3 ms·
Every report I have found says that, if an exploit does exist, it is in an old version of OpenSSH. I have no idea why you would update to anything but a recent
by JeremyChase 17y ago
Every report I have found says that, if an exploit does exist, it is in an old version of OpenSSH. I have no idea why you would update to anything but a recent version. If you suggest that your distribution doesn't have an update to a recent enough version; then rumored OpenSSH exploits are the least of your security concerns.
Your post also suggests that Damien Miller and the OpenSSH development team would not disclose the exploit. Are you aware that one of the goals of the OpenBSD and OpenSSH projects is Full Disclosure? What evidence do you have to suggest that they would go against their own goals?
http://www.openbsd.org/security.html http://www.openbsd.org/security.html
- weaksauce 17y agoI think I might not have been clear enough in my point. The people at OpenSSH are good, that was not in question. The point I was making is that the "anti-sec movement" are miles away from trustworthy. Without a confirmation from the actual devs that the current (5.x) versions are OK from the "exploit" I will not be upgrading from the most recent version that is on my distro. Taking a random "hacker" without proof at face value on the internet is not my cup of tea. As randallsquared pointed out here http://news.ycombinator.com/item?id=692344 http://news.ycombinator.com/item?id=692344 it is entirely possible that the latest version has the problem and this is all a social engineering hack to get everyone to upgrade to a compromised version without any data whatsoever.