2 ms·

That's not really good enough though, the distros just enable the build flags that let them do naughty things. The software needs to be opinionated on how to us

by cedws 2y ago

That's not really good enough though, the distros just enable the build flags that let them do naughty things. The software needs to be opinionated on how to use it securely, not leave it up to the users, because the developers that wrote it probably know best! The code simply needs to not exist. If users want to fork and maintain their own insecure branch, let them.

adamrt 2y ago
OpenBSD is also known for this. They constantly push back against adding configuration knobs or running non standard configurations. Have you used OpenBSD? You're telling them they should be doing something, that is already basically their mission statement.
- cedws 2y ago
  Looking at OpenSSH tells a different story. It is a massive, overly configurable behemoth. The 'WireGuard of SSH' would be 1% of the LOC. It would not provide password auth, or let you log in as root with password auth, or let you use old insecure ciphers. Maybe OpenBSD itself is better at sticking to these principles than OpenSSH. I haven't used (experimented with) it for ~5 years but read about various updates every so often.
  - djao 2y ago
    You seem to be confusing "OpenSSH" with "OpenSSH Portable Release". As explained here: https://www.openssh.com/portable.html https://www.openssh.com/portable.html > Normal OpenSSH development produces a very small, secure, and easy to maintain version for the OpenBSD project. The OpenSSH Portability Team takes that pure version and adds portability code so that OpenSSH can run on many other operating systems. Unless you actually run OpenBSD, what you think is "OpenSSH" is in fact "OpenSSH Portable Release". These are very different things.
akerl_ 2y ago
As the parent comments note, LibreSSL ripped out tons of code. Not "hidden behind build flags". Deleted. There's plenty of flaws with any project, but OpenBSD is pretty well known for doing exactly the thing you're claiming they don't do.

by cedws 2y ago

adamrt 2y ago

OpenBSD is also known for this. They constantly push back against adding configuration knobs or running non standard configurations. Have you used OpenBSD? You're telling them they should be doing something, that is already basically their mission statement.

cedws 2y ago
Looking at OpenSSH tells a different story. It is a massive, overly configurable behemoth. The 'WireGuard of SSH' would be 1% of the LOC. It would not provide password auth, or let you log in as root with password auth, or let you use old insecure ciphers. Maybe OpenBSD itself is better at sticking to these principles than OpenSSH. I haven't used (experimented with) it for ~5 years but read about various updates every so often.
- djao 2y ago
  You seem to be confusing "OpenSSH" with "OpenSSH Portable Release". As explained here: https://www.openssh.com/portable.html https://www.openssh.com/portable.html > Normal OpenSSH development produces a very small, secure, and easy to maintain version for the OpenBSD project. The OpenSSH Portability Team takes that pure version and adds portability code so that OpenSSH can run on many other operating systems. Unless you actually run OpenBSD, what you think is "OpenSSH" is in fact "OpenSSH Portable Release". These are very different things.

akerl_ 2y ago

As the parent comments note, LibreSSL ripped out tons of code. Not "hidden behind build flags". Deleted. There's plenty of flaws with any project, but OpenBSD is pretty well known for doing exactly the thing you're claiming they don't do.