Date: Wed, 11 Mar 2015 16:18:05 +0000 From: John Haxby <john.haxby@...cle.com> To: oss-security@...ts.openwall.com Subject: Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 On 11/03/15 15:48, Kurt Seifried wrote: > On 03/10/2015 08:05 PM, Michael Samuel wrote: >> Hi Kurt, >> >> Your corporate pissing match with Oracle is not helpful. Indeed, please cut it out. You're dealing with an individual, me, here. I'm just someone who is trying to improve things in small but useful ways. Someone who, incidentally, is personally hurt all of this. > > I think there's probably some cultural disconnect here that is > causing issues, a big part of Red Hat is "upstream first" and doing > things the open source way. We're actually no different, whatever you might think. (Obviously this does not apply to the large suite of closed or semi-closed applications that oracle produces; I'm only talking about the Linux group here.) [snip] > However here's the cool thing. If Oracle thinks they have a good > solution they can participate with upstreams, or simply try it. I think there's a misunderstanding here. I was asking for cooperation to come up with a solution, participating with other people who, like, I assumed, Red Hat, have an interest in solving this specific problem without breaking existing (admitedly flawed) applications. I know it's not straightforward, if it was I'd've just produced a patch. I'm still happy to work with anyone to sort this out. [snip] > I am actually working on something that will hopefully provide a > better solution (for values of speed and ease of fixing flaws) than > a traditional audit/code fix, (I'd rather address entire classes > of security flaw rather than one instance of the flaw at a time). > But like all things security infinite workload delays specific > projects. If this fixes the specific problem as a side effect that would be great. Details are lacking though, and there's no obvious link here to making adapting PEP-466 for backwards compatibility (and I have absolutely no arguments with the rejected solutions for Python). This is my last message on the list on the subject. jch
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ