full-disclosure - Re: OpenBSD IPSEC has backdoor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D084876.3040105@hawkhost.com>
Date: Tue, 14 Dec 2010 23:47:50 -0500
From: Cody Robertson <cody@...khost.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: OpenBSD IPSEC has backdoor

On 12/14/10 11:36 PM, musnt live wrote:
> On Tue, Dec 14, 2010 at 9:29 PM, Graham Gower <graham.gower@...il.com> wrote:
>> On 15 December 2010 12:05, musnt live <musntlive@...il.com> wrote:
>>> Original e-mail is from Theo DeRaadt
>>>
>>> Is my question: "Why is now Theo cower like rat." Is because his
>>> stance from the beginning: "we is audit everything" for make me
>>> believe Theo was is also on the payroll. Enjoy everyone.
>>
>> I have no idea what you're talking about here. Theo has always been
>> pragmatic regards security. He could easily have ignored this mail,
>> but decided to make it public in the spirit of full disclosure.
>>
>> It seems like a difficult task to flat out deny that a backdoor was
>> inserted, given the circumstances. So he's probably just taking the
>> opportunity to get more eyeballs on the code, which will be positive
>> regardless of whether backdoor(s) are found.
>>
>> -Graham
>>
> 
> It is for no difficult task in this him to do so. By Theo disclosing
> is this email he is take pre-emptive strike in this that the event for
> if he no say anything this original author come forward and say: "I is
> told you so, Theo is know all along"
> 
> Is you no familiar with this is OpenBSD, OpenBSD is for too highly
> audited code especially from Theo. You is cannot is have is this two
> way:
> 
> "We are ultra secure and we audit everysing including our babushka's panties"
> 
> and
> 
> "We is not know, for is to maybe we is should audit this now"

It seems like you may be digging too deeply into this. Ultimately if it
ended up being true you may be correct that he could use this to cover
himself however to me he's being responsible disclosing this. I'm sure
politics is in his mind however the ultimate concern is the potential
scope of the issue if it turns out true. Full disclosure of the e-mail /
concern is fully warranted and responsible in my eyes.

Perhaps stick to the issue at hand instead of digging into ulterior
motives - I find the actual issue itself more intriguing than Theo
looking for an "out".

-Cody

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/