[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Nov 2013 13:32:04 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: cryptographic primitive choices [was: Re: Microsoft
Warns Customers Away From RC4 and SHA-1]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 11/15/2013 12:18 PM, Chris Palmer wrote:
> On Thu, Nov 14, 2013 at 10:58 PM, Kurt Seifried
> <kseifried@...hat.com> wrote:
>>
>> Think of all the things that currently use (often older versions
>> of) OpenSSL/PolarSSL/GnuTLS/etc and will never get updated...
>
> I posit that there is a strong correlation between un-updated,
> un-updatable software that did not ship with (for example) support
> for modern cipher suites and protocols, and software that should
> be recalled for a variety of reasons. Random example:
>
> https://securityledger.com/2013/08/samsung-smart-tv-like-a-web-app-riddled-with-vulnerabilities/
>
> Let's unpack your use of the passive voice: Who, exactly, is
> choosing not to update the OpenSSL they ship? Why do we forgive
> that?
We don't have a choice? We already paid our money and as far as I know
we have no recourse? We can buy "not that vendor" but all the vendors
do this, simple economics, you paid for it, why would I spend money
supporting it? Especially when that model is no longer being
manufactured. Especially when my customers appear to have no
expectation that I'll support it?
This is why I bought a "dumb" TV. And why I won't get a carrier
controlled Android phone ever (they have a less then perfect upgrade
track record). But most people are not crazy and paranoid like me.
> To an extent, even security engineers are acting as enablers,
> allowing obsolete software/protocols/cipher suites to live far
> longer than they should have.
We can't force stuff to die, and I bet those security engineers
usually lose to managers talking about margins and such.
> "LTS", "ESR", and not EOL'ing Windows XP 4+ years ago is a
> significant part of the problem.
I can't speak to that, even if we support OpenSSL/whatever long term
that's only the tip of the proverbial ice berg. The supply chain for
this stuff is _deep_.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
iQIcBAEBAgAGBQJShoTEAAoJEBYNRVNeJnmTEo8QAL0VRMCKMS3nzd9Dhd7I1+Rx
yhov1UmK9WhZyK2aLsy21XZ33vjGd2uhkynCrq+Uo/x8hxGTrbrXVzT8jDuU+b7I
NCZfo2pks7y/Qp+KtSiIw3IyF9b8OFGuMgEK5znLFigz1wFWGwjRQnybiMag3WAQ
F5HDDgEshbiTCyWBrUvjyY0lIok1Y9CyzkTFcnSGQ9WhUPDQxOZ1laUhJVvz5yX8
kbAnbblnnSwpW1zMPRB79RLJFy4Rkq+rGm1tzbsavaesmPRhdDf3PZ1ZTFEwI/bn
No0I5xzUPpiD1jBgHxWFfD40+CAr2VISR7FObD/JHeSF0+Tpy2pBeq7RW4/MM5w7
/cznS7Cd17A74InICfjfbTkRaMCY2qfrdPo7sI4O33QteaeXRGKg1BrNimLq+LF+
KRTVlb5RkuHVfgppq9/Jh4n3B4avDkeiUYyAtTRNvmhgu9Hyj8tN9I3nIylWXIzI
wCoHMr7oYc6Xa/RydnVVy9h2LVdZiuePCQ0RyEatW59HuPL471DxLr6o2HCZe8TT
/kOdjGz22CooKryIa+pm434sdVlPMVTRtkJkWKtWlEf7NfdGqiK4rlEebuQWiRR2
ylqFn7vgWfCT9jsYEzJW92NnqV1F9Swh9ZuOU4Ac8oLDqcVx3ckHPWWWjOhFnrnY
Bq0PRSTYZPP/PvNlrVS4
=wdou
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
