bugtraq - Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 24 Mar 2006 19:33:04 -0500
From: "D.F.Russell" <DFRussell@...mcop.net>
To: Theo de Raadt <deraadt@....openbsd.org>
Cc: Martin Schulze <joey@...odrom.org>, bugtraq@...urityfocus.com
Subject: Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS,
 Memory Jumps, Integer Overflow)




Theo de Raadt wrote:
>>Sendmail has been an important part of the Internet infrastructure and
>>has gained a lot of honour and respect.  Many people use this piece of
>>software and a lot of distributors/vendors are proliferating this
>>software.  They do deserve better, as do the users who decide to trust
>>this vendor.
> 
> 
> Paul Vixie did not decide that BIND should become a critical part of
> the internet, or that it became a virtual monoculture.  He made it
> free.  The community decided to make it Internet infrastructure.
> 
> Eric Allman did not decide that BIND should become a critical part of
> the internet, or that it became a virtual monoculture.  He made it
> free.  The community decided to make it Internet infrastructure.
> 
> I did not decide that OpenSSH should become a critical part of the
> internet, or that it should become a virtual monopoly.  We made it
> free.  Again, the community decided to make it Internet infrastructure.
> 
> 
> Now you want to tell us that because the Internet community made
> decisions like these, that we should be held responsible.  That we
> have to follow YOUR procedures.  That we have to answer to YOU.
> 
> What if we ignore your procedures?  What if we say no?  What will you
> do then?  Continue to verbally attack us?  To what end?  To show that
> you are thankless dogs?

[...]

> 
> You (and others like you) should be ashamed.  I am done with this
> conversation.

[...]

I would imagine that a number of people have been following this
discussion... and the technical issues have been well covered by
people more conversant with the software involved than am I.

I'd just like to say thanks to Theo, Paul and Eric for the effort
and hours they've worked on the products being discussed.. and
hope that more people would do the same.


Observation to the opposing side:

Being kind: the complaints being voiced appear to lack merit or
substance... which causes people to wonder what the real point of
them is...

You're way past looking a gift horse in the mouth.

Maybe it's a good time to stop?