9 ms·

You know, it's really tiring that people keep up with the same old shtick every time the topic of embargoes and OpenBSD come up. OpenBSD followed [0] the origi

by brynet 9y ago

You know, it's really tiring that people keep up with the same old shtick every time the topic of embargoes and OpenBSD come up. OpenBSD followed [0] the original embargo from the KRACK researcher, he gave OpenBSD the go-ahead to commit it.. only later we he got CERT involved did they want to delay it for more months. He changed his mind retroactively. It's even stated in the original FAQ for that particular security issue. Enough already? This has nothing to do with Intel's very selective disclosure of Meltdown. [0] https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbhnfz https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbh...

cthalupa 9y ago
OpenBSD followed the original embargo, and got asked to extend it based on the CERT response. You guys said no, and the security researcher shrugged and went 'Well, okay, I guess.' When everyone else is agreeing to the extended embargo, I personally can't say that I feel like OpenBSD respected the embargo there. It's also not limited to just KRACK. With the OpenSSL/LibreSSL stuff back in 2015, OpenBSD wasn't part of the disclosure because Theo said he wasn't going to deal with an email-list or embargoes prior to that. Marc Espie has said he thinks it's a good thing that the KRACK embargo was broken early.
- brynet 9y ago
  That's not how it happened, that's the narrative you're spinning, certainly. https://twitter.com/vanhoefm/status/921425715903463425 https://twitter.com/vanhoefm/status/921425715903463425
  - cthalupa 9y ago
    Please explain how that is not what happened? That tweet does not contradict me in the slightest. In fact, your original link is quite explicit. >Then he got CERT (and, thus, US gov agencies) involved and had to extend the embargo even further until today. At that point we already had the ball rolling and decided to stick to the original agreement with him, and he gave us an agreeing nod towards that as well. So, stsp pretty specifically says "It got extended, we decided not to follow the new date, and he went 'well, okay'" https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd >To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo. If OpenBSD did nothing wrong, it seems quite odd that the same person who you are saying was fully on board with it is now explicitly saying he is going to provide late notifications.
    - brynet 9y ago
      OpenBSD had no idea who the other insiders were, only that it received a patch from the researcher, and the go-ahead to fix an important security problem. Suggesting that the correct response was to sit on the patch for months leaving users exposed to a security bug is unreasonable to place on any open source project. You should read the rest of what you linked, and check the dates carefully.
      - cthalupa 9y ago
        Yes or no: Was OpenBSD asked by the researcher to respect the CERT requested embargo extension?
        tedunangst 9y ago
        Denying a request you haven't agreed to isn't breaking an agreement.
        cthalupa 9y ago
        It's still irresponsible in the face of everyone else agreeing to it. The researcher informed them in good faith, they did not return it when the situation changed.
    - Mordak 9y ago
      Wow, that's some seriously selective quoting from the krackattacks link there. The one that is relevant to the question of whether or not OpenBSD patched early without permission is this: > As a compromise, I allowed them to silently patch the vulnerability. It's pretty easy to argue that OpenBSD doesn't like embargoes, but it's pretty hard to argue that they ignore embargoes and patch whenever they want to. In this specific case, the project asked and received permission to patch early. The fact that the researcher regrets this in hindsight is beside the point.
      - cthalupa 9y ago
- Fnoord 9y ago
  Hmm, not sure what exactly happened with [1] (remotely exploitable vulnerable in OpenSSH in 2006). Did the OpenSSH team follow responsible disclosure there? [1] https://www.openssh.com/txt/preauth.adv https://www.openssh.com/txt/preauth.adv

by brynet 9y ago

cthalupa 9y ago

OpenBSD followed the original embargo, and got asked to extend it based on the CERT response. You guys said no, and the security researcher shrugged and went 'Well, okay, I guess.' When everyone else is agreeing to the extended embargo, I personally can't say that I feel like OpenBSD respected the embargo there. It's also not limited to just KRACK. With the OpenSSL/LibreSSL stuff back in 2015, OpenBSD wasn't part of the disclosure because Theo said he wasn't going to deal with an email-list or embargoes prior to that. Marc Espie has said he thinks it's a good thing that the KRACK embargo was broken early.

brynet 9y ago
That's not how it happened, that's the narrative you're spinning, certainly. https://twitter.com/vanhoefm/status/921425715903463425 https://twitter.com/vanhoefm/status/921425715903463425
- cthalupa 9y ago
  Please explain how that is not what happened? That tweet does not contradict me in the slightest. In fact, your original link is quite explicit. >Then he got CERT (and, thus, US gov agencies) involved and had to extend the embargo even further until today. At that point we already had the ball rolling and decided to stick to the original agreement with him, and he gave us an agreeing nod towards that as well. So, stsp pretty specifically says "It got extended, we decided not to follow the new date, and he went 'well, okay'" https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd >To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo. If OpenBSD did nothing wrong, it seems quite odd that the same person who you are saying was fully on board with it is now explicitly saying he is going to provide late notifications.
  - brynet 9y ago
    OpenBSD had no idea who the other insiders were, only that it received a patch from the researcher, and the go-ahead to fix an important security problem. Suggesting that the correct response was to sit on the patch for months leaving users exposed to a security bug is unreasonable to place on any open source project. You should read the rest of what you linked, and check the dates carefully.
    - cthalupa 9y ago
      Yes or no: Was OpenBSD asked by the researcher to respect the CERT requested embargo extension?
      - tedunangst 9y ago
        Denying a request you haven't agreed to isn't breaking an agreement.
        cthalupa 9y ago
        It's still irresponsible in the face of everyone else agreeing to it. The researcher informed them in good faith, they did not return it when the situation changed.
  - Mordak 9y ago
    Wow, that's some seriously selective quoting from the krackattacks link there. The one that is relevant to the question of whether or not OpenBSD patched early without permission is this: > As a compromise, I allowed them to silently patch the vulnerability. It's pretty easy to argue that OpenBSD doesn't like embargoes, but it's pretty hard to argue that they ignore embargoes and patch whenever they want to. In this specific case, the project asked and received permission to patch early. The fact that the researcher regrets this in hindsight is beside the point.
    - cthalupa 9y ago
Fnoord 9y ago
Hmm, not sure what exactly happened with [1] (remotely exploitable vulnerable in OpenSSH in 2006). Did the OpenSSH team follow responsible disclosure there? [1] https://www.openssh.com/txt/preauth.adv https://www.openssh.com/txt/preauth.adv