3 ms·
The man who changed Internet security
- cperciva 18y agoI don't think this issue is quite as serious as Dan Kaminsky is making it sound; but I'll say this for him: He's great at wrangling the media. Is this bigger than past coordinated advisories? Maybe -- but not by much. A major flaw in OpenSSL, OpenSSH, Sendmail, or IPv6 (e.g., the recent 'source routing' issue) would all be just as "big" as this. Dan did exactly what any responsible researcher would do -- nothing more.
- nickb 18y agoIt is. Both Thomas Ptacek and Dino Dai Zovi say they were wrong in thinking it was not a big thing. Read this: http://blog.trailofbits.com/2008/07/09/dan-kaminsky-disqualified-from-most-overhyped-bug-pwnie/ http://blog.trailofbits.com/2008/07/09/dan-kaminsky-disquali... http://www.matasano.com/log/1093/patch-your-non-djbdns-server-now-dan-was-right-i-was-wrong/ http://www.matasano.com/log/1093/patch-your-non-djbdns-serve...
- cperciva 18y agoBoth Thomas Ptacek and Dino Dai Zovi say they were wrong in thinking it was not a big thing. Yes, I know. I was part of the pre-notified group. To clarify: Ptacek and Dai Zovi were wrong in thinking that this attack is not a big thing, and changed their mind when they heard more details. Having those details, I agree that this is big -- just not as big as Kaminsky is making it sound.
- nickb 18y agoBut were you told the details and you still think it's no big deal?
- cperciva 18y agoYes, I was told the details. I don't think it's "no big deal" -- I think it's not as big of a deal as Kaminsky makes it sound.
- tptacek 18y agoThis is a DNS forgery attack that, among other problems, works as effectively as a drive-by XSS. The patch for many organizations involves network rearchitecture. How many firewall rules had to change last time OpenSSH gave up remote code execution? Is it the worst vulnerability ever? No. But your counterexamples are egregiously off.