Bugtraq mailing list archives
Re: OpenBSD remote root
From: Dan Harkless <dan-bugtraq () DILVISH SPEED NET>
Date: Tue, 19 Dec 2000 17:50:01 -0800
Emre <emre () SRENGINEERING COM> writes:
On Sunday 17 December 2000 23:26, Typo Princep wrote:Now the funny thing is that 2 weeks have passed since the initial bugreport, to the openbsd bugs mailinglist, and NetBSD in the meanwhile seems to have put OpenBSDs bugfix into cvs. But noone has made the userbase aware of the security problems nor has any further discussion taken place on obsd-bugs.From http://www.openbsd.org/plus.html:SECURITY FIX: Fix buffer overflow in ftpd A patch is available. [Applied to stable] For us, who check the daily changelog, this isn't new. I dont believe it's OpenBSD's responsibility to notify every user of EVERY bug they fix. It's your (the user's) responsibility to keep up with patches and such. If you really care about your security, you should check the webpage more often.
This has been argued before, but many think that OpenBSD's policy of not having a specific security announcement mailing list is rash and is poor security policy. It's great to say that someone should "check the webpage more often", but obviously not everyone can watch it every instant. There are plenty of times when one is too busy to actively check something, but if it were announced to them in a "push" format, they'd make time to deal with it. This way you wouldn't have to waste time continuously checking and finding no update -- you'd simply get updated when there was an update available. True, one could write some kind of script to continuously check the appropriate web page(s) and grep for certain keywords in diffs vs. previous versions, but this is error-prone and wouldn't be necessary if the OpenBSD team just acted like almost every other vendor on the planet and provided a security announcement list. ---------------------------------------------------------------------- Dan Harkless | To prevent SPAM contamination, please dan-bugtraq () dilvish speed net | do not mention this private email SpeedGate Communications, Inc. | address in Usenet posts. Thank you.
Current thread:
- OpenBSD remote root Typo Princep (Dec 18)
- Re: OpenBSD remote root joshua stein (Dec 19)
- Re: OpenBSD remote root Emre (Dec 19)
- Re: OpenBSD remote root Dan Harkless (Dec 20)
- Re: OpenBSD remote root Jose Nazario (Dec 20)
- Re: OpenBSD remote root Dan Harkless (Dec 21)
- listing of vendor's security-announcement lists Matt Power (Dec 22)
- Re: OpenBSD remote root Dan Harkless (Dec 20)
- Re: OpenBSD remote root David Damerell (Dec 20)
- <Possible follow-ups>
- Re: OpenBSD remote root Theo de Raadt (Dec 21)