And in a piece of vital security infrastructure, trust is everything.
It would be interesting to read more details about this audit. This blurb is pretty much "Trust us" with more letters.
Edit: tried to add more clarification to address jtchang's question.
Publicly releasing an audit puts the auditor's reputation on the line. As such, the audit will always be performed very seriously, digging into the code and scrutinizing every possible angle - at a level usually not even remotely done for a private audit.
All said: a private audit means squat all.
About half the companies don't want the audit results going anywhere else. About half are OK with distribution under NDA. In between, there are companies which will negotiate the right to distribute, usually with an explicit indemnity clause, and on the far end are a minority of companies that tell you that the results are work for hire and entirely your prerogative.
The major concern is that the customer will misrepresent the results in some way, or even represent them accurately but then change the underlying service to open up a vulnerability. Either way, nobody really wants to be in the news...
Ditto, it just basically says "trust us"; no offense to the authors.
qwertyuiop924: I'm with you. When it comes to security it pays off to be skeptical and pragmatic. We're on the hook of keeping it robust, simple and secure for years to come. So eventually, with the help from the OSS community, we expect it to earn your trust, hopefully sooner than in 17 years though :)
Trust is based on an individual's experience over time. It can also be based on statistical observations over time. Statistically, nearly every single piece of software in use today has had a security hole in it at some point in time and many still have them. Audit or not, openssh is included in this fact. Today's infrastructure software is far too complex to ever be secure past a certain statistical threshold, at least without reinventing the way the Internet works.
Your comments are curious given Teleport just came out. One comes to trust something by spending time with it first. You can't apply anti-trust to something just because it's not the same as something you do trust.
And yes, you do start out with anti-trust if you're replacing something I trust, because you then have to be at least that trustworthy to replace it.
I don't follow this line of reasoning. I was with you for the opening sentence - trust is a thing earned over time - and then you lost me.
Statistically it is a near-certainty that OpenSSH does have undiscovered security holes. The trust that the maintainers have built over years makes me comfortable with that, because I know they will be rapidly addressed in a reasoned out manner.
I don't see gp as applying anti-trust just because it is different from OpenSSH - I see it as the maintainers of Teleport not yet having earned the trust that the maintainers of OpenSSH have.
And statistically as a new product with a new code base, Teleport is likely to have more security issues than an established product actively monitored for security flaws in the same space.
So the issue is not a matter of "new and different is bad", so much as "new product and (relatively) unknown community behind it are unproven". Those two factors combined make it inherently less trustworthy in a space where trustworthiness is critical.
This is the basic argument they are making:
> I don't trust it as much as I trust openssh...And in a piece of vital security infrastructure, trust is everything.
This is an implicit statement that all infrastructure tends toward full trustworthiness by the increasing use of legacy software. It also implies that trusted infrastructure affects everyone (which is true). Together, this is a logical fallacy - infrastructure will never be 100% trustworthy and when it breaks it will not affect everyone the same. You yourself made that observation regarding holes in OpenSSH. It is anti-trust, or "inverse trust" (if one is a stickler for terms) when one attempts to publically imply their individual/internal trust of a thing is based on their societal/external trust of another thing which is being used in a mutually exclusive way. That itself is an anti-competitive practice, whether intentional or not.
I think calling this flawed logic out is important when the subject is trust and security. There's a reason for the limit of causality in our universe. The lesson we can take from that limit would be to not apply inverse internal trust to something to prevent it's external use when using it is required to trust it.
I fail to see what's wrong with saying that a new piece of software hasn't yet earned the trust that an older piece of software has. However, I never said that it could not earn that trust. That's an assumption on your part.
And I don't distrust Teleport because OpenSSH exists, I distrust Teleport because it hasn't proven its reputation yet. If OpenSSH didn't exist, I'd be saying the same things. The difference is, because OpenSSH does exist, I can make a comparison to piece of infrastructure I do trust.
And I do agree that we cannot move forward with existing infrastructure, I just don't trust this particular piece of new infrastructure yet.