Date: Sun, 20 Apr 2014 05:46:34 +0400 From: Mikhail <mp39590@gmail.com> To: freebsd-security@freebsd.org Subject: Re: De Raadt + FBSD + OpenSSH + hole? Message-ID: <535326fa.ab7281.696ea278@edge> In-Reply-To: <53522186.9030207@FreeBSD.org> References: <534B11F0.9040400@paladin.bulgarpress.com> <201404141207.s3EC7IvT085450@chronos.org.uk> <201404141232.s3ECWFQ1081178@catnip.dyslexicfish.net> <53522186.9030207@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
>On 4/14/2014 7:32 AM, Jamie Landeg-Jones wrote: >> Matt Dawson <matt@chronos.org.uk> wrote: >> >>> My first thought when I saw this was "ego over ethics," which says more >>> about Theo than FreeBSD. >> >> Totally. >> >> I know Theo has a reputation for being 'difficult', but in my opinion, >> this outburst really calls into question his perceived motivations >> regarding secure software. >> >> As to the specific question, I don't think his ego would allow a bug >> in openssh to persist, so even if it does, I'd suspect it's not too >> serious (or it's non-trivial to exploit), and it's related to FreeBSD >> produced 'glue'. >> >> This is total guesswork on my part, but I'd therefore assume he was >> talkining about openssh in base, rarther than openssh-portable in >> ports. >> > >As the maintainer of the port I will say that your security decreases >with each OPTION/patch you apply. I really would not be surprised if one >of the optional patches available in the port had issues. I believe that Theo just browbeat. Reasons? It was looooong ago, I think very few still remember, but Theo definitely does: http://lists.freebsd.org/pipermail/freebsd-security/2005-March/002719.html
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?535326fa.ab7281.696ea278>