10 ms·

Theo de Raadt on OpenSSL vulnerabilities coming on the 19th

202 points by bootload 12y ago

rikkus 12y ago
Not sure what he's saying. That the OpenSSL group are going to send the LibreSSL group vulnerabilities? That the LibreSSL group are about to disclose OpenSSL vulnerabilities? Just a bit confused! Okay, a later story just appeared, I quote: "This or earlier LibreSSL releases may also address issues that are to be revealed by The OpenSSL Project Team on the 19th of March, 2015." This story is probably redundant now, then.
- tomaac 12y ago
  He is referring to https://mta.openssl.org/pipermail/openssl-announce/2015-March/000020.html https://mta.openssl.org/pipermail/openssl-announce/2015-Marc...
- bootload 12y ago
  "This story is probably redundant now, then." given obsd has/is doing a post heartbleed code review on OpenSSL since April 2014 to build LibreSSL [0] is it wise to assume this? [0] http://arstechnica.com/information-technology/2014/04/openssl-code-beyond-repair-claims-creator-of-libressl-fork/ http://arstechnica.com/information-technology/2014/04/openss...
noir_lord 12y ago
> The OpenSSL group do not tell the LibreSSL group about vulnerabilities that they are fixing in upcoming releases. > Why? Well, they just don't. That's the whole story. Then the story sucks, security of core components underlying the internet is bigger than any one group. Respect for end users would indicate that a simple heads up of a high severity bug to someone on the LibreSSL team would be the way to go.
- detaro 12y ago
  Well, according to (also unsourced, so no clue what the "real" story is) comments on the sister submisson [1] it is because LibreSSL doesn't want to take part in the embargo on reported vulnerabilities. [1] https://news.ycombinator.com/item?id=9216815 https://news.ycombinator.com/item?id=9216815
  - noir_lord 12y ago
    In which case and assuming that is accurate then > Why? Well, they just don't. That's the whole story. Could have been > Why? Well, we'd have liked to but they don't embargo reported bugs and we do. Clearer for everyone. Assuming it's true.
    - gpvos 12y ago
      Wouldn't that be "they embargo reported bugs and we don't"? (Or at least, I suspect LibreSSL wants to keep to its own embargo schedule.)
  - Bluerise 12y ago
    That is true. OpenBSD/Theo refuses to take part in embargos, which means they don't get a heads up. Don't have a citation right now, but Theo said that publicly when Hardbleed or so happened.
    - tedunangst 12y ago
      Not true.
  - alecco 12y ago
    That's because they patch within a couple of days and don't want their systems unpatched for long (30 to 60 days!) when there is a known issue out in the wild. The flaws tend to get leaked, the temptation is big because there are huge money incentives. I bet if the embargo were for 5 days they would reconsider. But good luck with that with members like Microsoft, Cisco, Oracle, which a terrible reputation of postponing things the maximum possible.
- raverbashing 12y ago
  Yeah, but based on the work of the LibreSSL team http://opensslrampage.org/ http://opensslrampage.org/ I wouldn't use OpenSSL for anything else if possible
  - themartorana 12y ago
    OpenBSD's scorched earth policy regarding OpenSSL is so anti-community it's ridiculous. OpenSSL served the entire internet for years. I'm happy that it's been forked - nice that could even happen at all - and some of the cruft responsible for the recent flood of exploits will be fixed/removed, but the hate just seems petty.
    - wtbob 12y ago
      > OpenSSL served the entire internet for years. Well, it gave the entire Internet a false sense of security for years, at least. > …the hate just seems petty. Have you read some of the cruft that the LibreSSL guys removed? OpenSSL has been a horrid mess. Sometimes you gotta admit that a Yugo is a really, really, really bad car.
      - rjaco31 12y ago
        False sense of security? They provided the best SSL stack for years, and for free. Everybody knew for long that OpenSSL was a mess, and the harsh reality is that no one wanted to take care of it beside the few (almost benevolent) OpenSSL developers. So now, the OpenBSD guys come in with their almighty attitude, while they knew about it for years and didn't bother to do anything about it before. No one wanted to do that job before Heartbleed, so yeah, it's really uncalled for to be that rude. We should all be grateful the OpenSSL team did what they did for so long.
        rurban 12y ago
        You must been living on an island over the last years. "OpenSSL was the best SSL stack for years?" Best no, only fast. PolarSSL (now "mbed TLS") is the best, to the best definition of best. Still better than OpenSSL, which was known to be fast but insecure and poorly managed, are the stacks used the biggest clients: * NSS used by Chrome, Mozilla, et al * GnuTLS used by exim, GNOME, et al. I'm not at all grateful to the OpenSSL team for using horrible software practices and putting their clients into danger.
- rlpb 12y ago
  > > Why? Well, they just don't. That's the whole story. It's not the whole story. Here's the whole story: http://lwn.net/Articles/601958/ http://lwn.net/Articles/601958/ "As it turns out, de Raadt had been asked if he wanted to join the distros list back in early May." "[de Raadt:] So I'll decline."
  - deleted 12y ago
    [deleted]
  - alecco 12y ago
    Way to cherry pick of a cherry picking. Theo meant he has no time to join yet another mailing list where OpenSSL security issues are very likely way less an 1% of the messages. Also, it's a Linux mailing list and he maintains a BSD distro, not much in common. I remember back in 98 he said he processed about 2500 emails a day (using a custom set of emacs macros). "I'm more an email processing system than a developer, sigh" (paraphrasing) Why can't OpenSSL have an simple early warning list like most other major software packages. It's only adding one CC field.
    - rlpb 12y ago
      It would be nice if he'd said that, rather than "Well, they just don't." which completely misrepresents the situation. AFAIK, he has never requested such a thing, anyway. The only requests I see come from third party apologists, not from him. He just complains that they don't give him access, when in fact they offered him access. > Theo meant he has no time to join yet another mailing list where OpenSSL security issues are very likely way less an 1% of the messages. Is it really that hard to filter for /openssl/i/?
      - deleted 12y ago
        [deleted]
      - worklogin 12y ago
        Is it really that hard to have a vulnerabilities mailer for important stuff?
- bdg 12y ago
  Theo has a reputation for this attitude. He's not entirely unlike Linus in that he's brilliant and people don't want to deal with him.
roghummal 12y ago
This is a cry for attention. Why doesn't Theo get more love?
some_furry 12y ago
If the fix is already committed for any of the vulnerabilities, then the answer is a simple github search away: https://github.com/openssl/openssl/compare/OpenSSL_1_0_1l...OpenSSL_1_0_1-stable https://github.com/openssl/openssl/compare/OpenSSL_1_0_1l...... https://github.com/openssl/openssl/compare/OpenSSL_1_0_2...OpenSSL_1_0_2-stable https://github.com/openssl/openssl/compare/OpenSSL_1_0_2...O... Some interesting commits: https://github.com/openssl/openssl/commit/327de270d583e716bc0282dd0d59e133f41d7ada https://github.com/openssl/openssl/commit/327de270d583e716bc... https://github.com/openssl/openssl/commit/f5ee5213073870493a8ade98b13ea41a2b20b8d4 https://github.com/openssl/openssl/commit/f5ee5213073870493a... https://github.com/openssl/openssl/commit/51527f1e3564f210e984fe5b654c45d34e4f03d7 https://github.com/openssl/openssl/commit/51527f1e3564f210e9...
- cjg_ 12y ago
  It is weird, two of them (CVE-2015-0288 and CVE-2015-0209) are listed here also with links to patches, https://security-tracker.debian.org/tracker/source-package/openssl https://security-tracker.debian.org/tracker/source-package/o... Why have embargo on the vulnerabilities if you publish patches anyway? Which makes me think that the patches has not been committed yet and that the embargoed are different ones than these.
  - geeknik 12y ago
    I found an OpenSSL bug that was assigned CVE-2015-0208 and it is still embargoed near as I can tell.
- deleted 12y ago
  [deleted]
onestone 12y ago
The situation seems to have changed (core LibreSSL developers have now had disclosure from OpenSSL): http://marc.info/?l=openbsd-misc&m=142660009729096&w=2 http://marc.info/?l=openbsd-misc&m=142660009729096&w=2
kriro 12y ago
I can't say I feel comfortable with an announcement of "there's a vulnarability ranked high but we won't patch it until the 19th". I get why they do it that way and I prefer this announcement to nothing but it's still somewhat unsettling. They obviously know a lot more about security than I do so I'll live with that decision.
- TomMasz 12y ago
  It's less than ideal but the obvious remediation is to update OpenSSL. Of course, if there are any other remediations it would be nice to know about them sooner. I know I'll have customers bugging me before Thursday.
tomjen3 12y ago
Oh great, egos is programming leading to worse security situations for everybody. Yeah Theo they made a fork of your code because it was insecure - that doesn't mean you should hope for them to fail just so you can say "they had a bug too".
- shiggerino 12y ago
  Who exactly made a fork of Theo's code? Also, I don't see how you can read any ill intent out of the email alone. It shouldn't be unreasonable for the OpenSSL devs to share vulnerabilities with LibreSSL. I don't think he would use it for any malicious purposes. Though I guess it makes you want to err on the side of caution when he comes up with such classics as declaring Apache 2.0 proprietary for no other reason that it has more lines of text than the previous version.
  - jdiez17 12y ago
    I'd think tomjen3 meant "Yeah Theo made a fork of (...)" instead of "Yeah Theo they". Looks like he originally wrote "Yeah they made a fork (...)", then he rephrased and forgot to delete the "they".

202 points by bootload 12y ago

Not sure what he's saying. That the OpenSSL group are going to send the LibreSSL group vulnerabilities? That the LibreSSL group are about to disclose OpenSSL vulnerabilities? Just a bit confused! Okay, a later story just appeared, I quote: "This or earlier LibreSSL releases may also address issues that are to be revealed by The OpenSSL Project Team on the 19th of March, 2015." This story is probably redundant now, then.

tomaac 12y ago
He is referring to https://mta.openssl.org/pipermail/openssl-announce/2015-March/000020.html https://mta.openssl.org/pipermail/openssl-announce/2015-Marc...
bootload 12y ago
"This story is probably redundant now, then." given obsd has/is doing a post heartbleed code review on OpenSSL since April 2014 to build LibreSSL [0] is it wise to assume this? [0] http://arstechnica.com/information-technology/2014/04/openssl-code-beyond-repair-claims-creator-of-libressl-fork/ http://arstechnica.com/information-technology/2014/04/openss...

noir_lord 12y ago

> The OpenSSL group do not tell the LibreSSL group about vulnerabilities that they are fixing in upcoming releases. > Why? Well, they just don't. That's the whole story. Then the story sucks, security of core components underlying the internet is bigger than any one group. Respect for end users would indicate that a simple heads up of a high severity bug to someone on the LibreSSL team would be the way to go.

detaro 12y ago
Well, according to (also unsourced, so no clue what the "real" story is) comments on the sister submisson [1] it is because LibreSSL doesn't want to take part in the embargo on reported vulnerabilities. [1] https://news.ycombinator.com/item?id=9216815 https://news.ycombinator.com/item?id=9216815
- noir_lord 12y ago
  In which case and assuming that is accurate then > Why? Well, they just don't. That's the whole story. Could have been > Why? Well, we'd have liked to but they don't embargo reported bugs and we do. Clearer for everyone. Assuming it's true.
  - gpvos 12y ago
    Wouldn't that be "they embargo reported bugs and we don't"? (Or at least, I suspect LibreSSL wants to keep to its own embargo schedule.)
- Bluerise 12y ago
  That is true. OpenBSD/Theo refuses to take part in embargos, which means they don't get a heads up. Don't have a citation right now, but Theo said that publicly when Hardbleed or so happened.
  - tedunangst 12y ago
    Not true.
- alecco 12y ago
  That's because they patch within a couple of days and don't want their systems unpatched for long (30 to 60 days!) when there is a known issue out in the wild. The flaws tend to get leaked, the temptation is big because there are huge money incentives. I bet if the embargo were for 5 days they would reconsider. But good luck with that with members like Microsoft, Cisco, Oracle, which a terrible reputation of postponing things the maximum possible.
raverbashing 12y ago
Yeah, but based on the work of the LibreSSL team http://opensslrampage.org/ http://opensslrampage.org/ I wouldn't use OpenSSL for anything else if possible
- themartorana 12y ago
  OpenBSD's scorched earth policy regarding OpenSSL is so anti-community it's ridiculous. OpenSSL served the entire internet for years. I'm happy that it's been forked - nice that could even happen at all - and some of the cruft responsible for the recent flood of exploits will be fixed/removed, but the hate just seems petty.
  - wtbob 12y ago
    > OpenSSL served the entire internet for years. Well, it gave the entire Internet a false sense of security for years, at least. > …the hate just seems petty. Have you read some of the cruft that the LibreSSL guys removed? OpenSSL has been a horrid mess. Sometimes you gotta admit that a Yugo is a really, really, really bad car.
    - rjaco31 12y ago
      False sense of security? They provided the best SSL stack for years, and for free. Everybody knew for long that OpenSSL was a mess, and the harsh reality is that no one wanted to take care of it beside the few (almost benevolent) OpenSSL developers. So now, the OpenBSD guys come in with their almighty attitude, while they knew about it for years and didn't bother to do anything about it before. No one wanted to do that job before Heartbleed, so yeah, it's really uncalled for to be that rude. We should all be grateful the OpenSSL team did what they did for so long.
      - rurban 12y ago
        You must been living on an island over the last years. "OpenSSL was the best SSL stack for years?" Best no, only fast. PolarSSL (now "mbed TLS") is the best, to the best definition of best. Still better than OpenSSL, which was known to be fast but insecure and poorly managed, are the stacks used the biggest clients: * NSS used by Chrome, Mozilla, et al * GnuTLS used by exim, GNOME, et al. I'm not at all grateful to the OpenSSL team for using horrible software practices and putting their clients into danger.
rlpb 12y ago
> > Why? Well, they just don't. That's the whole story. It's not the whole story. Here's the whole story: http://lwn.net/Articles/601958/ http://lwn.net/Articles/601958/ "As it turns out, de Raadt had been asked if he wanted to join the distros list back in early May." "[de Raadt:] So I'll decline."
- deleted 12y ago
  [deleted]
- alecco 12y ago
  Way to cherry pick of a cherry picking. Theo meant he has no time to join yet another mailing list where OpenSSL security issues are very likely way less an 1% of the messages. Also, it's a Linux mailing list and he maintains a BSD distro, not much in common. I remember back in 98 he said he processed about 2500 emails a day (using a custom set of emacs macros). "I'm more an email processing system than a developer, sigh" (paraphrasing) Why can't OpenSSL have an simple early warning list like most other major software packages. It's only adding one CC field.
  - rlpb 12y ago
    It would be nice if he'd said that, rather than "Well, they just don't." which completely misrepresents the situation. AFAIK, he has never requested such a thing, anyway. The only requests I see come from third party apologists, not from him. He just complains that they don't give him access, when in fact they offered him access. > Theo meant he has no time to join yet another mailing list where OpenSSL security issues are very likely way less an 1% of the messages. Is it really that hard to filter for /openssl/i/?
    - deleted 12y ago
      [deleted]
    - worklogin 12y ago
      Is it really that hard to have a vulnerabilities mailer for important stuff?
bdg 12y ago
Theo has a reputation for this attitude. He's not entirely unlike Linus in that he's brilliant and people don't want to deal with him.

roghummal 12y ago

This is a cry for attention. Why doesn't Theo get more love?

some_furry 12y ago

If the fix is already committed for any of the vulnerabilities, then the answer is a simple github search away: https://github.com/openssl/openssl/compare/OpenSSL_1_0_1l...OpenSSL_1_0_1-stable https://github.com/openssl/openssl/compare/OpenSSL_1_0_1l...... https://github.com/openssl/openssl/compare/OpenSSL_1_0_2...OpenSSL_1_0_2-stable https://github.com/openssl/openssl/compare/OpenSSL_1_0_2...O... Some interesting commits: https://github.com/openssl/openssl/commit/327de270d583e716bc0282dd0d59e133f41d7ada https://github.com/openssl/openssl/commit/327de270d583e716bc... https://github.com/openssl/openssl/commit/f5ee5213073870493a8ade98b13ea41a2b20b8d4 https://github.com/openssl/openssl/commit/f5ee5213073870493a... https://github.com/openssl/openssl/commit/51527f1e3564f210e984fe5b654c45d34e4f03d7 https://github.com/openssl/openssl/commit/51527f1e3564f210e9...

cjg_ 12y ago
It is weird, two of them (CVE-2015-0288 and CVE-2015-0209) are listed here also with links to patches, https://security-tracker.debian.org/tracker/source-package/openssl https://security-tracker.debian.org/tracker/source-package/o... Why have embargo on the vulnerabilities if you publish patches anyway? Which makes me think that the patches has not been committed yet and that the embargoed are different ones than these.
- geeknik 12y ago
  I found an OpenSSL bug that was assigned CVE-2015-0208 and it is still embargoed near as I can tell.
deleted 12y ago
[deleted]

onestone 12y ago

The situation seems to have changed (core LibreSSL developers have now had disclosure from OpenSSL): http://marc.info/?l=openbsd-misc&m=142660009729096&w=2 http://marc.info/?l=openbsd-misc&m=142660009729096&w=2

kriro 12y ago

I can't say I feel comfortable with an announcement of "there's a vulnarability ranked high but we won't patch it until the 19th". I get why they do it that way and I prefer this announcement to nothing but it's still somewhat unsettling. They obviously know a lot more about security than I do so I'll live with that decision.

TomMasz 12y ago
It's less than ideal but the obvious remediation is to update OpenSSL. Of course, if there are any other remediations it would be nice to know about them sooner. I know I'll have customers bugging me before Thursday.

tomjen3 12y ago

Oh great, egos is programming leading to worse security situations for everybody. Yeah Theo they made a fork of your code because it was insecure - that doesn't mean you should hope for them to fail just so you can say "they had a bug too".

shiggerino 12y ago
Who exactly made a fork of Theo's code? Also, I don't see how you can read any ill intent out of the email alone. It shouldn't be unreasonable for the OpenSSL devs to share vulnerabilities with LibreSSL. I don't think he would use it for any malicious purposes. Though I guess it makes you want to err on the side of caution when he comes up with such classics as declaring Apache 2.0 proprietary for no other reason that it has more lines of text than the previous version.
- jdiez17 12y ago
  I'd think tomjen3 meant "Yeah Theo made a fork of (...)" instead of "Yeah Theo they". Looks like he originally wrote "Yeah they made a fork (...)", then he rephrased and forgot to delete the "they".