4 ms·

What good reason could their possibly be for not disclosing a hole to FreeBSD? Especially if it effects networking infrastructure.... 1. Government gag order?

What good reason could their possibly be for not disclosing a hole to FreeBSD? Especially if it effects networking infrastructure.... 1. Government gag order? I'd call this a "good reason", but it wouldn't clear my conscience. 2. Disclosure to or interception by malicious parties? I can't imagine that the best solution would be STO.

Xylakant 13y ago
> Government gag order I can't imagine a government gag order that allows you to publicly hint that there's a problem.
xeroxmalf 13y ago
It's not a good reason that they aren't disclosing, it's a personal reason.
willvarfar 13y ago
It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSL consumers - only when they have a fix? It could be best fixed in OpenSSL itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.
- lholden 13y ago
  OpenSSH is a SSH client and server provided by the Open BSD Foundation. OpenSSL is an encryption API maintained by an entirely different group of people. EDIT: Modified my reply. OpenSSH at some point moved it's "restrictively licenced software" (RSA, DES, etc) out of it's codebase and now depends on OpenSSL according to it's license. http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENC...
  - willvarfar 13y ago
    Quite right, my typo, and if I could still 'edit' my post I'd correct it. I meant OpenSSH: It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSH consumers - only when they have a fix? It could be best fixed in OpenSSH itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.
    - lholden 13y ago
      No worries. My reply turned out ot be not entirely correct either so :D
  - Xylakant 13y ago
    Actually somebody posted the contrary yesterday and I thought the same as you. We're both wrong - I went off and checked the openssl license and it lists a couple of things that are included from OpenSSL and a short grep in the code turns up a lot of references to OpenSSL.
    - lholden 13y ago
      Crazy... Modified my post. Thanks :)
  - peterwwillis 13y ago
    RSA, DES, etc are not "restrictively licensed software", they are algorithms in the public domain. Anybody can write their own implementation of it and license that work how they see fit - including OpenSSH. I'm pretty sure they're just lazy and would rather use someone else's code.
    - lholden 13y ago
      RSA was patent encumbered at the time the clause was made to the OpenSSH license. This very likely qualified RSA as "restrictively licensed". RSA was released from its patent in 2000 (just weeks before it expired). DSA I believe is still patent encumbered.
      - peterwwillis 13y ago
        Right. They've had 14 years to re-add code like RSA and Diffie-Hellman to their project if they wanted to. Lazy programmers. NIST made the DSA patent available worldwide royalty-free. In fact, DSA was unencumbered by patents before RSA, which is why SSH version 2 incorporated it.
        lholden 13y ago
        Granted. Code reduction on the other hand is generally a good thing. :P I want to say that I would have done the same thing. At the same time though... doing so with a security application assumes that the team supporting the software you depend on is competent enough to properly audit and test their code. I have a feeling that OpenSSL will be leaving a bad taste in peoples mouths for a while. :/
asuffield 13y ago
I can see that you have not interacted with Theo before. Sometimes these things are just all personality.
- fabulist 13y ago
  I've not yet had the pleasure, but despite the insight lholden's shared about the contentious relationship between the BSDs, I have a really hard time believing anyone in this industry would be so petty. Its clear, however, that the only way to get to the bottom of this is to become a big contributor to OpenSSH.
lholden 13y ago
Short Answer: Bitterness. Long Answer: It's complicated and I do not understand the whole picture myself. I can however outline two things that likely exasperate the situation. a) OpenSSH is used by nearly everyone. Nearly every unix-like installation includes a copy of OpenSSH. Most companies which do business on the internet use a unix-like operating system in some way. The OpenBSD Foundation has had trouble obtaining funding to cover operating costs in the past. Included in these operating costs is support and auditing of OpenSSH. b) There has been a long and colored history between FreeBSD and OpenBSD. A lot of code and features developed under OpenBSD has been ported over to FreeBSD such as the OpenBSD Packet Filter (PF). Juniper uses FreeBSD and PF in their routers and have donated in various ways to FreeBSD. For example, Juniper donated three EX3200s with full contracts to FreeBSD for use in their datacenter. The OpenBSD Foundation on the other hand has not really seen the same support.
- nnkh 13y ago
  Sure, De Raadt/OpenBSD are bitter about the lack of funding but that does not explain anything about this mysterious hole. This email can mean anything. Does Kirk McKusick know about this hole and has he pressured De Raadt not to disclose it (for what reason could that even be?), or is it a vague reference to a fallout he had with him earlier(making this an absurdly petty reason not to disclose it)? Just dropping that hint is ambiguous drama baiting.
  - lholden 13y ago
    Drama baiting is something Theo de Raadt is good at. :) I have a feeling it has less to do with something sinister, and more to do with Theo's very vocal stance on the security situation in FreeBSD. http://www.itwire.com/business-it-news/open-source/62641-crypto-freebsd-playing-catch-up-says-de-raadt http://www.itwire.com/business-it-news/open-source/62641-cry... Most likely the FreeBSD kernel or libraries are doing something in a certain way that Theo finds insecure/insufficient. (Justified or not)
    - nnkh 13y ago
      FreeBSD dev response to De Raadt's very vocal stance: http://tech.slashdot.org/comments.pl?sid=4559455&cid=45701981 http://tech.slashdot.org/comments.pl?sid=4559455&cid=4570198... It really does seem like De Raadt's just being really petty to me. But if this is an actual hole and he doesn't want to say what it is, that is worrisome. Doesn't he insinuate the rest of FreeBSD does not know about the hole?

Xylakant 13y ago

> Government gag order I can't imagine a government gag order that allows you to publicly hint that there's a problem.

xeroxmalf 13y ago

It's not a good reason that they aren't disclosing, it's a personal reason.

willvarfar 13y ago

It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSL consumers - only when they have a fix? It could be best fixed in OpenSSL itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.

lholden 13y ago
OpenSSH is a SSH client and server provided by the Open BSD Foundation. OpenSSL is an encryption API maintained by an entirely different group of people. EDIT: Modified my reply. OpenSSH at some point moved it's "restrictively licenced software" (RSA, DES, etc) out of it's codebase and now depends on OpenSSL according to it's license. http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENC...
- willvarfar 13y ago
  Quite right, my typo, and if I could still 'edit' my post I'd correct it. I meant OpenSSH: It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSH consumers - only when they have a fix? It could be best fixed in OpenSSH itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.
  - lholden 13y ago
    No worries. My reply turned out ot be not entirely correct either so :D
- Xylakant 13y ago
  Actually somebody posted the contrary yesterday and I thought the same as you. We're both wrong - I went off and checked the openssl license and it lists a couple of things that are included from OpenSSL and a short grep in the code turns up a lot of references to OpenSSL.
  - lholden 13y ago
    Crazy... Modified my post. Thanks :)
- peterwwillis 13y ago
  RSA, DES, etc are not "restrictively licensed software", they are algorithms in the public domain. Anybody can write their own implementation of it and license that work how they see fit - including OpenSSH. I'm pretty sure they're just lazy and would rather use someone else's code.
  - lholden 13y ago
    RSA was patent encumbered at the time the clause was made to the OpenSSH license. This very likely qualified RSA as "restrictively licensed". RSA was released from its patent in 2000 (just weeks before it expired). DSA I believe is still patent encumbered.
    - peterwwillis 13y ago
      Right. They've had 14 years to re-add code like RSA and Diffie-Hellman to their project if they wanted to. Lazy programmers. NIST made the DSA patent available worldwide royalty-free. In fact, DSA was unencumbered by patents before RSA, which is why SSH version 2 incorporated it.
      - lholden 13y ago
        Granted. Code reduction on the other hand is generally a good thing. :P I want to say that I would have done the same thing. At the same time though... doing so with a security application assumes that the team supporting the software you depend on is competent enough to properly audit and test their code. I have a feeling that OpenSSL will be leaving a bad taste in peoples mouths for a while. :/

asuffield 13y ago

I can see that you have not interacted with Theo before. Sometimes these things are just all personality.

fabulist 13y ago
I've not yet had the pleasure, but despite the insight lholden's shared about the contentious relationship between the BSDs, I have a really hard time believing anyone in this industry would be so petty. Its clear, however, that the only way to get to the bottom of this is to become a big contributor to OpenSSH.

lholden 13y ago

Short Answer: Bitterness. Long Answer: It's complicated and I do not understand the whole picture myself. I can however outline two things that likely exasperate the situation. a) OpenSSH is used by nearly everyone. Nearly every unix-like installation includes a copy of OpenSSH. Most companies which do business on the internet use a unix-like operating system in some way. The OpenBSD Foundation has had trouble obtaining funding to cover operating costs in the past. Included in these operating costs is support and auditing of OpenSSH. b) There has been a long and colored history between FreeBSD and OpenBSD. A lot of code and features developed under OpenBSD has been ported over to FreeBSD such as the OpenBSD Packet Filter (PF). Juniper uses FreeBSD and PF in their routers and have donated in various ways to FreeBSD. For example, Juniper donated three EX3200s with full contracts to FreeBSD for use in their datacenter. The OpenBSD Foundation on the other hand has not really seen the same support.

nnkh 13y ago
Sure, De Raadt/OpenBSD are bitter about the lack of funding but that does not explain anything about this mysterious hole. This email can mean anything. Does Kirk McKusick know about this hole and has he pressured De Raadt not to disclose it (for what reason could that even be?), or is it a vague reference to a fallout he had with him earlier(making this an absurdly petty reason not to disclose it)? Just dropping that hint is ambiguous drama baiting.
- lholden 13y ago
  Drama baiting is something Theo de Raadt is good at. :) I have a feeling it has less to do with something sinister, and more to do with Theo's very vocal stance on the security situation in FreeBSD. http://www.itwire.com/business-it-news/open-source/62641-crypto-freebsd-playing-catch-up-says-de-raadt http://www.itwire.com/business-it-news/open-source/62641-cry... Most likely the FreeBSD kernel or libraries are doing something in a certain way that Theo finds insecure/insufficient. (Justified or not)
  - nnkh 13y ago
    FreeBSD dev response to De Raadt's very vocal stance: http://tech.slashdot.org/comments.pl?sid=4559455&cid=45701981 http://tech.slashdot.org/comments.pl?sid=4559455&cid=4570198... It really does seem like De Raadt's just being really petty to me. But if this is an actual hole and he doesn't want to say what it is, that is worrisome. Doesn't he insinuate the rest of FreeBSD does not know about the hole?