earlier quoted context omitted.

Short Answer: Bitterness. Long Answer: It's complicated and I do not understand the whole picture myself. I can however outline two things that likely exasperate the situation. a) OpenSSH is used by nearly everyone. Nearly every unix-like installation includes a copy of OpenSSH. Most companies which do business on the internet use a unix-like operating system in some way. The OpenBSD Foundation has had trouble obtain…

Sure, De Raadt/OpenBSD are bitter about the lack of funding but that does not explain anything about this mysterious hole. This email can mean anything. Does Kirk McKusick know about this hole and has he pressured De Raadt not to disclose it (for what reason could that even be?), or is it a vague reference to a fallout he had with him earlier(making this an absurdly petty reason not to disclose it)? Just dropping tha…

Drama baiting is something Theo de Raadt is good at. :)

I have a feeling it has less to do with something sinister, and more to do with Theo's very vocal stance on the security situation in FreeBSD.

http://www.itwire.com/business-it-news/open-source/62641-cry...

Most likely the FreeBSD kernel or libraries are doing something in a certain way that Theo finds insecure/insufficient. (Justified or not)

Re: Undisclosed hole in openssh on FreeBSD and Juniper?

#24

Post by peterwwillis »

lholden wrote: post #15
willvarfar wrote: post #9

Earlier quoted context omitted.

It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSL consumers - only when they have a fix? It could be best fixed in OpenSSL itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.

OpenSSH is a SSH client and server provided by the Open BSD Foundation. OpenSSL is an encryption API maintained by an entirely different group of people. EDIT: Modified my reply. OpenSSH at some point moved it's "restrictively licenced software" (RSA, DES, etc) out of it's codebase and now depends on OpenSSL according to it's license. http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENC...

RSA, DES, etc are not "restrictively licensed software", they are algorithms in the public domain. Anybody can write their own implementation of it and license that work how they see fit - including OpenSSH. I'm pretty sure they're just lazy and would rather use someone else's code.

Re: Undisclosed hole in openssh on FreeBSD and Juniper?

#25

Post by yp_all »

awakened wrote: post #12

Many years ago, I submitted a bug report to OpenBSD about an issue I had discovered with threads. I received a one line response from Theo. I still have the mail. He wrote: "Threads are for idiots." At the time, I felt discounted and I was upset. I was younger then. Today, I realize what he meant and that he's right.

Great story. It is good to know that some programmers do learn over time.

For every 1 story like yours there are probably 10 where someone is still traying to get "revenge" by saying nasty things about you know who.

Those more common stories get replicated through the wires and the end result is that no one cares about programming anymore; they are simply interested in discussing interpersonal relations.

Would you rather have your software written by a foolish programmer who is pleasantly tactful or a competent and conservative one who is tactless?

The answer of course varies depending on what you are really after.

Re: Undisclosed hole in openssh on FreeBSD and Juniper?

#26

Post by nnkh »

lholden wrote: post #22
nnkh wrote: post #20

Earlier quoted context omitted.

Sure, De Raadt/OpenBSD are bitter about the lack of funding but that does not explain anything about this mysterious hole. This email can mean anything. Does Kirk McKusick know about this hole and has he pressured De Raadt not to disclose it (for what reason could that even be?), or is it a vague reference to a fallout he had with him earlier(making this an absurdly petty reason not to disclose it)? Just dropping tha…

Drama baiting is something Theo de Raadt is good at. :) I have a feeling it has less to do with something sinister, and more to do with Theo's very vocal stance on the security situation in FreeBSD. http://www.itwire.com/business-it-news/open-source/62641-cry... Most likely the FreeBSD kernel or libraries are doing something in a certain way that Theo finds insecure/insufficient. (Justified or not)

FreeBSD dev response to De Raadt's very vocal stance: http://tech.slashdot.org/comments.pl?sid=4559455&cid=4570198...

It really does seem like De Raadt's just being really petty to me. But if this is an actual hole and he doesn't want to say what it is, that is worrisome. Doesn't he insinuate the rest of FreeBSD does not know about the hole?

Re: Undisclosed hole in openssh on FreeBSD and Juniper?

#27

Post by lholden »

Xylakant wrote: post #17
lholden wrote: post #15

Earlier quoted context omitted.

OpenSSH is a SSH client and server provided by the Open BSD Foundation. OpenSSL is an encryption API maintained by an entirely different group of people. EDIT: Modified my reply. OpenSSH at some point moved it's "restrictively licenced software" (RSA, DES, etc) out of it's codebase and now depends on OpenSSL according to it's license. http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENC...

Actually somebody posted the contrary yesterday and I thought the same as you. We're both wrong - I went off and checked the openssl license and it lists a couple of things that are included from OpenSSL and a short grep in the code turns up a lot of references to OpenSSL.

Crazy... Modified my post. Thanks :)

Re: Undisclosed hole in openssh on FreeBSD and Juniper?

#28

Post by JackC »

yp_all wrote: post #25
awakened wrote: post #12

Many years ago, I submitted a bug report to OpenBSD about an issue I had discovered with threads. I received a one line response from Theo. I still have the mail. He wrote: "Threads are for idiots." At the time, I felt discounted and I was upset. I was younger then. Today, I realize what he meant and that he's right.

Great story. It is good to know that some programmers do learn over time. For every 1 story like yours there are probably 10 where someone is still traying to get "revenge" by saying nasty things about you know who. Those more common stories get replicated through the wires and the end result is that no one cares about programming anymore; they are simply interested in discussing interpersonal relations. Would you ra…

> Would you rather have your software written by a foolish programmer who is pleasantly tactful or a competent and conservative one who is tactless?

This is a false dichotomy. Interpersonal skills are among the skills necessary to work on a project that involves more than one person. That covers most of the interesting ones. If there's a successful project with someone who lacks those skills, it's because other people are covering for them -- just like a successful project with a foolish programmer. Sometimes that person makes up for it with other things they bring to the table, and that's fine, but don't pretend a weakness is a virtue.

Re: Undisclosed hole in openssh on FreeBSD and Juniper?

#29

Post by lholden »

peterwwillis wrote: post #24
lholden wrote: post #15

Earlier quoted context omitted.

OpenSSH is a SSH client and server provided by the Open BSD Foundation. OpenSSL is an encryption API maintained by an entirely different group of people. EDIT: Modified my reply. OpenSSH at some point moved it's "restrictively licenced software" (RSA, DES, etc) out of it's codebase and now depends on OpenSSL according to it's license. http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENC...

RSA, DES, etc are not "restrictively licensed software", they are algorithms in the public domain. Anybody can write their own implementation of it and license that work how they see fit - including OpenSSH. I'm pretty sure they're just lazy and would rather use someone else's code.

RSA was patent encumbered at the time the clause was made to the OpenSSH license. This very likely qualified RSA as "restrictively licensed". RSA was released from its patent in 2000 (just weeks before it expired).

DSA I believe is still patent encumbered.

Re: Undisclosed hole in openssh on FreeBSD and Juniper?

#30

Post by peterwwillis »

lholden wrote: post #29
peterwwillis wrote: post #24

Earlier quoted context omitted.

RSA, DES, etc are not "restrictively licensed software", they are algorithms in the public domain. Anybody can write their own implementation of it and license that work how they see fit - including OpenSSH. I'm pretty sure they're just lazy and would rather use someone else's code.

RSA was patent encumbered at the time the clause was made to the OpenSSH license. This very likely qualified RSA as "restrictively licensed". RSA was released from its patent in 2000 (just weeks before it expired). DSA I believe is still patent encumbered.

Right. They've had 14 years to re-add code like RSA and Diffie-Hellman to their project if they wanted to. Lazy programmers.

NIST made the DSA patent available worldwide royalty-free. In fact, DSA was unencumbered by patents before RSA, which is why SSH version 2 incorporated it.

Post reply on HN