Lessons from the Debian/OpenSSL Fiasco (2008)
research.swtch.com
Lessons from the Debian/OpenSSL Fiasco (2008)
1–10 of 26 posts
Re: Lessons from the Debian/OpenSSL Fiasco (2008)
#2Discussed at the time:
Lessons from the Debian/OpenSSL Fiasco - https://news.ycombinator.com/item?id=196035 - May 2008 (2 comments)
Re: Lessons from the Debian/OpenSSL Fiasco (2008)
#3Wonder if any of the lessons got learned? We, as an industry, are absolutely terrible at this, but hope springs eternal...
Re: Lessons from the Debian/OpenSSL Fiasco (2008)
#4I recently spend some time looking into this bug again, because I develop a tool to detect known cryptographic vulnerabilities in public keys called badkeys - https://badkeys.info/ if you're interested.
Some notable things I learned:
* This affects both OpenSSL and OpenSSH, but the keys are different. I.e. you have a set of vulnerable OpenSSH keys and a set of vulnerable OpenSSL keys. But the key format is the same, yet most of the tools to detect just look for either of these. I found a TLS certificate created with a vulnerable key generated by OpenSSH.
* It was "conventional wisdom" that ECDSA was unaffected because some sources said that OpenSSL version did not support ECDSA. However that was wrong, you can generate ECDSA keys with that old version.
Generally it seems a lot of the detection tools are incomplete. E.g. github seems to block some vulnerable keys, but only a subset.
Re: Lessons from the Debian/OpenSSL Fiasco (2008)
#5Wonder if any of the lessons got learned? We, as an industry, are absolutely terrible at this, but hope springs eternal...
> Wonder if any of the lessons got learned?
Debian patches too much and can't be trusted is the lesson I learnt.
They haven't changed their patching policy since so I refuse to use any Debian derivative and advise everyone to do so and stick to distributions which stay as close to vanilla as possible.
Similarly I also think that anything pretending to provide LTS while freezing software versions is misguided and mostly lying to you and you are one incorrectly backported patch away from distaster.
Re: Lessons from the Debian/OpenSSL Fiasco (2008)
#6Wonder if any of the lessons got learned? We, as an industry, are absolutely terrible at this, but hope springs eternal...
> Wonder if any of the lessons got learned? Debian patches too much and can't be trusted is the lesson I learnt. They haven't changed their patching policy since so I refuse to use any Debian derivative and advise everyone to do so and stick to distributions which stay as close to vanilla as possible. Similarly I also think that anything pretending to provide LTS while freezing software versions is misguided and most…
> Debian patches too much
It does. This is partly because of The Debian Guarantee: I think that's why they delivered a castrated version of FFMPEG.
If upstream is deemed non-free, then they should just put the package in non-free, and delete it from main. Mangling upstream so they can squeeze it into main is worse than pointless.
Re: Lessons from the Debian/OpenSSL Fiasco (2008)
#7Wonder if any of the lessons got learned? We, as an industry, are absolutely terrible at this, but hope springs eternal...
The lesson that OpenSSL code is terrible was learnt much harder way in 2014 with Heartbleed, and lead to LibreSSL existence.
Re: Lessons from the Debian/OpenSSL Fiasco (2008)
#8Wonder if any of the lessons got learned? We, as an industry, are absolutely terrible at this, but hope springs eternal...
> Wonder if any of the lessons got learned? Debian patches too much and can't be trusted is the lesson I learnt. They haven't changed their patching policy since so I refuse to use any Debian derivative and advise everyone to do so and stick to distributions which stay as close to vanilla as possible. Similarly I also think that anything pretending to provide LTS while freezing software versions is misguided and most…
> anything pretending to provide LTS while freezing software versions is misguided
How would you define LTS?
Re: Lessons from the Debian/OpenSSL Fiasco (2008)
#9Earlier quoted context omitted.
> Wonder if any of the lessons got learned? Debian patches too much and can't be trusted is the lesson I learnt. They haven't changed their patching policy since so I refuse to use any Debian derivative and advise everyone to do so and stick to distributions which stay as close to vanilla as possible. Similarly I also think that anything pretending to provide LTS while freezing software versions is misguided and most…
> anything pretending to provide LTS while freezing software versions is misguided How would you define LTS?
LTS is making only the breaking changes that I want, of course. /s
Re: Lessons from the Debian/OpenSSL Fiasco (2008)
#10Wonder if any of the lessons got learned? We, as an industry, are absolutely terrible at this, but hope springs eternal...
No, generally there is no respect for the complexity of libraries. There is a reason why library authors themselves are reluctant to do many or broad changes.
But first the sysadmin culture (which I generally like, but not in this aspect) taught us that anyone can modify anything to make it work for him.
Now the equity culture teaches us that anyone is equal and has a right to do any modifications. Correctness does not matter, and if you insist, you are a class traitor.
Projects that deviate from upstream with this attitude have frequent issues.