6 ms·

That's not how it happened, that's the narrative you're spinning, certainly. https://twitter.com/vanhoefm/status/921425715903463425 https://twitter.com/vanhoef

by brynet 9y ago

That's not how it happened, that's the narrative you're spinning, certainly. https://twitter.com/vanhoefm/status/921425715903463425 https://twitter.com/vanhoefm/status/921425715903463425

cthalupa 9y ago
Please explain how that is not what happened? That tweet does not contradict me in the slightest. In fact, your original link is quite explicit. >Then he got CERT (and, thus, US gov agencies) involved and had to extend the embargo even further until today. At that point we already had the ball rolling and decided to stick to the original agreement with him, and he gave us an agreeing nod towards that as well. So, stsp pretty specifically says "It got extended, we decided not to follow the new date, and he went 'well, okay'" https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd >To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo. If OpenBSD did nothing wrong, it seems quite odd that the same person who you are saying was fully on board with it is now explicitly saying he is going to provide late notifications.
- brynet 9y ago
  OpenBSD had no idea who the other insiders were, only that it received a patch from the researcher, and the go-ahead to fix an important security problem. Suggesting that the correct response was to sit on the patch for months leaving users exposed to a security bug is unreasonable to place on any open source project. You should read the rest of what you linked, and check the dates carefully.
  - cthalupa 9y ago
    Yes or no: Was OpenBSD asked by the researcher to respect the CERT requested embargo extension?
    - tedunangst 9y ago
      Denying a request you haven't agreed to isn't breaking an agreement.
      - cthalupa 9y ago
        It's still irresponsible in the face of everyone else agreeing to it. The researcher informed them in good faith, they did not return it when the situation changed.
- Mordak 9y ago
  Wow, that's some seriously selective quoting from the krackattacks link there. The one that is relevant to the question of whether or not OpenBSD patched early without permission is this: > As a compromise, I allowed them to silently patch the vulnerability. It's pretty easy to argue that OpenBSD doesn't like embargoes, but it's pretty hard to argue that they ignore embargoes and patch whenever they want to. In this specific case, the project asked and received permission to patch early. The fact that the researcher regrets this in hindsight is beside the point.
  - cthalupa 9y ago
    They were asked to respect the extended embargo from CERT. They argued against doing so. The researcher going "Well, fine, we had previously agreed on this date, so do it" after trying to get them to respect the extension is not the same as the researcher going "yeah man just release it now it's all good." He regrets coming to that compromise when they pushed back. They still pushed back and did not want to follow the extension.

by brynet 9y ago

That's not how it happened, that's the narrative you're spinning, certainly. https://twitter.com/vanhoefm/status/921425715903463425 https://twitter.com/vanhoefm/status/921425715903463425

cthalupa 9y ago

Please explain how that is not what happened? That tweet does not contradict me in the slightest. In fact, your original link is quite explicit. >Then he got CERT (and, thus, US gov agencies) involved and had to extend the embargo even further until today. At that point we already had the ball rolling and decided to stick to the original agreement with him, and he gave us an agreeing nod towards that as well. So, stsp pretty specifically says "It got extended, we decided not to follow the new date, and he went 'well, okay'" https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd >To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo. If OpenBSD did nothing wrong, it seems quite odd that the same person who you are saying was fully on board with it is now explicitly saying he is going to provide late notifications.

brynet 9y ago
OpenBSD had no idea who the other insiders were, only that it received a patch from the researcher, and the go-ahead to fix an important security problem. Suggesting that the correct response was to sit on the patch for months leaving users exposed to a security bug is unreasonable to place on any open source project. You should read the rest of what you linked, and check the dates carefully.
- cthalupa 9y ago
  Yes or no: Was OpenBSD asked by the researcher to respect the CERT requested embargo extension?
  - tedunangst 9y ago
    Denying a request you haven't agreed to isn't breaking an agreement.
    - cthalupa 9y ago
      It's still irresponsible in the face of everyone else agreeing to it. The researcher informed them in good faith, they did not return it when the situation changed.
Mordak 9y ago
Wow, that's some seriously selective quoting from the krackattacks link there. The one that is relevant to the question of whether or not OpenBSD patched early without permission is this: > As a compromise, I allowed them to silently patch the vulnerability. It's pretty easy to argue that OpenBSD doesn't like embargoes, but it's pretty hard to argue that they ignore embargoes and patch whenever they want to. In this specific case, the project asked and received permission to patch early. The fact that the researcher regrets this in hindsight is beside the point.
- cthalupa 9y ago
  They were asked to respect the extended embargo from CERT. They argued against doing so. The researcher going "Well, fine, we had previously agreed on this date, so do it" after trying to get them to respect the extension is not the same as the researcher going "yeah man just release it now it's all good." He regrets coming to that compromise when they pushed back. They still pushed back and did not want to follow the extension.