3 ms·

they previously broke the KRACK embargo (among others): https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbhnfz https://lobste.rs/s/dwzplh/krack_attacks

they previously broke the KRACK embargo (among others): https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbhnfz https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbh... it's no surprise they're not high up on the list of important people to tell

blattimwind 9y ago
No one seems to have told the other BSDs, either.
- kuschku 9y ago
  FreeBSD was told in December, which is still a realistic timeline.
  - JdeBP 9y ago
    Late December, i.e. a week or so before the cat actually got let out of the bag, and probably around a fortnight's notice until the originally planned coördinated announcement date. * https://news.ycombinator.com/item?id=16074531 https://news.ycombinator.com/item?id=16074531 That is hardly enough time, considering that it is likely a holiday period for most of the people concerned, to prepare what needed to be prepared. Google and Intel gave themselves six months, in contrast, and they gave Ubuntu since November 2017. I still haven't nailed down how much advanced notice Matthew Dillion, author of DragonFly BSD, was given; although his apparent level of preparedness with patches on 2018-01-05 can be attributed to the fact that he actually talked publicly about the problem in April 2017, months before Google Project Zero secretly reported it to processor manufacturers in June 2017 in the first place. * https://news.ycombinator.com/item?id=16084641 https://news.ycombinator.com/item?id=16084641
    - kuschku 9y ago
      > That is hardly enough time, considering that it is likely a holiday period for most of the people concerned, to prepare what needed to be prepared. Google and Intel gave themselves six months, in contrast, and they gave Ubuntu since November 2017. Correct, but it’s significantly better than OpenBSD’s timeline (which learnt about it from the media). Mitigation for Meltdown is possible within of a week, or two. It requires working through the night, but it’s possible. Mitigation after it’s in the media is a whole different situation.
      - JdeBP 9y ago
        No, it is not significantly better. Contrasted with the months that the likes of Microsoft, Ubuntu, and (going by what Paolo Bonzini has already said on Hacker News) RedHat got, FreeBSD and OpenBSD were in practical terms in the same boat. The difference of a week, when that week is Christmastide, is insignificant when put alongside those.
cm2187 9y ago
And the guy complains in the same paragraph that there are embargoes and that he wasn't in on the embargo... If he doesn't want embargoes he should be happy to discover the vulnerability with everyone else.
temprature 9y ago
He told them they could go ahead, he then regretted it but that's not OpenBSD's fault. From https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd : > As a compromise, I allowed them to silently patch the vulnerability. Receiving permission to patch is the opposite of breaking an embargo.
- xucheng 9y ago
  And it continues: > As a compromise, I allowed them to silently patch the vulnerability. In hindsight this was a bad decision, since others might rediscover the vulnerability by inspecting their silent patch. To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.

blattimwind 9y ago

No one seems to have told the other BSDs, either.

kuschku 9y ago
FreeBSD was told in December, which is still a realistic timeline.
- JdeBP 9y ago
  Late December, i.e. a week or so before the cat actually got let out of the bag, and probably around a fortnight's notice until the originally planned coördinated announcement date. * https://news.ycombinator.com/item?id=16074531 https://news.ycombinator.com/item?id=16074531 That is hardly enough time, considering that it is likely a holiday period for most of the people concerned, to prepare what needed to be prepared. Google and Intel gave themselves six months, in contrast, and they gave Ubuntu since November 2017. I still haven't nailed down how much advanced notice Matthew Dillion, author of DragonFly BSD, was given; although his apparent level of preparedness with patches on 2018-01-05 can be attributed to the fact that he actually talked publicly about the problem in April 2017, months before Google Project Zero secretly reported it to processor manufacturers in June 2017 in the first place. * https://news.ycombinator.com/item?id=16084641 https://news.ycombinator.com/item?id=16084641
  - kuschku 9y ago
    > That is hardly enough time, considering that it is likely a holiday period for most of the people concerned, to prepare what needed to be prepared. Google and Intel gave themselves six months, in contrast, and they gave Ubuntu since November 2017. Correct, but it’s significantly better than OpenBSD’s timeline (which learnt about it from the media). Mitigation for Meltdown is possible within of a week, or two. It requires working through the night, but it’s possible. Mitigation after it’s in the media is a whole different situation.
    - JdeBP 9y ago
      No, it is not significantly better. Contrasted with the months that the likes of Microsoft, Ubuntu, and (going by what Paolo Bonzini has already said on Hacker News) RedHat got, FreeBSD and OpenBSD were in practical terms in the same boat. The difference of a week, when that week is Christmastide, is insignificant when put alongside those.

cm2187 9y ago

And the guy complains in the same paragraph that there are embargoes and that he wasn't in on the embargo... If he doesn't want embargoes he should be happy to discover the vulnerability with everyone else.

temprature 9y ago

He told them they could go ahead, he then regretted it but that's not OpenBSD's fault. From https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd : > As a compromise, I allowed them to silently patch the vulnerability. Receiving permission to patch is the opposite of breaking an embargo.

xucheng 9y ago
And it continues: > As a compromise, I allowed them to silently patch the vulnerability. In hindsight this was a bad decision, since others might rediscover the vulnerability by inspecting their silent patch. To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.