4 ms·

It's interesting, but I don't think I'd take it over openssh just yet. I'm not at the scale where most of the features become relevant, and frankly, I don't tru

It's interesting, but I don't think I'd take it over openssh just yet. I'm not at the scale where most of the features become relevant, and frankly, I don't trust it as much as I trust openssh, a piece of software that's been in active development for almost 17 years, has an excellent security track record, and a development team well known for its care for security and its response to security issues. And in a piece of vital security infrastructure, trust is everything.

draugadrotten 10y ago
> "Teleport has completed a security audit from a nationally recognized technology security company. So we are comfortable with the use of Teleport from a security perspective." It would be interesting to read more details about this audit. This blurb is pretty much "Trust us" with more letters.
- qwertyuiop924 10y ago
  Indeed. That's why I'm not entirely trusting of it yet.
- twakefield 10y ago
  Unfortunately, our current agreement with the security company we hired prevents us from sharing the details unless under NDA. We may revisit those terms so that we can publish it now that Teleport is garnering more interest. Edit: tried to add more clarification to address jtchang's question.
  - jtchang 10y ago
    Why is this? Doesn't it make sense to publish which company did the audit? I mean for financial companies like KPMG they definitely do it.
    - sethhochberg 10y ago
      I'd guess it is something like "pay us $XX for an audit for your information; pay us $XXXX to tell other people we audited you"
      - developer2 10y ago
        It's exactly this. A private audit is generally cheap. The truth with these is that the audit really doesn't mean anything - you will often find such audits performing such a superficial sweep of the software that even glaring problems may not be found. Publicly releasing an audit puts the auditor's reputation on the line. As such, the audit will always be performed very seriously, digging into the code and scrutinizing every possible angle - at a level usually not even remotely done for a private audit. All said: a private audit means squat all.
    - dsr_ 10y ago
      My company pays for an annual external audit, and I do most of the negotiations. About half the companies don't want the audit results going anywhere else. About half are OK with distribution under NDA. In between, there are companies which will negotiate the right to distribute, usually with an explicit indemnity clause, and on the far end are a minority of companies that tell you that the results are work for hire and entirely your prerogative. The major concern is that the customer will misrepresent the results in some way, or even represent them accurately but then change the underlying service to open up a vulnerability. Either way, nobody really wants to be in the news...
- microcolonel 10y ago
  Having worked on software which received audits from a "natonally recognized security company", this statement on their part gives me no additional confidence. I performed what I would consider a "light" audit on the same codebase and found database injection attacks, auth forging attacks, denial of service; and the infrastructure it was deployed on used versions of libraries which opened the service up to plausible remote code execution. Ditto, it just basically says "trust us"; no offense to the authors.
old-gregg 10y ago
Maintainer of Teleport here. qwertyuiop924: I'm with you. When it comes to security it pays off to be skeptical and pragmatic. We're on the hook of keeping it robust, simple and secure for years to come. So eventually, with the help from the OSS community, we expect it to earn your trust, hopefully sooner than in 17 years though :)
- qwertyuiop924 10y ago
  If the maintainer is understanding of your skepticism, it's already a good sign :-).
kordless 10y ago
> And in a piece of vital security infrastructure, trust is everything. Trust is based on an individual's experience over time. It can also be based on statistical observations over time. Statistically, nearly every single piece of software in use today has had a security hole in it at some point in time and many still have them. Audit or not, openssh is included in this fact. Today's infrastructure software is far too complex to ever be secure past a certain statistical threshold, at least without reinventing the way the Internet works. Your comments are curious given Teleport just came out. One comes to trust something by spending time with it first. You can't apply anti-trust to something just because it's not the same as something you do trust.
- qwertyuiop924 10y ago
  It just came out, so I don't trust it yet. I'm waiting to see what security flaws arise, how the developers respond, etc. And yes, you do start out with anti-trust if you're replacing something I trust, because you then have to be at least that trustworthy to replace it.
- GrinningFool 10y ago
  >Your comments are curious given Teleport just came out. One comes to trust something by spending time with it first. You can't apply anti-trust to something just because it's not the same as something you do trust. I don't follow this line of reasoning. I was with you for the opening sentence - trust is a thing earned over time - and then you lost me. Statistically it is a near-certainty that OpenSSH does have undiscovered security holes. The trust that the maintainers have built over years makes me comfortable with that, because I know they will be rapidly addressed in a reasoned out manner. I don't see gp as applying anti-trust just because it is different from OpenSSH - I see it as the maintainers of Teleport not yet having earned the trust that the maintainers of OpenSSH have. And statistically as a new product with a new code base, Teleport is likely to have more security issues than an established product actively monitored for security flaws in the same space. So the issue is not a matter of "new and different is bad", so much as "new product and (relatively) unknown community behind it are unproven". Those two factors combined make it inherently less trustworthy in a space where trustworthiness is critical.

draugadrotten 10y ago

> "Teleport has completed a security audit from a nationally recognized technology security company. So we are comfortable with the use of Teleport from a security perspective." It would be interesting to read more details about this audit. This blurb is pretty much "Trust us" with more letters.

qwertyuiop924 10y ago
Indeed. That's why I'm not entirely trusting of it yet.
twakefield 10y ago
Unfortunately, our current agreement with the security company we hired prevents us from sharing the details unless under NDA. We may revisit those terms so that we can publish it now that Teleport is garnering more interest. Edit: tried to add more clarification to address jtchang's question.
- jtchang 10y ago
  Why is this? Doesn't it make sense to publish which company did the audit? I mean for financial companies like KPMG they definitely do it.
  - sethhochberg 10y ago
    I'd guess it is something like "pay us $XX for an audit for your information; pay us $XXXX to tell other people we audited you"
    - developer2 10y ago
      It's exactly this. A private audit is generally cheap. The truth with these is that the audit really doesn't mean anything - you will often find such audits performing such a superficial sweep of the software that even glaring problems may not be found. Publicly releasing an audit puts the auditor's reputation on the line. As such, the audit will always be performed very seriously, digging into the code and scrutinizing every possible angle - at a level usually not even remotely done for a private audit. All said: a private audit means squat all.
  - dsr_ 10y ago
    My company pays for an annual external audit, and I do most of the negotiations. About half the companies don't want the audit results going anywhere else. About half are OK with distribution under NDA. In between, there are companies which will negotiate the right to distribute, usually with an explicit indemnity clause, and on the far end are a minority of companies that tell you that the results are work for hire and entirely your prerogative. The major concern is that the customer will misrepresent the results in some way, or even represent them accurately but then change the underlying service to open up a vulnerability. Either way, nobody really wants to be in the news...
microcolonel 10y ago
Having worked on software which received audits from a "natonally recognized security company", this statement on their part gives me no additional confidence. I performed what I would consider a "light" audit on the same codebase and found database injection attacks, auth forging attacks, denial of service; and the infrastructure it was deployed on used versions of libraries which opened the service up to plausible remote code execution. Ditto, it just basically says "trust us"; no offense to the authors.

old-gregg 10y ago

Maintainer of Teleport here. qwertyuiop924: I'm with you. When it comes to security it pays off to be skeptical and pragmatic. We're on the hook of keeping it robust, simple and secure for years to come. So eventually, with the help from the OSS community, we expect it to earn your trust, hopefully sooner than in 17 years though :)

qwertyuiop924 10y ago
If the maintainer is understanding of your skepticism, it's already a good sign :-).

kordless 10y ago

> And in a piece of vital security infrastructure, trust is everything. Trust is based on an individual's experience over time. It can also be based on statistical observations over time. Statistically, nearly every single piece of software in use today has had a security hole in it at some point in time and many still have them. Audit or not, openssh is included in this fact. Today's infrastructure software is far too complex to ever be secure past a certain statistical threshold, at least without reinventing the way the Internet works. Your comments are curious given Teleport just came out. One comes to trust something by spending time with it first. You can't apply anti-trust to something just because it's not the same as something you do trust.

qwertyuiop924 10y ago
It just came out, so I don't trust it yet. I'm waiting to see what security flaws arise, how the developers respond, etc. And yes, you do start out with anti-trust if you're replacing something I trust, because you then have to be at least that trustworthy to replace it.
GrinningFool 10y ago
>Your comments are curious given Teleport just came out. One comes to trust something by spending time with it first. You can't apply anti-trust to something just because it's not the same as something you do trust. I don't follow this line of reasoning. I was with you for the opening sentence - trust is a thing earned over time - and then you lost me. Statistically it is a near-certainty that OpenSSH does have undiscovered security holes. The trust that the maintainers have built over years makes me comfortable with that, because I know they will be rapidly addressed in a reasoned out manner. I don't see gp as applying anti-trust just because it is different from OpenSSH - I see it as the maintainers of Teleport not yet having earned the trust that the maintainers of OpenSSH have. And statistically as a new product with a new code base, Teleport is likely to have more security issues than an established product actively monitored for security flaws in the same space. So the issue is not a matter of "new and different is bad", so much as "new product and (relatively) unknown community behind it are unproven". Those two factors combined make it inherently less trustworthy in a space where trustworthiness is critical.