3 ms·

Maybe I should have said Theo rather than OpenBSD? But seriously, look at the Lazy FPU thing -- someone leaked it to Theo, and his immediate response wasn't "g

Maybe I should have said Theo rather than OpenBSD? But seriously, look at the Lazy FPU thing -- someone leaked it to Theo, and his immediate response wasn't "gee, this sounds serious, I should work together with other vendors to make sure that we can all get this fixed"; it was "let's publicly disclose the vulnerability at the soonest opportunity". I'm not saying that he has agreed to embargoes and then broken them. I'm saying that he has made it clear that he isn't interested in acting as a productive member of the community.

tedunangst 8y ago
I think you've been cut out of enough embargoes to understand the openbsd position. Embargoes hurt users. The decision to not work together on lazy FPU was made before Theo got involved. What Theo and others, including myself, have made clear is that embargoes suck, and we will complain about them as is our right, but we will attempt to honor them if that's how it going to be.
- cperciva 8y ago
  I think you've been cut out of enough embargoes to understand the openbsd position. Embargoes hurt users. I disagree. Embargoes are good for users, as long as (a) people actually respect the embargoes (rather than leaking details, whether to Theo or on a public Linux kernel mailing list), (b) the right people are part of the embargo, and (c) the embargo is not unreasonable long (Intel in particular fails here). The decision to not work together on lazy FPU was made before Theo got involved. Leaving aside the question of who refused to sign an NDA, after details were leaked to Theo he made a decision to go public rather than attempting to work productively with other vendors. What Theo and others, including myself, have made clear is that embargoes suck, and we will complain about them as is our right, but we will attempt to honor them if that's how it going to be. You can complain all you want, but if you want other people to give you advance notice of vulnerabilities they find, you should be prepared to give people advance notice of vulnerabilities you find. As long as OpenBSD has a policy of "bugs we find get fixed immediately, without talking to other vendors" you're going to run into problems here.
  - throwaway2048 8y ago
    Those "Other vendors" (Intel) did not contact OpenBSD, and did not reply when OpenBSD contacted them. Who exactly wasn't willing to work with who here? Is OpenBSD supposed to comply with secret terms that they are purposely not made aware of, nor have agreed to? That's a pretty unfair standard don't you think?
    - mappu 8y ago
      > Is OpenBSD supposed to comply with secret terms that they are purposely not made aware of, nor have agreed to? You discovered the secret, but recognize that embargoes still have value even if you weren't part of it. Be the better project, show magnanimity, and don't place end users of other projects at undue risk. > That's a pretty unfair standard don't you think? "An eye for an eye makes the whole world blind".
      - throwaway2048 8y ago
        That makes a giant assumption that 12 month long embargoes protect anyone's safety (which is extremely dubious) Its pretty much beyond debate that multiple malicious parties knew about the Intel issues many months before they were allowed to be fixed. Coordinated disclosure is not some kind of unmitigated good.
        cperciva 8y ago
        I agree that 12 month embargoes are stupid. I know that there are people, including FreeBSD people, who have been vigorously encouraging Intel to be more reasonable about how such issues are handled. I played a small role in that after Theo announced the Lazy FPU issue, by writing exploit code and telling Intel (via the FreeBSD people in the embargo) "shorten the embargo or else".
        busterarm 8y ago
        Given how much Intel likes to throw their weight around wrt embargo terms well past the point of being unreasonable, maybe it's a good thing that someone holds a gun to their head every once in a while. If you want to lead market in mission-critical product, there's a certain amount of responsibility that you have to your customers and more than once Intel has lost sight of that.
mfukar 8y ago
> it was "let's publicly disclose the vulnerability at the soonest opportunity". > ... > he has made it clear that he isn't interested in acting as a productive member of the community. Don't project your opinions about disclosure to other people and their intentions.
throwaway2048 8y ago
If somebody purposely snubs you and dosen't include you in an embargo, why exactly is it your responsibility to maintain it?
deleted 8y ago
[deleted]

tedunangst 8y ago

I think you've been cut out of enough embargoes to understand the openbsd position. Embargoes hurt users. The decision to not work together on lazy FPU was made before Theo got involved. What Theo and others, including myself, have made clear is that embargoes suck, and we will complain about them as is our right, but we will attempt to honor them if that's how it going to be.

cperciva 8y ago
I think you've been cut out of enough embargoes to understand the openbsd position. Embargoes hurt users. I disagree. Embargoes are good for users, as long as (a) people actually respect the embargoes (rather than leaking details, whether to Theo or on a public Linux kernel mailing list), (b) the right people are part of the embargo, and (c) the embargo is not unreasonable long (Intel in particular fails here). The decision to not work together on lazy FPU was made before Theo got involved. Leaving aside the question of who refused to sign an NDA, after details were leaked to Theo he made a decision to go public rather than attempting to work productively with other vendors. What Theo and others, including myself, have made clear is that embargoes suck, and we will complain about them as is our right, but we will attempt to honor them if that's how it going to be. You can complain all you want, but if you want other people to give you advance notice of vulnerabilities they find, you should be prepared to give people advance notice of vulnerabilities you find. As long as OpenBSD has a policy of "bugs we find get fixed immediately, without talking to other vendors" you're going to run into problems here.
- throwaway2048 8y ago
  Those "Other vendors" (Intel) did not contact OpenBSD, and did not reply when OpenBSD contacted them. Who exactly wasn't willing to work with who here? Is OpenBSD supposed to comply with secret terms that they are purposely not made aware of, nor have agreed to? That's a pretty unfair standard don't you think?
  - mappu 8y ago
    > Is OpenBSD supposed to comply with secret terms that they are purposely not made aware of, nor have agreed to? You discovered the secret, but recognize that embargoes still have value even if you weren't part of it. Be the better project, show magnanimity, and don't place end users of other projects at undue risk. > That's a pretty unfair standard don't you think? "An eye for an eye makes the whole world blind".
    - throwaway2048 8y ago
      That makes a giant assumption that 12 month long embargoes protect anyone's safety (which is extremely dubious) Its pretty much beyond debate that multiple malicious parties knew about the Intel issues many months before they were allowed to be fixed. Coordinated disclosure is not some kind of unmitigated good.
      - cperciva 8y ago
        I agree that 12 month embargoes are stupid. I know that there are people, including FreeBSD people, who have been vigorously encouraging Intel to be more reasonable about how such issues are handled. I played a small role in that after Theo announced the Lazy FPU issue, by writing exploit code and telling Intel (via the FreeBSD people in the embargo) "shorten the embargo or else".
        busterarm 8y ago
        Given how much Intel likes to throw their weight around wrt embargo terms well past the point of being unreasonable, maybe it's a good thing that someone holds a gun to their head every once in a while. If you want to lead market in mission-critical product, there's a certain amount of responsibility that you have to your customers and more than once Intel has lost sight of that.

mfukar 8y ago

> it was "let's publicly disclose the vulnerability at the soonest opportunity". > ... > he has made it clear that he isn't interested in acting as a productive member of the community. Don't project your opinions about disclosure to other people and their intentions.

throwaway2048 8y ago

If somebody purposely snubs you and dosen't include you in an embargo, why exactly is it your responsibility to maintain it?

deleted 8y ago

[deleted]