6 ms·

Not the first time OpenBSD does not respect embargoes, for example https://lwn.net/Articles/726585/ https://lwn.net/Articles/726585/ and https://lwn.net/Article

by 0x0 9y ago

Not the first time OpenBSD does not respect embargoes, for example https://lwn.net/Articles/726585/ https://lwn.net/Articles/726585/ and https://lwn.net/Articles/726580/ https://lwn.net/Articles/726580/

philippnagel 9y ago
As a user I am completely fine with that.
- nasduia 9y ago
  Even when the author states that now as a result of that selfishness OpenBSD won't get notified about vulnerabilities until well after everyone else?
  - cjsuk 9y ago
    What about the vulnerabilities that OpenBSD notice? Works both ways. And they have an active interest in such things and have discovered as much as any famous-for-five-minutes security researcher.
    - JumpCrisscross 9y ago
      > [OpenBSD] have discovered as much as any famous-for-five-minutes security researcher TL; DR OpenBSD acted rationally if they'd prefer to go it alone, which seems to be their culture. To their credit, it's worked pretty well so far. But you can't have your cake and eat it too. If they prefer a mad scramble after public disclosure, they'll get it. But they shouldn't get early notice from responsible researchers.
      - cjsuk 9y ago
        See my comment here. It sort of replies to this anyway: https://news.ycombinator.com/item?id=15482285 https://news.ycombinator.com/item?id=15482285 I don't believe that embargo is healthy or responsible! If anything its a monopolising factor.
  - temprature 9y ago
    > OpenBSD won't get notified about vulnerabilities until well after everyone else Which doesn't make a difference if OpenBSD still gets their patch out at the same time as everyone else. Unlike other vendors, it doesn't take OpenBSD four months to go from vulnerability notification to patch release, if you look at previous disclosure timelines they typically have a patch out in days.
  - abcdef123xyz 9y ago
    It sounds rather like he is trying to blame OpenBSD for his own mistake. As multiple people from OpenBSD have said, he agreed they could apply the fix, so they did. He didn't have to say they could. The fact that CERT persuaded him to extend the embargo later is not their fault.
tedunangst 9y ago
A bunch of dudes on a linux mailing list lack the authority to prevent openbsd from fixing things.
- Xylakant 9y ago
  True, they don't. However, this researcher has the authority to not notify the openbsd team in advance any more and he already announced that he'll keep his cards closer next time. What happens if sufficient researchers come to the same conclusion?
  - cjsuk 9y ago
    What happens if a vendor or researcher is in bed with the NSA and they use the exploit while embargoed? The whole thing is a shit show and really I'm rather more behind OpenBSD's approach. Edit just to expand on this as someone deleted a post .... ---- It's slightly more complicated than the prisoner's dilemma. The prisoner's dilemma doesn't account for a large facet of the problem which is being discussed here. If all the good parties participate and coordinate then we're better off. The problem is there are outlying circumstances which means that not everyone will be included: 1. If someone kicks someone out (OpenBSD) on political whim playing CYA, they no longer benefit. 2. If a party is not let in, they no longer benefit. 3. If someone is unaware of it, they don't benefit. This turns it into a security monopoly where the big vendors get exclusive rights to embargo and exclude smaller vendors and control the disclosure process on their own schedule. The first thing the people outside of the club find is they wake up on Monday morning and have to clear up a shitstorm of monumental proportions with less resources than the monopolised vendors who've had time to deal with it. Then there's the assumption that the monopolised vendors are trustworthy which is 100% impossible to validate and therefore invalid.
    - deleted 9y ago
      [deleted]
    - tedunangst 9y ago
      Yeah, the hysterical part is how people think distros is leak proof. It just doesn't leak in nice public ways to allow "responsible white hats" to wag their fingers. Raise your hand if you can say you confidently know the full back channel distribution of a notification to distros.
gizzlon 9y ago
"As a compromise, I allowed them to silently patch the vulnerability." The way I read that they broke no embargo
- cyphar 9y ago
  They were pressured by OpenBSD to do so, and regret it. That doesn't mean they broke embargo, but it also doesn't reflect well on them. Do you think Theo would've respected the embargo if they had said "no, do not patch until the embargo date?"
  - brians 9y ago
    Yes. He would have tried to persuade them, perhaps cut out the researchers to persuade CERT.
  - abcdef123xyz 9y ago
    Who says they were pressured?
JumpCrisscross 9y ago
Sounds like the researcher is at fault for putting OpenBSD on their list. If you cut a deal with someone who serially defects, at a certain point the onus shifts from them to your lack of foresight.
- noobermin 9y ago
  The problem isn't a "fool me once shame on...fool me you don't get fooled again", because the problem is one unscrupulous party is unscrupulous to different parties and the different parties at different times are unaware of it.
  - JumpCrisscross 9y ago
    > the problem is one unscrupulous party is unscrupulous to different parties and the different parties at different times are unaware of it Sure, but eventually you get called out on it in a public forum, like this one, and people stop giving you goodies going forward. I would consider it acceptable practice to, when considering dealing with OpenBSD (or people who are close to them), (a) withhold vulnerabilities until after the embargo date or (b) refuse to give any information unless they sign a binding non-disclosure agreement committing them to the deadline under pain of penalty. (The latter is an option because it appears, in this case, they broke the spirit if not letter of the agreement. The solution to that problem is legalese.)
    - stsp 9y ago
      Hi, I am the person you are accusing of mischief. I didn't break any agreement. I agreed with Mathy on what to do, and that's what I did. The fact that Mathy decided to get CERT involved and subsequently had to extend the embargo has nothing to do with me. (edit: typo)
      - JumpCrisscross 9y ago
        To be clear, I accuse you of nothing less than playing a rational response to the researcher's apparent "always coöperate" strategy. "Defect" in a prisoner's dilemma context does not mean "breach" in a legal one. (For example, an OPEC member defecting has zero legal consequences. It does, however, affect their standing in the next round of negotiations.)

by 0x0 9y ago

philippnagel 9y ago

As a user I am completely fine with that.

nasduia 9y ago
Even when the author states that now as a result of that selfishness OpenBSD won't get notified about vulnerabilities until well after everyone else?
- cjsuk 9y ago
  What about the vulnerabilities that OpenBSD notice? Works both ways. And they have an active interest in such things and have discovered as much as any famous-for-five-minutes security researcher.
  - JumpCrisscross 9y ago
    > [OpenBSD] have discovered as much as any famous-for-five-minutes security researcher TL; DR OpenBSD acted rationally if they'd prefer to go it alone, which seems to be their culture. To their credit, it's worked pretty well so far. But you can't have your cake and eat it too. If they prefer a mad scramble after public disclosure, they'll get it. But they shouldn't get early notice from responsible researchers.
    - cjsuk 9y ago
      See my comment here. It sort of replies to this anyway: https://news.ycombinator.com/item?id=15482285 https://news.ycombinator.com/item?id=15482285 I don't believe that embargo is healthy or responsible! If anything its a monopolising factor.
- temprature 9y ago
  > OpenBSD won't get notified about vulnerabilities until well after everyone else Which doesn't make a difference if OpenBSD still gets their patch out at the same time as everyone else. Unlike other vendors, it doesn't take OpenBSD four months to go from vulnerability notification to patch release, if you look at previous disclosure timelines they typically have a patch out in days.
- abcdef123xyz 9y ago
  It sounds rather like he is trying to blame OpenBSD for his own mistake. As multiple people from OpenBSD have said, he agreed they could apply the fix, so they did. He didn't have to say they could. The fact that CERT persuaded him to extend the embargo later is not their fault.

tedunangst 9y ago

A bunch of dudes on a linux mailing list lack the authority to prevent openbsd from fixing things.

Xylakant 9y ago
True, they don't. However, this researcher has the authority to not notify the openbsd team in advance any more and he already announced that he'll keep his cards closer next time. What happens if sufficient researchers come to the same conclusion?
- cjsuk 9y ago
  What happens if a vendor or researcher is in bed with the NSA and they use the exploit while embargoed? The whole thing is a shit show and really I'm rather more behind OpenBSD's approach. Edit just to expand on this as someone deleted a post .... ---- It's slightly more complicated than the prisoner's dilemma. The prisoner's dilemma doesn't account for a large facet of the problem which is being discussed here. If all the good parties participate and coordinate then we're better off. The problem is there are outlying circumstances which means that not everyone will be included: 1. If someone kicks someone out (OpenBSD) on political whim playing CYA, they no longer benefit. 2. If a party is not let in, they no longer benefit. 3. If someone is unaware of it, they don't benefit. This turns it into a security monopoly where the big vendors get exclusive rights to embargo and exclude smaller vendors and control the disclosure process on their own schedule. The first thing the people outside of the club find is they wake up on Monday morning and have to clear up a shitstorm of monumental proportions with less resources than the monopolised vendors who've had time to deal with it. Then there's the assumption that the monopolised vendors are trustworthy which is 100% impossible to validate and therefore invalid.
  - deleted 9y ago
    [deleted]
  - tedunangst 9y ago
    Yeah, the hysterical part is how people think distros is leak proof. It just doesn't leak in nice public ways to allow "responsible white hats" to wag their fingers. Raise your hand if you can say you confidently know the full back channel distribution of a notification to distros.

gizzlon 9y ago

"As a compromise, I allowed them to silently patch the vulnerability." The way I read that they broke no embargo

cyphar 9y ago
They were pressured by OpenBSD to do so, and regret it. That doesn't mean they broke embargo, but it also doesn't reflect well on them. Do you think Theo would've respected the embargo if they had said "no, do not patch until the embargo date?"
- brians 9y ago
  Yes. He would have tried to persuade them, perhaps cut out the researchers to persuade CERT.
- abcdef123xyz 9y ago
  Who says they were pressured?

JumpCrisscross 9y ago

Sounds like the researcher is at fault for putting OpenBSD on their list. If you cut a deal with someone who serially defects, at a certain point the onus shifts from them to your lack of foresight.

noobermin 9y ago
The problem isn't a "fool me once shame on...fool me you don't get fooled again", because the problem is one unscrupulous party is unscrupulous to different parties and the different parties at different times are unaware of it.
- JumpCrisscross 9y ago
  > the problem is one unscrupulous party is unscrupulous to different parties and the different parties at different times are unaware of it Sure, but eventually you get called out on it in a public forum, like this one, and people stop giving you goodies going forward. I would consider it acceptable practice to, when considering dealing with OpenBSD (or people who are close to them), (a) withhold vulnerabilities until after the embargo date or (b) refuse to give any information unless they sign a binding non-disclosure agreement committing them to the deadline under pain of penalty. (The latter is an option because it appears, in this case, they broke the spirit if not letter of the agreement. The solution to that problem is legalese.)
  - stsp 9y ago
    Hi, I am the person you are accusing of mischief. I didn't break any agreement. I agreed with Mathy on what to do, and that's what I did. The fact that Mathy decided to get CERT involved and subsequently had to extend the embargo has nothing to do with me. (edit: typo)
    - JumpCrisscross 9y ago
      To be clear, I accuse you of nothing less than playing a rational response to the researcher's apparent "always coöperate" strategy. "Defect" in a prisoner's dilemma context does not mean "breach" in a legal one. (For example, an OPEC member defecting has zero legal consequences. It does, however, affect their standing in the next round of negotiations.)