full-disclosure - openssh remote exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200309162043.h8GKhHgg004426@caligula.anu.edu.au>
From: avalon at caligula.anu.edu.au (Darren Reed)
Subject: openssh remote exploit

In some mail from Edward W. Ray, sie said:
> 
> Either your just an ass or an Theo hater or both.
> 
> Either way, your comments are without merit.  If one looks at the record of
> OpenBSD and OpenSSH it is certainly way better than the other software out
> there.

Really ?  I think you'll find that there are quite a number of people,
aside from myself, who think that the "1 exploit in X years" is on one
end of it as misleading and the other end, a lie, excluding this current
openssh problem.

But that statement is as much market fodder as much anything else.

As for the "way better", I'll take your comment as a completely
subjective comment as the way in which you measure software
quality may not be the same as the way I (or others) measure it.

I could go on and cite examples but I don't think that's necessary.

Some people, like you, believe openbsd/openssh is the best software
that exists today.  Others don't and I'm sure there are examples and
counter examples to prove either side.  My only advice is try not to
take criticism of it personally.

Darren