6 ms·

OpenBSD doesn't keep secrets. The X.org team had to keep this secret, so they couldn't tell OpenBSD. If OpenBSD starts participating in embargoes, they'll get

OpenBSD doesn't keep secrets. The X.org team had to keep this secret, so they couldn't tell OpenBSD. If OpenBSD starts participating in embargoes, they'll get advance notice of vulnerabilities. It's as simple as that.

deleted 8y ago
[deleted]
- deleted 8y ago
  [deleted]
tedunangst 8y ago
Come on, you know better than that.
- cperciva 8y ago
  Maybe I should have said Theo rather than OpenBSD? But seriously, look at the Lazy FPU thing -- someone leaked it to Theo, and his immediate response wasn't "gee, this sounds serious, I should work together with other vendors to make sure that we can all get this fixed"; it was "let's publicly disclose the vulnerability at the soonest opportunity". I'm not saying that he has agreed to embargoes and then broken them. I'm saying that he has made it clear that he isn't interested in acting as a productive member of the community.
  - tedunangst 8y ago
    I think you've been cut out of enough embargoes to understand the openbsd position. Embargoes hurt users. The decision to not work together on lazy FPU was made before Theo got involved. What Theo and others, including myself, have made clear is that embargoes suck, and we will complain about them as is our right, but we will attempt to honor them if that's how it going to be.
    - cperciva 8y ago
      I think you've been cut out of enough embargoes to understand the openbsd position. Embargoes hurt users. I disagree. Embargoes are good for users, as long as (a) people actually respect the embargoes (rather than leaking details, whether to Theo or on a public Linux kernel mailing list), (b) the right people are part of the embargo, and (c) the embargo is not unreasonable long (Intel in particular fails here). The decision to not work together on lazy FPU was made before Theo got involved. Leaving aside the question of who refused to sign an NDA, after details were leaked to Theo he made a decision to go public rather than attempting to work productively with other vendors. What Theo and others, including myself, have made clear is that embargoes suck, and we will complain about them as is our right, but we will attempt to honor them if that's how it going to be. You can complain all you want, but if you want other people to give you advance notice of vulnerabilities they find, you should be prepared to give people advance notice of vulnerabilities you find. As long as OpenBSD has a policy of "bugs we find get fixed immediately, without talking to other vendors" you're going to run into problems here.
      - throwaway2048 8y ago
        Those "Other vendors" (Intel) did not contact OpenBSD, and did not reply when OpenBSD contacted them. Who exactly wasn't willing to work with who here? Is OpenBSD supposed to comply with secret terms that they are purposely not made aware of, nor have agreed to? That's a pretty unfair standard don't you think?
        mappu 8y ago
        > Is OpenBSD supposed to comply with secret terms that they are purposely not made aware of, nor have agreed to? You discovered the secret, but recognize that embargoes still have value even if you weren't part of it. Be the better project, show magnanimity, and don't place end users of other projects at undue risk. > That's a pretty unfair standard don't you think? "An eye for an eye makes the whole world blind".
        8y ago
  - mfukar 8y ago
    > it was "let's publicly disclose the vulnerability at the soonest opportunity". > ... > he has made it clear that he isn't interested in acting as a productive member of the community. Don't project your opinions about disclosure to other people and their intentions.
  - throwaway2048 8y ago
    If somebody purposely snubs you and dosen't include you in an embargo, why exactly is it your responsibility to maintain it?
  - deleted 8y ago
    [deleted]
kroeckx 8y ago
At least Theo has a reputation for breaking embargoes. If he wants to get notified, he should work on changing that reputation. [edit: It's probably more accurate to say that Theo doesn't want to agree to an embargo.]
- tedunangst 8y ago
  How can Theo control what people post on HN?
- tiles 8y ago
  Isn't this untrue? https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd
- ori_b 8y ago
  > At least Theo has a reputation for breaking embargoes. If he wants to get notified, he should work on changing that reputation. Given that nobody here seems to be able to point to a single embargo that has been broken, how exactly do you propose he do that?
  - Maxious 8y ago
    "There is a related issue in that OpenBSD broke the embargo by publicly committing a patch to add a 1MB stack guard on May 18 — one day after the private disclosure of the problem. This has raised a number of questions, including whether OpenBSD (which is not a member of the distros list) should be included in embargoed disclosures in the future." https://lwn.net/Articles/726580/ https://lwn.net/Articles/726580/
eridius 8y ago
Would it have been possible to tell Theo "hey, a serious issue is going to be released at <deadline>. I know you have a big release coming up. I strongly advise you to delay the release by a week so you can properly react to the disclosure. I'd tell you now, but I don't trust you not to break the embargo". I don't know if it would actually work, but that would at least put responsibility for handling this on Theo.
- cperciva 8y ago
  I was dealing with a multi-vendor security vulnerability in 2005. I asked Theo some questions, determined that OpenBSD wasn't affected, and told him "ok, nothing to worry about here". Theo's response was to (a) announce to the world at large that I was coordinating disclosure of a major vulnerability, and (b) threaten to withhold information about OpenSSH vulnerabilities from FreeBSD unless I shared details about this vulnerability with him -- even though it didn't affect OpenBSD! So... my best guess is that Theo's response to your proposed email would be "hey everyone, eridius is going to be announcing a vulnerability at <deadline> and he's refusing to tell me what it is".
  - eridius 8y ago
    Wow that's pretty awful. I kinda get the rationale for breaking embargo and disclosing information about a vulnerability to the world. I don't agree with it, but I at least understand why someone might think that's a reasonable thing to do. I don't at all understand why anyone would try to publicly announce the fact that a vulnerability exists without actually knowing the details. The fact that the exists some vulnerability in a product doesn't give you enough information to protect yourself from it (short of not using the product at all, but that's generally infeasible). But the knowledge that there is a critical vulnerability in a product does give malicious actors reason to dedicate effort towards probing that product to try and rediscover the vulnerability. So announcing this helps nobody and potentially causes great harm.
    - busterarm 8y ago
      What? It's not just malicious actors that work on researching this stuff. Spectre and Meltdown leaked well ahead (5 months ahead, in fact, even though nobody paid attention) of the the embargoed patch. People found exploits and started working on defense before the official patches released. Good research into similar vulnerabilities got a huge head start rather than having to wait. You should assume that well-funded, capable and malicious (at least from someone's perspective) state-level actors are aware of and exploiting these flaws _whenever_ they exist. It's their mandate to do so.
naner 8y ago
I see this comment on every discussion regarding OpenBSD and security vulnerability embargoes. Have they stated they won't stick to embargoes or agreed to one and then broke it in the past?
- tedunangst 8y ago
  Facts don't matter in the narrative zone.
  - GavinMcG 8y ago
    Without actually answering the question asked or clarifying what you're referring to, your comment is not a good contribution.
    - busterarm 8y ago
      tedu is one of the more prolific OpenBSD contributors and has had a front-row seat to the goings-on for a long time. If his experience is that "facts don't matter", literally how can he provide you any kind of contribution that would satisfy you that also doesn't contradict himself? It's an important opinion, without any unnecessary words added.
      - GavinMcG 8y ago
        Well, saying that he's one of the more prolific OpenBSD contributors and has had a front row seat would obviously be a good start...
- deleted 8y ago
  [deleted]
- beatgammit 8y ago
  There's the KRACK vulnerability issue [1] where OpenBSD pushed a minor patch and published information on the originally agreed embargo date, which was extended. OpenBSD made sure to not mention the attack and instead say that it was fixing an OpenBSD-specific issue, and others agreed that it didn't constitute a violation of the embargo agreement. However, given Theo de Raadt's colorful past, OpenBSD's relatively small userbase, and this relatively minor incident, I can see how other companies may think that it's not worth the risk of including OpenBSD in an embargo. It's not fair, but it is what it is. [1] https://marc.info/?l=openbsd-tech&m=152910536208954 https://marc.info/?l=openbsd-tech&m=152910536208954
djmdjm 8y ago
Colin, which specific embago(es) has OpenBSD broken?
- sytse 8y ago
  You didn't ask me but I found https://www.reddit.com/r/linux/comments/76ybkv/openbsd_developer_responds_to_the_accusation_that/ https://www.reddit.com/r/linux/comments/76ybkv/openbsd_devel...
  - ori_b 8y ago
    To quote the KRACK site directly: https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd > Why did OpenBSD silently release a patch before the embargo? OpenBSD announced an errata on 30 August 2017 that silently prevented our key reinstallation attacks. More specifically, patches were released for both OpenBSD 6.0 and OpenBSD 6.1. > We notified OpenBSD of the vulnerability on 15 July 2017, before CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt replied and critiqued the tentative disclosure deadline: “In the open source world, if a person writes a diff and has to sit on it for a month, that is very discouraging”. Note that I wrote and included a suggested diff for OpenBSD already, and that at the time the tentative disclosure deadline was around the end of August. As a compromise, I allowed them to silently patch the vulnerability. In hindsight this was a bad decision, since others might rediscover the vulnerability by inspecting their silent patch. To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo. In other words: "We said they could make their users more secure by applying the patch, and they did."
twhb 8y ago
Do you have a source? Google got me only KRACK, which doesn't mesh with your comment. They did participate in that embargo, for six weeks, then refused to extend it to three months because the information was widespread at that point, including to US government agencies, so they felt it likely to be exploited. They communicated this beforehand, got the OK, then patched it silently, which while potentially revealing is no announcement. Their actions seem consistent with a goal of minimizing exploitation across the industry, not some quixotic dedication to non-secrecy. Even the least charitable interpretation of their behavior would lead one to notify them weeks beforehand, not hours.
- LukeShu 8y ago
  Colin Percival was the FreeBSD Security Officer 2005-2012. In that role, he interacted personally with members of the OpenBSD team (and Theo de Raadt in particular) in discussing vulnerabilities with them; this is not necessarily public communication. Elsewhere in this HN thread, he discussed OpenBSD's/Theo's handling of an unspecified vulnerability in 2005, and the "Lazy FPU" vulnerability in 2018. Perhaps one of the more salient bits is when he wrote "I'm not saying that he [Theo] has agreed to embargoes and then broken them. I'm saying that he has made it clear that he isn't interested in acting as a productive member of the community." As a member of the broader security community, and of the BSD security community in particular, Colin is somewhat uniquely qualified to make that statement on his own credibility. Replying to him in the thread is Ted Unangst, a high-profile OpenBSD developer.
  - bjpbakker 8y ago
    > the "Lazy FPU" vulnerability in 2018 You mean that OpenBSD discovered this issue by themselves when they were left out of an ongoing embargo? Please explain to me how one can break an embargo they are not a part of in the first place?
    - cperciva 8y ago
      They didn't discover it themselves. If they had, how would they have known who was part of the embargo and when it was scheduled to end? Someone leaked it to them.

deleted 8y ago

[deleted]

deleted 8y ago
[deleted]

tedunangst 8y ago

Come on, you know better than that.

cperciva 8y ago
Maybe I should have said Theo rather than OpenBSD? But seriously, look at the Lazy FPU thing -- someone leaked it to Theo, and his immediate response wasn't "gee, this sounds serious, I should work together with other vendors to make sure that we can all get this fixed"; it was "let's publicly disclose the vulnerability at the soonest opportunity". I'm not saying that he has agreed to embargoes and then broken them. I'm saying that he has made it clear that he isn't interested in acting as a productive member of the community.
- tedunangst 8y ago
  I think you've been cut out of enough embargoes to understand the openbsd position. Embargoes hurt users. The decision to not work together on lazy FPU was made before Theo got involved. What Theo and others, including myself, have made clear is that embargoes suck, and we will complain about them as is our right, but we will attempt to honor them if that's how it going to be.
  - cperciva 8y ago
    I think you've been cut out of enough embargoes to understand the openbsd position. Embargoes hurt users. I disagree. Embargoes are good for users, as long as (a) people actually respect the embargoes (rather than leaking details, whether to Theo or on a public Linux kernel mailing list), (b) the right people are part of the embargo, and (c) the embargo is not unreasonable long (Intel in particular fails here). The decision to not work together on lazy FPU was made before Theo got involved. Leaving aside the question of who refused to sign an NDA, after details were leaked to Theo he made a decision to go public rather than attempting to work productively with other vendors. What Theo and others, including myself, have made clear is that embargoes suck, and we will complain about them as is our right, but we will attempt to honor them if that's how it going to be. You can complain all you want, but if you want other people to give you advance notice of vulnerabilities they find, you should be prepared to give people advance notice of vulnerabilities you find. As long as OpenBSD has a policy of "bugs we find get fixed immediately, without talking to other vendors" you're going to run into problems here.
    - throwaway2048 8y ago
      Those "Other vendors" (Intel) did not contact OpenBSD, and did not reply when OpenBSD contacted them. Who exactly wasn't willing to work with who here? Is OpenBSD supposed to comply with secret terms that they are purposely not made aware of, nor have agreed to? That's a pretty unfair standard don't you think?
      - mappu 8y ago
        > Is OpenBSD supposed to comply with secret terms that they are purposely not made aware of, nor have agreed to? You discovered the secret, but recognize that embargoes still have value even if you weren't part of it. Be the better project, show magnanimity, and don't place end users of other projects at undue risk. > That's a pretty unfair standard don't you think? "An eye for an eye makes the whole world blind".
        8y ago
- mfukar 8y ago
  > it was "let's publicly disclose the vulnerability at the soonest opportunity". > ... > he has made it clear that he isn't interested in acting as a productive member of the community. Don't project your opinions about disclosure to other people and their intentions.
- throwaway2048 8y ago
  If somebody purposely snubs you and dosen't include you in an embargo, why exactly is it your responsibility to maintain it?
- deleted 8y ago
  [deleted]

kroeckx 8y ago

At least Theo has a reputation for breaking embargoes. If he wants to get notified, he should work on changing that reputation. [edit: It's probably more accurate to say that Theo doesn't want to agree to an embargo.]

tedunangst 8y ago
How can Theo control what people post on HN?
tiles 8y ago
Isn't this untrue? https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd
ori_b 8y ago
> At least Theo has a reputation for breaking embargoes. If he wants to get notified, he should work on changing that reputation. Given that nobody here seems to be able to point to a single embargo that has been broken, how exactly do you propose he do that?
- Maxious 8y ago
  "There is a related issue in that OpenBSD broke the embargo by publicly committing a patch to add a 1MB stack guard on May 18 — one day after the private disclosure of the problem. This has raised a number of questions, including whether OpenBSD (which is not a member of the distros list) should be included in embargoed disclosures in the future." https://lwn.net/Articles/726580/ https://lwn.net/Articles/726580/

eridius 8y ago

Would it have been possible to tell Theo "hey, a serious issue is going to be released at <deadline>. I know you have a big release coming up. I strongly advise you to delay the release by a week so you can properly react to the disclosure. I'd tell you now, but I don't trust you not to break the embargo". I don't know if it would actually work, but that would at least put responsibility for handling this on Theo.

cperciva 8y ago
I was dealing with a multi-vendor security vulnerability in 2005. I asked Theo some questions, determined that OpenBSD wasn't affected, and told him "ok, nothing to worry about here". Theo's response was to (a) announce to the world at large that I was coordinating disclosure of a major vulnerability, and (b) threaten to withhold information about OpenSSH vulnerabilities from FreeBSD unless I shared details about this vulnerability with him -- even though it didn't affect OpenBSD! So... my best guess is that Theo's response to your proposed email would be "hey everyone, eridius is going to be announcing a vulnerability at <deadline> and he's refusing to tell me what it is".
- eridius 8y ago
  Wow that's pretty awful. I kinda get the rationale for breaking embargo and disclosing information about a vulnerability to the world. I don't agree with it, but I at least understand why someone might think that's a reasonable thing to do. I don't at all understand why anyone would try to publicly announce the fact that a vulnerability exists without actually knowing the details. The fact that the exists some vulnerability in a product doesn't give you enough information to protect yourself from it (short of not using the product at all, but that's generally infeasible). But the knowledge that there is a critical vulnerability in a product does give malicious actors reason to dedicate effort towards probing that product to try and rediscover the vulnerability. So announcing this helps nobody and potentially causes great harm.
  - busterarm 8y ago
    What? It's not just malicious actors that work on researching this stuff. Spectre and Meltdown leaked well ahead (5 months ahead, in fact, even though nobody paid attention) of the the embargoed patch. People found exploits and started working on defense before the official patches released. Good research into similar vulnerabilities got a huge head start rather than having to wait. You should assume that well-funded, capable and malicious (at least from someone's perspective) state-level actors are aware of and exploiting these flaws _whenever_ they exist. It's their mandate to do so.

naner 8y ago

I see this comment on every discussion regarding OpenBSD and security vulnerability embargoes. Have they stated they won't stick to embargoes or agreed to one and then broke it in the past?

tedunangst 8y ago
Facts don't matter in the narrative zone.
- GavinMcG 8y ago
  Without actually answering the question asked or clarifying what you're referring to, your comment is not a good contribution.
  - busterarm 8y ago
    tedu is one of the more prolific OpenBSD contributors and has had a front-row seat to the goings-on for a long time. If his experience is that "facts don't matter", literally how can he provide you any kind of contribution that would satisfy you that also doesn't contradict himself? It's an important opinion, without any unnecessary words added.
    - GavinMcG 8y ago
      Well, saying that he's one of the more prolific OpenBSD contributors and has had a front row seat would obviously be a good start...
deleted 8y ago
[deleted]
beatgammit 8y ago
There's the KRACK vulnerability issue [1] where OpenBSD pushed a minor patch and published information on the originally agreed embargo date, which was extended. OpenBSD made sure to not mention the attack and instead say that it was fixing an OpenBSD-specific issue, and others agreed that it didn't constitute a violation of the embargo agreement. However, given Theo de Raadt's colorful past, OpenBSD's relatively small userbase, and this relatively minor incident, I can see how other companies may think that it's not worth the risk of including OpenBSD in an embargo. It's not fair, but it is what it is. [1] https://marc.info/?l=openbsd-tech&m=152910536208954 https://marc.info/?l=openbsd-tech&m=152910536208954

djmdjm 8y ago

Colin, which specific embago(es) has OpenBSD broken?

sytse 8y ago
You didn't ask me but I found https://www.reddit.com/r/linux/comments/76ybkv/openbsd_developer_responds_to_the_accusation_that/ https://www.reddit.com/r/linux/comments/76ybkv/openbsd_devel...
- ori_b 8y ago
  To quote the KRACK site directly: https://www.krackattacks.com/#openbsd https://www.krackattacks.com/#openbsd > Why did OpenBSD silently release a patch before the embargo? OpenBSD announced an errata on 30 August 2017 that silently prevented our key reinstallation attacks. More specifically, patches were released for both OpenBSD 6.0 and OpenBSD 6.1. > We notified OpenBSD of the vulnerability on 15 July 2017, before CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt replied and critiqued the tentative disclosure deadline: “In the open source world, if a person writes a diff and has to sit on it for a month, that is very discouraging”. Note that I wrote and included a suggested diff for OpenBSD already, and that at the time the tentative disclosure deadline was around the end of August. As a compromise, I allowed them to silently patch the vulnerability. In hindsight this was a bad decision, since others might rediscover the vulnerability by inspecting their silent patch. To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo. In other words: "We said they could make their users more secure by applying the patch, and they did."

twhb 8y ago

Do you have a source? Google got me only KRACK, which doesn't mesh with your comment. They did participate in that embargo, for six weeks, then refused to extend it to three months because the information was widespread at that point, including to US government agencies, so they felt it likely to be exploited. They communicated this beforehand, got the OK, then patched it silently, which while potentially revealing is no announcement. Their actions seem consistent with a goal of minimizing exploitation across the industry, not some quixotic dedication to non-secrecy. Even the least charitable interpretation of their behavior would lead one to notify them weeks beforehand, not hours.

LukeShu 8y ago
Colin Percival was the FreeBSD Security Officer 2005-2012. In that role, he interacted personally with members of the OpenBSD team (and Theo de Raadt in particular) in discussing vulnerabilities with them; this is not necessarily public communication. Elsewhere in this HN thread, he discussed OpenBSD's/Theo's handling of an unspecified vulnerability in 2005, and the "Lazy FPU" vulnerability in 2018. Perhaps one of the more salient bits is when he wrote "I'm not saying that he [Theo] has agreed to embargoes and then broken them. I'm saying that he has made it clear that he isn't interested in acting as a productive member of the community." As a member of the broader security community, and of the BSD security community in particular, Colin is somewhat uniquely qualified to make that statement on his own credibility. Replying to him in the thread is Ted Unangst, a high-profile OpenBSD developer.
- bjpbakker 8y ago
  > the "Lazy FPU" vulnerability in 2018 You mean that OpenBSD discovered this issue by themselves when they were left out of an ongoing embargo? Please explain to me how one can break an embargo they are not a part of in the first place?
  - cperciva 8y ago
    They didn't discover it themselves. If they had, how would they have known who was part of the embargo and when it was scheduled to end? Someone leaked it to them.