Date: Wed, 11 May 2016 07:09:46 +0200 From: Michael Scherer <misc@...b.org> To: oss-security@...ts.openwall.com Cc: security@...keeper.com Subject: Re: BitKeeper /tmp vulns On Tue, May 10, 2016 at 12:40:50PM -0700, Larry McVoy wrote: > In the past, at least, BitKeeper was run inside a firewall and in an > environment where users are trusted. As such, I suspect that you have > just begun to scratch the surface, I wouldn't be at all surprised to > see dozens more like this. If the security model is "everybody is trusted and we have firewall", the frontpage of https://www.bitkeeper.com/ with "Hardened for the Enterprise.", is a bit misleading, as is the part on "security" and "safety" on https://www.bitkeeper.com/why_why_buy I do get that "hardening", "security", "safety" can mean different things to different people, but "insecure on a shared server" is not written anywhere in the documentation. > We've never had anyone complain about this in a real world situation > so we've never focussed on it. I am not sure to fully understand, so allow me to rephrase based on my understanding. Because no one complained and found the problem before among your clients, (that likely didn't had the source code to begin with, and also no expectation of being able to read without likely infriging copyright), the BK team didn't focused on trying to be proactive and fixing security issues that ook 5 minutes to be found ? (or updating code bundled for a 15 years old CVE) > If you care about this stuff we'll > gladly take patches. I am sorry, but that's not exactly the kind of answer that motivate me to work on a software I do not use. But since you agree that's a security problem, I guess I can now officially request CVE for the issues that do not have one. -- Michael Scherer
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ