3 ms·

OpenBSD followed the original embargo, and got asked to extend it based on the CERT response. You guys said no, and the security researcher shrugged and went 'W

OpenBSD followed the original embargo, and got asked to extend it based on the CERT response. You guys said no, and the security researcher shrugged and went 'Well, okay, I guess.' When everyone else is agreeing to the extended embargo, I personally can't say that I feel like OpenBSD respected the embargo there. It's also not limited to just KRACK. With the OpenSSL/LibreSSL stuff back in 2015, OpenBSD wasn't part of the disclosure because Theo said he wasn't going to deal with an email-list or embargoes prior to that. Marc Espie has said he thinks it's a good thing that the KRACK embargo was broken early.

brynet 9y ago
That's not how it happened, that's the narrative you're spinning, certainly. https://twitter.com/vanhoefm/status/921425715903463425 https://twitter.com/vanhoefm/status/921425715903463425
- cthalupa 9y ago
  Please explain how that is not what happened? That tweet does not contradict me in the slightest. In fact, your original link is quite explicit. >Then he got CERT (and, thus, US gov agencies) involved and had to extend the embargo even further until today. At that point we already had the ball rolling and decided to stick to the original agreement with him, and he gave us an agreeing nod towards that as well. So, stsp pretty specifically says "It got extended, we decided not to follow the new date, and he went 'well, okay'" https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd >To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo. If OpenBSD did nothing wrong, it seems quite odd that the same person who you are saying was fully on board with it is now explicitly saying he is going to provide late notifications.
  - brynet 9y ago
    OpenBSD had no idea who the other insiders were, only that it received a patch from the researcher, and the go-ahead to fix an important security problem. Suggesting that the correct response was to sit on the patch for months leaving users exposed to a security bug is unreasonable to place on any open source project. You should read the rest of what you linked, and check the dates carefully.
    - cthalupa 9y ago
      Yes or no: Was OpenBSD asked by the researcher to respect the CERT requested embargo extension?
      - tedunangst 9y ago
        Denying a request you haven't agreed to isn't breaking an agreement.
        cthalupa 9y ago
        It's still irresponsible in the face of everyone else agreeing to it. The researcher informed them in good faith, they did not return it when the situation changed.
  - Mordak 9y ago
    Wow, that's some seriously selective quoting from the krackattacks link there. The one that is relevant to the question of whether or not OpenBSD patched early without permission is this: > As a compromise, I allowed them to silently patch the vulnerability. It's pretty easy to argue that OpenBSD doesn't like embargoes, but it's pretty hard to argue that they ignore embargoes and patch whenever they want to. In this specific case, the project asked and received permission to patch early. The fact that the researcher regrets this in hindsight is beside the point.
    - cthalupa 9y ago
      They were asked to respect the extended embargo from CERT. They argued against doing so. The researcher going "Well, fine, we had previously agreed on this date, so do it" after trying to get them to respect the extension is not the same as the researcher going "yeah man just release it now it's all good." He regrets coming to that compromise when they pushed back. They still pushed back and did not want to follow the extension.
Fnoord 9y ago
Hmm, not sure what exactly happened with [1] (remotely exploitable vulnerable in OpenSSH in 2006). Did the OpenSSH team follow responsible disclosure there? [1] https://www.openssh.com/txt/preauth.adv https://www.openssh.com/txt/preauth.adv

brynet 9y ago

That's not how it happened, that's the narrative you're spinning, certainly. https://twitter.com/vanhoefm/status/921425715903463425 https://twitter.com/vanhoefm/status/921425715903463425

cthalupa 9y ago
Please explain how that is not what happened? That tweet does not contradict me in the slightest. In fact, your original link is quite explicit. >Then he got CERT (and, thus, US gov agencies) involved and had to extend the embargo even further until today. At that point we already had the ball rolling and decided to stick to the original agreement with him, and he gave us an agreeing nod towards that as well. So, stsp pretty specifically says "It got extended, we decided not to follow the new date, and he went 'well, okay'" https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd >To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo. If OpenBSD did nothing wrong, it seems quite odd that the same person who you are saying was fully on board with it is now explicitly saying he is going to provide late notifications.
- brynet 9y ago
  OpenBSD had no idea who the other insiders were, only that it received a patch from the researcher, and the go-ahead to fix an important security problem. Suggesting that the correct response was to sit on the patch for months leaving users exposed to a security bug is unreasonable to place on any open source project. You should read the rest of what you linked, and check the dates carefully.
  - cthalupa 9y ago
    Yes or no: Was OpenBSD asked by the researcher to respect the CERT requested embargo extension?
    - tedunangst 9y ago
      Denying a request you haven't agreed to isn't breaking an agreement.
      - cthalupa 9y ago
        It's still irresponsible in the face of everyone else agreeing to it. The researcher informed them in good faith, they did not return it when the situation changed.
- Mordak 9y ago
  Wow, that's some seriously selective quoting from the krackattacks link there. The one that is relevant to the question of whether or not OpenBSD patched early without permission is this: > As a compromise, I allowed them to silently patch the vulnerability. It's pretty easy to argue that OpenBSD doesn't like embargoes, but it's pretty hard to argue that they ignore embargoes and patch whenever they want to. In this specific case, the project asked and received permission to patch early. The fact that the researcher regrets this in hindsight is beside the point.
  - cthalupa 9y ago
    They were asked to respect the extended embargo from CERT. They argued against doing so. The researcher going "Well, fine, we had previously agreed on this date, so do it" after trying to get them to respect the extension is not the same as the researcher going "yeah man just release it now it's all good." He regrets coming to that compromise when they pushed back. They still pushed back and did not want to follow the extension.

Fnoord 9y ago

Hmm, not sure what exactly happened with [1] (remotely exploitable vulnerable in OpenSSH in 2006). Did the OpenSSH team follow responsible disclosure there? [1] https://www.openssh.com/txt/preauth.adv https://www.openssh.com/txt/preauth.adv