How do code security audits actually work? Are various well-experienced people just combing through the code and trying to break it? Or is there a more formal process?
OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative
31–40 of 94 posts
Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative
#32Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…
> And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. Yeah, but people who give money usually tend to see that as a valid reason.
Theo's "outspokeness" is believed to be the reason that DARPA canceled a million dollar development grant.
https://en.wikipedia.org/wiki/Theo_de_Raadt#DARPA_funding_ca...
Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative
#33I skimmed, but cannot seem to see which project is being supported when they say NTP. When you support the OpenBSD Foundation you support: - OpenBSD - OpenSSH - OpenBGPD - OpenNTPD - OpenSMTPD - LibreSSL The wording makes me think that the initiative will be supporting something other than OpenNTPD
They're supporting 4 projects so far: OpenSSL, OpenSSH, NTPd, and an Open Crypto Audit Project (OCAP) audit of OpenSSL. The Network Time Protocol project is here: http://ntp.org/
Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative
#34This is great news. NTP is one of the least appreciated OSS projects. Harlan and the rest of the ntp dev team are very helpful and deserve a lot of respect for keeping the clocks on time. I can only hope that increased ntp funding/awareness/development means that BitKeeper (not a typo) is finally replaced by git/mercurial.
Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative
#35Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…
Is it possible to give them more granular donations? I want to support OpenSSH and LibreSSL, but I don't cae about OpenBSD.
The reason I don't donate to them is that I feel like most of my donation will be going towards something I don't care about.
Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative
#36How do code security audits actually work? Are various well-experienced people just combing through the code and trying to break it? Or is there a more formal process?
This depends on a couple of different things. The most important of which is "at what stage of development is the application? (i.e. how mature and well tested is this code)". Software Development Life Cycle (SDLC) processes are great when followed from the start. When they are applied long after the first 100k+ lines of code are written then its harder. A typical code audit for us (I do this professionally at http://leafsr.com) involves some threat modeling, attack surface enumeration, manual data-flow and taint analysis ("where does untrusted data come into this application and how is it handled") and finally just reading the code. Timing and scope will heavily influence how deep you can go. 1 week on OpenSSH will probably get you nothing, 6 weeks on OpenSSL will definitely get you something.
(edit: expanded on what is most important)
Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative
#37I skimmed, but cannot seem to see which project is being supported when they say NTP. When you support the OpenBSD Foundation you support: - OpenBSD - OpenSSH - OpenBGPD - OpenNTPD - OpenSMTPD - LibreSSL The wording makes me think that the initiative will be supporting something other than OpenNTPD
ntp has an open-source reference implementation that many Linux distros use. See http://www.ntp.org/
Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative
#38I'm actually looking forward to seeing how the OpenSSL problem will deal with their own legacy code, compared to how the OpenBSD developers have handled it. It seems that own of the only ways of dealing with the OpenSSL code is to strip out the code for a large number of, should we say "less used platforms". Is the OpenSSL developers willing to drop support for 16 bit Windows or OpenVMS?
One of my favorite platform removals was support for the Cray T3E, as in the debuted in 1995, Cray Research T3E.[1,2]
-/* Added for T3E, address-of fails on bit field (beckman@acl.lanl.gov) */
-#ifndef BIT_FIELD_LIMITS
memcpy(&server.sin_addr.s_addr, ip, 4);
-#else
- memcpy(&server.sin_addr, ip, 4);
-#endif
Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative
#39I skimmed, but cannot seem to see which project is being supported when they say NTP. When you support the OpenBSD Foundation you support: - OpenBSD - OpenSSH - OpenBGPD - OpenNTPD - OpenSMTPD - LibreSSL The wording makes me think that the initiative will be supporting something other than OpenNTPD
Don't forget OpenCVS
Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative
#40Earlier quoted context omitted.
Seems to have worked out for Torvalds and good chunks of the Web ecosystem.
Most of the "Linus being a dick" examples are him being a dick to developers, and several of those cases are "him being a dick to developers because they did something that affects users". That's the kind of thing that's good for PR more than bad for it, because when Linus rages at a developer for breaking things, a large portion of users think "Linus has my back".
And that's not the case with Theo?