[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 29 Mar 2024 21:54:11 -0000 (UTC)
From: Tavis Ormandy <taviso@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: backdoor in upstream xz/liblzma leading to ssh server compromise
On 2024-03-29, Solar Designer wrote:
>> I have a minor procedural question for Solar though, shouldn't this
>> have been redirected to oss-security immediately from distros? What's
>> the rationale for an embargo here?
>
> We don't have a clear policy for such case. Some distros list members
> have indeed suggested making this public ASAP. We ended up delaying
> publication by one day per my suggestion (as a compromise between ASAP
> and having no specific CRD), and I think these are some reasons why:
Thanks, a compromise is better than nothing :) I think I would have
argued for immediately discussing this in the open.
>
> If this were made public yesterday, there would be more of a panic.
There are lots of actions possible without any official guidance from
vendors, and sometimes hours can make a difference. I don't think it's
fair to characterize that as panic.
>
> 2. We didn't know how the culprit (or group) would react when they
> learned of the full extent of the community's awareness.
This is true with any vulnerability, there is always the possibility an
attacker is already aware of it. They could respond to a patch being
released by trying to extract as much value from their exploit before
it's worthless.
I'm not convinced that's a good argument to delay making the patch available?
> 3. We were aware of concurrent coordination efforts by other groups
> (CERT/CC, CISA) and we didn't want to interfere with their plans.
The trade-off here is we're delaying everybody elses ability to react.
I worry they might want a delay to patch the systems they care about
first.
Perhaps if a representative had said the feds request a few hours
because they're deploying a helicopter full of agents to make an arrest,
well okay, that's more convincing :)
> 4. More findings were still being made and the wording of Andres'
> posting improved per private feedback.
>
Sure, but this could have been done in the open on oss-security, right?
Tavis.
--
_o) $ lynx lock.cmpxchg8b.com
/\\ _o) _o) $ finger taviso@....org
_\_V _( ) _( ) @taviso
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
