4 ms·
OpenSSH 9.3/9.3p1
- cperciva 4y agoSorry guys, this is my fault. I was going to start builds for the final release candidate for FreeBSD 13.2 in a few hours.
- EE84M3i 4y agofwiw, releases like this (and especially the notes) give me more confidence in the security of OpenSSH, not less.
- cperciva 4y agoOh, I'm not saying that they shouldn't have released this. Of course they should. It's just creepy how often OpenSSH and OpenSSL security fixes happen just before we do a release.
- fmajid 4y agoDon't forget LibreSSL, which dropped 3.7.1 today.
- Smar 4y agoMaybe they're just triggering major releases whenever they get incoming security issue(s), to reduce release overflow?
- brynet 4y agoOpenBSD is currently in release mode, 7.3 is due out in April. Happens every 6 months like clockwork.
- ArchOversight 4y agoWe users of FreeBSD appreciate your hard work Colin!
- cperciva 4y agoThanks! This was a promotion I never wanted, but I'm doing my best to muddle through the release process.
- riobard 4y agoProbably off topic, but is it worth the trouble to (re)write critical infra software like SSH in memory-safe languages? From the release note this seems a minor issue, but given the importance of SSH in auth, maybe it isn't too crazy to think about the possibilities?
- enriquto 4y agoNot all bugs are memory bugs. A memory-safe re-implementation would likewise introduce many new bugs, so it would not be necessarily better than the battle-tested current implementation. That said, re-implementations are always cool.
- mrweasel 4y agoIf I recall correctly having most of the world relying on a single SSH implementation was raised as a concern by the OpenBSD/OpenSSH developers when HeartBleed happened and OpenBSD forked OpenSSL. A major security problem in OpenSSH would be a huge issue, as it affects everyone at once. If someone where to do a reimplementation in a memory-safe language, and let's face it, that's a sly way of saying Rust, it shouldn't be viewed as a replacement for OpenSSH, but as an alternative to existing along side it.
- Fnoord 4y ago> A major security problem in OpenSSH would be a huge issue, as it affects everyone at once. It happened once in OpenSSH (in the '00s), and that's it. Ever since, it got hardened. Same with OpenSSL's Heartbleed. We've adapted to these occurrences.
- zie 4y agoI agree the probability is low, but it's clearly not 0, nor will it ever be 0. Is it close enough to 0 as to be not worth worrying about? I don't know the answer to that question but I'd guess it's far enough away from zero that it could definitely be a concern. Especially since we know that upgrades can be quite slow, especially in the consumer space(if they are ever done at all). Another worry, is now every platform uses OpenSSH (Microsoft, Apple and *nix all use OpenSSH). 22-ish years without a major security problem is a great track record though.
- deleted 4y ago[deleted]
- jamiesonbecker 4y agoThanks Colin, this is great! The new unprivileged sshd -G to do auditing of the SSH configuration will be really useful when we start putting SSH daemon auditing into Userify.