oss-sec mailing list archives
Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777
From: Kurt Seifried <kseifried () redhat com>
Date: Mon, 09 Mar 2015 10:47:57 -0600
This is off topic but anyways, I don't care if people repackage RHEL and give it away/sell it, that's something the business model we have explicitly takes into account, and indeed something we actively support with groups that participate meaningfully in the open source community (e.g. with the CentOS and Scientific Linux community). If customers want features in RHEL asking on oss-security is not the way to go about it, ask your TAM/GSS. If vendors want features in their rebranded RHEL they can add them. I have no clue why you would need broad agreement from the community including Red Hat to add a feature to Oracle Linux. If you lack the engineering talent to add this feature, then at least with RHEL you can become a customer and get support (new features if requested by enough customers obviously become more of a priority but I can't make any promises obviously). Which leads back to the "ask your TAM/GSS" point. On 08/03/15 11:18 AM, John Haxby wrote:
On 7 Mar 2015, at 03:54, Kurt Seifried <kseifried () redhat com> wrote: On 06/03/15 06:08 AM, John Haxby wrote:On 06/03/15 01:02, Kurt Seifried wrote:Please contact your TAM/GSS with this request, it carries a lot more impact if customers want something that we also want.I know "me too" isn't helpful, but I'm going to say "me too" anyway. It occurred to me that we could have a patch that has a global switch (eg a file in, say, /etc/sysconfig and a corresponding switch for individual applications) that switches on the correct behaviour. I know it's a bit of a mess, but that way people who don't care will continue in blissful ignorance and people that do care can do something about it.That would be one way. But why can't Oracle build it and open source it? Oracle has a Linux distribution too I thought? Or do you need Red Hat engineering to do it first? If so as I said, customer cases carry far more weight than oss-security for feature requests.Sorry, I didn’t mean to imply that Red Hat should do this first. I’m also sorry if this came across as antagonistic: my intention was to try to find a way forward that would be beneficial to us both and to everyone else. There is no reason at all why I should not do this, but I would rather do it with broad agreement. There is also absolutely no way this could be done as closed-source and I’m not sure why you think I could or would do that. If both Red Hat have customer requests then that would help everyone would it not? jchjch-- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 04)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Donald Stufft (Mar 04)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 04)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 05)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 05)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 05)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 05)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 06)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 06)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 08)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 09)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 09)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 09)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 10)
- Re: PEP-466 common compatible implementation. (was ... CVE-2015-1777) John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 04)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Donald Stufft (Mar 04)