Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 9 Mar 2015 18:52:58 +0000
From: John Haxby <john.haxby@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777


> On 9 Mar 2015, at 16:47, Kurt Seifried <kseifried@...hat.com> wrote:
> 
> If vendors want features in their rebranded RHEL they can add them. I
> have no clue why you would need broad agreement from the community
> including Red Hat to add a feature to Oracle Linux.

On the other hand, if two loosely compatible vendors want the same feature it makes sense to have the feature implemented in the same way.

For this python certificate validation, we could have as many different mechanisms as there are distros and chaos would rule.   Even worse, you might pick the mechanism from the wrong distro and it has no effect and we (people on this list) would be guilty of weakening security by confusion.

It’s not a question of lack of talent: all the distro vendors have talented people who can fix problems, it’s a question of doing the best by our joint customer base.

Does that make sense?

jch

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ