3 ms·
OpenSSH and the dangers of unused code
- wyldfire 11y ago> CVE-2016-0778... is "unlikely to have any real-world impact" because it relies on two non-default options being used by the client (ProxyCommand and either ForwardAgent or ForwardX11) cringe -- I know I've got both in my ~/.ssh/config, though hopefully not both enabled for the same server(s).
- falcolas 11y agoWe use 'ProxyCommand' constantly with bastion servers to help protect our infrastructure. We use 'ForwardAgent' much less, but it's still useful for some testing purposes or one-offs.
- yeukhon 11y agoThose are probably the most used non default options on any ssh-equipped linux/bsd machine today.
- ufmace 11y agoUpvoted because this is the first short and clear description of how the SSH bug works and why it's bad that I've read so far.
- mike_hock 11y ago"Half-implemented feature" is so awesome for plausible deniability. You can leave blatant security holes in and be like, "yeah, I never got around to fixing that since we stopped developing the feature," when elsewhere those flaws would be suspected of being an intentional backdoor.
- Kristine1975 11y agoPerhaps even leave a comment: TODO: FIXME
- Kristine1975 11y agoThe comments show why most people shouldn't be writing security-critical software in C: They think they know the language's pitfalls when in reality they only know some of them. Use memset_s! The compiler isn't allowed to remove calls to it: http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1381.pdf http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1381.pdf
- bcook 11y agoNobody knows all of any language's pitfalls. Even the greatest programmer with the safest language will still code security vulnerabilities.
- sitkack 11y agoHow many fallacies is this and what are they?
- yeukhon 11y agoUsing the wrong library or function call, exposing stacktrace to end-user, doesn't actually handle error code properly so things blow up and leak information. You will know it when you see one.
- leni536 11y agoPerfectionist Fallacy Assuming that the only option on the table is perfect success, then rejecting anything that will not work perfectly. 'What's the point of these anti-drunk driving ad campaigns? People are still going to drink and drive no matter what.' Shared From Logical Defence Application
- sitkack 11y agoexcellent! https://en.wikipedia.org/wiki/Nirvana_fallacy https://en.wikipedia.org/wiki/Nirvana_fallacy