5 ms·
(Pidgin's) SSL support appears to have been written by a lobotomy victim
- martey 14y agoBesides being rude, this clearly does not follow Pidgin's security vulnerability reporting process: http://developer.pidgin.im/wiki/SecurityVulnerabilityProcess http://developer.pidgin.im/wiki/SecurityVulnerabilityProcess
- chris_wot 14y agoIs it really a huge vulnerability? But certainly a very dickish bug entry.
- darklajid 14y agoWell, you answer the question yourself: Do you think that using SSL where your client accepts every certificate (the link points to a function that returns a success code unconditionally, the 'real' stuff is disabled by preprocessor directives) is bad? Whatever the severity (for me this is certainly high), the tone in that bug report is inexcusable. Edit: Well, it seems that code existed like this since its creation, 2003-09-29: http://hg.pidgin.im/pidgin/main/rev/895a5ff9ebd4 http://hg.pidgin.im/pidgin/main/rev/895a5ff9ebd4 Edit 2: The bug report has now a proper response, quite relaxed. So it seems this is totally expected - for whatever reasons. I'm still curious why the code is littered with #if 0 fragments for years (dead code belongs in the vcs history for me), but the initial expectation of a total lack of certificate verification is wrong.
- cjoh 14y agoSo it's taken 9 years for anyone to notice that SSL is broken in the most widely used(?) open source IM client?
- zwp 14y agoI think it's fair to say that it's still not really clear. Twitter(!) has the news as it broke/continues to break: https://twitter.com/0xabad1dea/status/243095210819715072 https://twitter.com/0xabad1dea/status/243095210819715072
- lloeki 14y agoAllow me to fix that, because it's not just Pidgin: > .. the most widely used(?) open source IM client library, libpurple?
- zaroth 14y agoEven more strange, seeing as there appears to be working validation code which is #ifdef 0, even back in 2003? At the very least, would have been a great place in the code to comment on where (since obviously not there) the cert is supposed to get validated!
- 1007 14y agoThe author of this ticket isn't exaggerating when he states that "MITMing this crawling horror would be no more difficult than a plain, unencrypted TCP connection". That's how bad it is.
- nicholassmith 14y agoHe might be right but he still went about it in the wrong way.
- mike-cardwell 14y agoYes, unnecessarily rude and offensive to the developer(s) who wrote it. If he'd just used a more respectful title and removed the last sentence it would have been fine.
- leif 14y agoNo, it wouldn't have been fine. If you find a security bug, you have to follow the reporting procedures. Otherwise you're just making things worse. This should not be in a public ticket. That aside, I have a hard time seeing that there's any level of rudeness this sort of code doesn't deserve.
- theorique 14y agoExposing a technically misguided decision as such is enough. No need for the spluttering outrage and emotional editorial comment by the bug reporter (to say nothing of the ad hominem attacks on the programmer).
- smoyer 14y agoIn general, lobotomy victims did not choose to have the procedure and have no recourse but to live with the results. This title is rude both to the developers (who we can assume are good intentioned) and to lobotomy victims (who likely had nothing to do with this security issue).
- swdunlop 14y agoLooking at the code referenced in the bug? I agree, this is a horrible slight to lobotomy victims.
- kstenerud 14y agoOr, it's just old cruft that is no longer used. As per datallah's response: "If you don't look carefully, it may appear that the NSS plugin doesn't do any validation of the SSL certificates, but that isn't the case; the validation is done, just not by the SSL_AuthCertificateHook hook." "If you look at ssl-nss.c#l454, you'll see that before the SSL connection is considered "connected" from libpurple's perspective, ssl_nss_handshake_cb is called to validate the certificate using the libpurple's purple_certificate_verify functionality." This is why you don't jump to conclusions, throw out an emotional diatribe, and generally make an ass of yourself when writing bug reports.
- zobzu 14y agoI agree. It's also uncalled for. However, I'll also agree that being rude has some value. It's linked here and on other such sites. It means they'll have to fix it, but also to be more careful in the future, because being bashed in public is never a fun thing. Unfortunate reality.
- jeffehobbs 14y agoI read this entire article in my interior Comic Shop Guy voice.
- comice 14y ago"If you don't look carefully, it may appear that the NSS plugin doesn't do any validation of the SSL certificates, but that isn't the case; the validation is done, just not by the SSL_AuthCertificateHook hook."
- colanderman 14y agoWhy isn't libpurple, being a library, licensed under the LGPL, instead of the GPL? If it were, then there would be no problem linking with OpenSSL if I understand things correctly.
- exDM69 14y agoThis bug report appears to have been written by a lobotomy victim who has had their "communicating with humans" part of the brain removed.</troll> It makes me so sad to see this kind of attitude. And usually (don't know about this case) it comes from a person who does not contribute to the project. Not everyone is a cryptographer. Although they should refrain from writing crypto code, calling them "lobotomy victims" makes you sound like one.
- illumen 14y agoReally insulting headline. flagged
- chris_wot 14y agoIt's a really insulting bug report!