OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: OpenBSD remote root
From: Dan Harkless (dan-bugtraqDILVISH.SPEED.NET)
Date: Tue Dec 19 2000 - 19:50:01 CST

Emre <emreSRENGINEERING.COM> writes:
> On Sunday 17 December 2000 23:26, Typo Princep wrote:
>
> > Now the funny thing is that 2 weeks have passed since the initial
> > bugreport, to the openbsd bugs mailinglist, and NetBSD in the meanwhile
> > seems to have put OpenBSDs bugfix into cvs.
> >
> > But noone has made the userbase aware of the security problems nor has any
> > further discussion taken place on obsd-bugs.
>
> >From http://www.openbsd.org/plus.html:
>
> SECURITY FIX: Fix buffer overflow in ftpd
> A patch is available.
> [Applied to stable]
>
> For us, who check the daily changelog, this isn't new. I dont believe it's
> OpenBSD's responsibility to notify every user of EVERY bug they fix. It's
> your (the user's) responsibility to keep up with patches and such. If you
> really care about your security, you should check the webpage more often.

This has been argued before, but many think that OpenBSD's policy of not
having a specific security announcement mailing list is rash and is poor
security policy. It's great to say that someone should "check the webpage
more often", but obviously not everyone can watch it every instant. There
are plenty of times when one is too busy to actively check something, but if
it were announced to them in a "push" format, they'd make time to deal with
it. This way you wouldn't have to waste time continuously checking and
finding no update -- you'd simply get updated when there was an update
available.

True, one could write some kind of script to continuously check the
appropriate web page(s) and grep for certain keywords in diffs vs. previous
versions, but this is error-prone and wouldn't be necessary if the OpenBSD
team just acted like almost every other vendor on the planet and provided a
security announcement list.

----------------------------------------------------------------------
Dan Harkless | To prevent SPAM contamination, please
dan-bugtraqdilvish.speed.net | do not mention this private email
SpeedGate Communications, Inc. | address in Usenet posts. Thank you.