2 ms·
I can think of better straw men. But if they had approached their task with half the seriousness of the openssh maintainers then they probably wouldn't be faili
by angry_octet 2mo ago
I can think of better straw men. But if they had approached their task with half the seriousness of the openssh maintainers then they probably wouldn't be failing to check the return value of authentication functions.
OpenSSH authors have spent considerable effort separating concerns, reducing privileges, process isolation, etc. So I would say they have been planning for potential bugs. These techniques are very much absent from Artifactory.
https://vivianvoss.net/blog/technical-beauty-openssh https://vivianvoss.net/blog/technical-beauty-openssh
- dist-epoch 2mo agoSo you agree that you can have designs premised on the idea that they are bug free without this being hubris. So the issue is with the actual Artifactory project/team, not with this premise which obviously you seem to agree that is not hubris for the SSH project.
- angry_octet 2mo agoExactly the opposite of what I wrote. The OpenSSH team have taken extensive efforts to mitigate against bugs; they suspect themselves of erroneous thinking.