3 ms·

For some of us who aren't OS enthusiasts: can anyone provide an ELI5 or deeper context links?

Lazare 8y ago
There's a serious bug that impacts a number of operating systems, including OpenBSD. In order to coordinate a release, some vendors were made aware of the bug before it was publically disclosed, but OpenBSD was not one of them, probably because OpenBSD has a reputation (fairly or not) as being very anti-secrecy, not being cooperative in situations like this, and not providing other vendors advance notice of issues they find. OpenBSD is, understandably, upset that they ended up shipping a bug when they could easily have delayed the release had they been made aware of it. Whether that's a legitimate complaint, or simply their just deserts given their past behaviour, or somewhere in between is something I'm not remotely qualified to answer. In any case, if people won't trust you to follow embargoes, you'll end up shipping bugs, and angrily complaining on public mailing lists that people don't trust you won't make people start trusting you. (For one thing, notably absent from the linked post was a "we would have course adhered to the embargo if we'd been asked", which leaves the question open of whether not trusting them, in this specific case, may not have been correct. In any case, this will be resolved, if it's resolved, in private between concerned individuals.)
- owenmarshall 8y ago
  To add a wrinkle that may be missed from a quick read of Theo’s post: OpenBSD’s X maintainer is on the X.org security team - that’s the Matthieu referenced. So it’s possible that an entirely human set of mistakes occurred that lead to this happening; it’s also possible that embargoed bugs came in to play.
  - Lazare 8y ago
    Yes. Simple oversight is possible. Alternatively, if it is a trust issue, the fact that it's not just "the X.org security team doesn't trust the OpenBSD maintainer team" but "the OpenBSD X maintainer doesn't trust the rest of the OpenBSD maintainer team" adds several extra levels of politics to this, which I suspect is what Theo was alluding to with his "abdication of the duty of care" comment. I assume Matthieu acted (if that is indeed what he did) in his role as a member of the X security team, but I imagine Theo would say that in doing so he failed to act appropriately in his role as a member of the OpenBSD maintenance team. It all makes me quite interested to know what his reasoning was.

There's a serious bug that impacts a number of operating systems, including OpenBSD. In order to coordinate a release, some vendors were made aware of the bug before it was publically disclosed, but OpenBSD was not one of them, probably because OpenBSD has a reputation (fairly or not) as being very anti-secrecy, not being cooperative in situations like this, and not providing other vendors advance notice of issues they find. OpenBSD is, understandably, upset that they ended up shipping a bug when they could easily have delayed the release had they been made aware of it. Whether that's a legitimate complaint, or simply their just deserts given their past behaviour, or somewhere in between is something I'm not remotely qualified to answer. In any case, if people won't trust you to follow embargoes, you'll end up shipping bugs, and angrily complaining on public mailing lists that people don't trust you won't make people start trusting you. (For one thing, notably absent from the linked post was a "we would have course adhered to the embargo if we'd been asked", which leaves the question open of whether not trusting them, in this specific case, may not have been correct. In any case, this will be resolved, if it's resolved, in private between concerned individuals.)

owenmarshall 8y ago
To add a wrinkle that may be missed from a quick read of Theo’s post: OpenBSD’s X maintainer is on the X.org security team - that’s the Matthieu referenced. So it’s possible that an entirely human set of mistakes occurred that lead to this happening; it’s also possible that embargoed bugs came in to play.
- Lazare 8y ago
  Yes. Simple oversight is possible. Alternatively, if it is a trust issue, the fact that it's not just "the X.org security team doesn't trust the OpenBSD maintainer team" but "the OpenBSD X maintainer doesn't trust the rest of the OpenBSD maintainer team" adds several extra levels of politics to this, which I suspect is what Theo was alluding to with his "abdication of the duty of care" comment. I assume Matthieu acted (if that is indeed what he did) in his role as a member of the X security team, but I imagine Theo would say that in doing so he failed to act appropriately in his role as a member of the OpenBSD maintenance team. It all makes me quite interested to know what his reasoning was.