4 ms·

> > Why? Well, they just don't. That's the whole story. It's not the whole story. Here's the whole story: http://lwn.net/Articles/601958/ http://lwn.net/Art

by rlpb 12y ago

> > Why? Well, they just don't. That's the whole story. It's not the whole story. Here's the whole story: http://lwn.net/Articles/601958/ http://lwn.net/Articles/601958/ "As it turns out, de Raadt had been asked if he wanted to join the distros list back in early May." "[de Raadt:] So I'll decline."

deleted 12y ago
[deleted]
alecco 12y ago
Way to cherry pick of a cherry picking. Theo meant he has no time to join yet another mailing list where OpenSSL security issues are very likely way less an 1% of the messages. Also, it's a Linux mailing list and he maintains a BSD distro, not much in common. I remember back in 98 he said he processed about 2500 emails a day (using a custom set of emacs macros). "I'm more an email processing system than a developer, sigh" (paraphrasing) Why can't OpenSSL have an simple early warning list like most other major software packages. It's only adding one CC field.
- rlpb 12y ago
  It would be nice if he'd said that, rather than "Well, they just don't." which completely misrepresents the situation. AFAIK, he has never requested such a thing, anyway. The only requests I see come from third party apologists, not from him. He just complains that they don't give him access, when in fact they offered him access. > Theo meant he has no time to join yet another mailing list where OpenSSL security issues are very likely way less an 1% of the messages. Is it really that hard to filter for /openssl/i/?
  - deleted 12y ago
    [deleted]
  - worklogin 12y ago
    Is it really that hard to have a vulnerabilities mailer for important stuff?
    - rlpb 12y ago
      You've just described the mailing list that de Raadt refuses to join.
      - worklogin 12y ago
        From the context, it sounds like he was asked to join a linux distro security mailer, which wouldn't make sense. Isn't there an OpenSSL mailer for this stuff?
        gpvos 12y ago
        There are two lists: linux-distros and distros, the latter including FreeBSD and NetBSD. (Why is OpenSolaris - or whatever it's called this year - not in there too?) Nevertheless, it should be doable for OpenSSL to also mail LibreSSL; it is a bit of a special case, after all.
  - tedunangst 12y ago
    We asked for advance notice in the past. We received advance notice in the past. This time we didn't. Now we did, again.
- icebraining 12y ago
  I must be missing something, because I don't understand what's so difficult about filtering out the irrelevant emails.
- detaro 12y ago
  To me it seems mostly a difference in principles. If OpenSSL and others work with embargoes and LibreSSL/OpenBSD doesn't accept them, there is no solution that satisfies both sides. The amount of mails sounds like a strange argument to me. I can't imagine that they couldn't find one of the regular consumers of the mailing list willing to pass relevant ones on, assuming it were clear that LibreSSL is an accepted recipient of the information. That said, I don't expect much in the way of goodwill or willingness to compromise on any side here.
  - danieldk 12y ago
    To me it seems mostly a difference in principles. If OpenSSL and others work with embargoes and LibreSSL/OpenBSD doesn't accept them, there is no solution that satisfies both sides. Indeed, this is the main point, OpenBSD developers are proponents of full-disclosure: http://www.openbsd.org/security.html http://www.openbsd.org/security.html This paragraph summarizes it very well: Security information moves very fast in cracker circles. On the other hand, our experience is that coding and releasing of proper security fixes typically requires about an hour of work -- very fast fix turnaround is possible. Thus we think that full disclosure helps the people who really care about security.
- gavinatkinson 12y ago
  > Also, it's a Linux mailing list and he maintains a BSD distro, not much in common. No, you're thinking of linux-distros@. linux-distros@ is where issues that affect Linux only go. distros@ covers issues that are relevant to both BSD and Linux - distros@ membership is FreeBSD+NetBSD+linux-distros@.
forgottenpass 12y ago
This argument has always bugged me. Even if the mailing list was openssl-private-security-announce-embargoed (which it isn't), shouldn't openssl still attempt to identify and notify the large downstream consumers of openssl even if they're not on the list? This mailing list conversation sounds like a cartoon bureaucrat saying "Well, I'd LOVE to help you, but you didn't tick checkbox 16-A on your X-23 form last week."
- geofft 12y ago
  The distros list works on the principle that, at least in part, it's about people who are participating in the security-fix process. Of course some of the benefit is you get to stage your fixes early, but you also agree to be another set of eyes on the patch, run your local build and regression tests, etc. If someone brings an issue to the distros list without a patch, the patch needs to get written by someone. And so forth. My employer repackages Ubuntu into a virtual appliance, but since we're firmly downstream and haven't yet had the time to get deeply involved in upstream security work, we're not allowed on the distros list. (We haven't asked, but the policy is pretty clear.) I think that's pretty fair, even if I personally dislike that end result. See for instance, the disastrous handling around Shellshock, where no details were given on the distros list, the announcement went public, and it took a few days (in public) for people, mostly people on distros@, to realize that the patch was incomplete and two more patches were needed. It's not clear the distros list worked any better than a public announcement would have. The other argument is that embargoes always get harder to enforce as you add more people to them. The distros list is the successor of the old vendor-sec list, which was more lenient about membership and always had suspicions of leaks (until someone broke into the mail server....). See, for instance, the messy handling of Heartbleed's embargo: http://www.theage.com.au/it-pro/security-it/heartbleed-disclosure-timeline-who-knew-what-and-when-20140415-zqurk.html http://www.theage.com.au/it-pro/security-it/heartbleed-discl... I think that if there's going to be a private disclosure process at all, it's better that it's bureaucratic instead of friends telling their friends at CloudFlare and Akamai, under the table, that they should patch.
  - tomjen3 12y ago
    I have always hated embargoes for things like that because they end up benefitting the worst companies - the big ones - over the people who actually need the help.

by rlpb 12y ago

deleted 12y ago

[deleted]

alecco 12y ago

Way to cherry pick of a cherry picking. Theo meant he has no time to join yet another mailing list where OpenSSL security issues are very likely way less an 1% of the messages. Also, it's a Linux mailing list and he maintains a BSD distro, not much in common. I remember back in 98 he said he processed about 2500 emails a day (using a custom set of emacs macros). "I'm more an email processing system than a developer, sigh" (paraphrasing) Why can't OpenSSL have an simple early warning list like most other major software packages. It's only adding one CC field.

rlpb 12y ago
It would be nice if he'd said that, rather than "Well, they just don't." which completely misrepresents the situation. AFAIK, he has never requested such a thing, anyway. The only requests I see come from third party apologists, not from him. He just complains that they don't give him access, when in fact they offered him access. > Theo meant he has no time to join yet another mailing list where OpenSSL security issues are very likely way less an 1% of the messages. Is it really that hard to filter for /openssl/i/?
- deleted 12y ago
  [deleted]
- worklogin 12y ago
  Is it really that hard to have a vulnerabilities mailer for important stuff?
  - rlpb 12y ago
    You've just described the mailing list that de Raadt refuses to join.
    - worklogin 12y ago
      From the context, it sounds like he was asked to join a linux distro security mailer, which wouldn't make sense. Isn't there an OpenSSL mailer for this stuff?
      - gpvos 12y ago
        There are two lists: linux-distros and distros, the latter including FreeBSD and NetBSD. (Why is OpenSolaris - or whatever it's called this year - not in there too?) Nevertheless, it should be doable for OpenSSL to also mail LibreSSL; it is a bit of a special case, after all.
- tedunangst 12y ago
  We asked for advance notice in the past. We received advance notice in the past. This time we didn't. Now we did, again.
icebraining 12y ago
I must be missing something, because I don't understand what's so difficult about filtering out the irrelevant emails.
detaro 12y ago
To me it seems mostly a difference in principles. If OpenSSL and others work with embargoes and LibreSSL/OpenBSD doesn't accept them, there is no solution that satisfies both sides. The amount of mails sounds like a strange argument to me. I can't imagine that they couldn't find one of the regular consumers of the mailing list willing to pass relevant ones on, assuming it were clear that LibreSSL is an accepted recipient of the information. That said, I don't expect much in the way of goodwill or willingness to compromise on any side here.
- danieldk 12y ago
  To me it seems mostly a difference in principles. If OpenSSL and others work with embargoes and LibreSSL/OpenBSD doesn't accept them, there is no solution that satisfies both sides. Indeed, this is the main point, OpenBSD developers are proponents of full-disclosure: http://www.openbsd.org/security.html http://www.openbsd.org/security.html This paragraph summarizes it very well: Security information moves very fast in cracker circles. On the other hand, our experience is that coding and releasing of proper security fixes typically requires about an hour of work -- very fast fix turnaround is possible. Thus we think that full disclosure helps the people who really care about security.
gavinatkinson 12y ago
> Also, it's a Linux mailing list and he maintains a BSD distro, not much in common. No, you're thinking of linux-distros@. linux-distros@ is where issues that affect Linux only go. distros@ covers issues that are relevant to both BSD and Linux - distros@ membership is FreeBSD+NetBSD+linux-distros@.

forgottenpass 12y ago

This argument has always bugged me. Even if the mailing list was openssl-private-security-announce-embargoed (which it isn't), shouldn't openssl still attempt to identify and notify the large downstream consumers of openssl even if they're not on the list? This mailing list conversation sounds like a cartoon bureaucrat saying "Well, I'd LOVE to help you, but you didn't tick checkbox 16-A on your X-23 form last week."

geofft 12y ago
The distros list works on the principle that, at least in part, it's about people who are participating in the security-fix process. Of course some of the benefit is you get to stage your fixes early, but you also agree to be another set of eyes on the patch, run your local build and regression tests, etc. If someone brings an issue to the distros list without a patch, the patch needs to get written by someone. And so forth. My employer repackages Ubuntu into a virtual appliance, but since we're firmly downstream and haven't yet had the time to get deeply involved in upstream security work, we're not allowed on the distros list. (We haven't asked, but the policy is pretty clear.) I think that's pretty fair, even if I personally dislike that end result. See for instance, the disastrous handling around Shellshock, where no details were given on the distros list, the announcement went public, and it took a few days (in public) for people, mostly people on distros@, to realize that the patch was incomplete and two more patches were needed. It's not clear the distros list worked any better than a public announcement would have. The other argument is that embargoes always get harder to enforce as you add more people to them. The distros list is the successor of the old vendor-sec list, which was more lenient about membership and always had suspicions of leaks (until someone broke into the mail server....). See, for instance, the messy handling of Heartbleed's embargo: http://www.theage.com.au/it-pro/security-it/heartbleed-disclosure-timeline-who-knew-what-and-when-20140415-zqurk.html http://www.theage.com.au/it-pro/security-it/heartbleed-discl... I think that if there's going to be a private disclosure process at all, it's better that it's bureaucratic instead of friends telling their friends at CloudFlare and Akamai, under the table, that they should patch.
- tomjen3 12y ago
  I have always hated embargoes for things like that because they end up benefitting the worst companies - the big ones - over the people who actually need the help.