OpenBSD doesn't keep secrets. The X.org team had to keep this secret, so they couldn't tell OpenBSD.
If OpenBSD starts participating in embargoes, they'll get advance notice of vulnerabilities. It's as simple as that.
If OpenBSD starts participating in embargoes, they'll get advance notice of vulnerabilities. It's as simple as that.
I don't know if it would actually work, but that would at least put responsibility for handling this on Theo.
Theo's response was to (a) announce to the world at large that I was coordinating disclosure of a major vulnerability, and (b) threaten to withhold information about OpenSSH vulnerabilities from FreeBSD unless I shared details about this vulnerability with him -- even though it didn't affect OpenBSD!
So... my best guess is that Theo's response to your proposed email would be "hey everyone, eridius is going to be announcing a vulnerability at <deadline> and he's refusing to tell me what it is".
I kinda get the rationale for breaking embargo and disclosing information about a vulnerability to the world. I don't agree with it, but I at least understand why someone might think that's a reasonable thing to do.
I don't at all understand why anyone would try to publicly announce the fact that a vulnerability exists without actually knowing the details. The fact that the exists some vulnerability in a product doesn't give you enough information to protect yourself from it (short of not using the product at all, but that's generally infeasible). But the knowledge that there is a critical vulnerability in a product does give malicious actors reason to dedicate effort towards probing that product to try and rediscover the vulnerability. So announcing this helps nobody and potentially causes great harm.
You should assume that well-funded, capable and malicious (at least from someone's perspective) state-level actors are aware of and exploiting these flaws _whenever_ they exist. It's their mandate to do so.
And yeah, perhaps nation-state actors already know of the flaw (but perhaps not as well, they're not omniscient), but for most people, it's not nation-state actors that are the biggest threat, it's all the other malicious people out there.
This actually sound quite reasonable to me.
Knowing the details would make the difference between drastic and inconvenient mitigations (maybe no graphics at all) and just "disabling legacy drivers and lose the setuid bit".
If after my warning hackers start focusing on X, my users are already on the run: it isn't a problem for them.
No atom in their body is even the same. (Supposedly.)
Replying to him in the thread is Ted Unangst, a high-profile OpenBSD developer.
You mean that OpenBSD discovered this issue by themselves when they were left out of an ongoing embargo?
Please explain to me how one can break an embargo they are not a part of in the first place?
Someone leaked it to them.
Since you didn’t answer my question, let me try again. How can someone break an embargo they’re not a part of?
To me the mess back then was a very convenient distraction from the real issue, for Intel and their embargo.
Given that Theo maintains OpenBSD and what has come out of the project (https://www.openbsd.org/innovations.html), I think it's pretty clear that Theo is an extremely productive member of the community.
> [Theo] isn't interested in acting as a productive member of the community.
That's not saying he is not an extremely productive member of the community. It's saying that he is not acting in a way appropriate for that role. It's like when people say that Trump is not presidential, they don't deny that he is president.
However, given Theo de Raadt's colorful past, OpenBSD's relatively small userbase, and this relatively minor incident, I can see how other companies may think that it's not worth the risk of including OpenBSD in an embargo. It's not fair, but it is what it is.
It's an important opinion, without any unnecessary words added.
[edit: It's probably more accurate to say that Theo doesn't want to agree to an embargo.]
Given that nobody here seems to be able to point to a single embargo that has been broken, how exactly do you propose he do that?
> Why did OpenBSD silently release a patch before the embargo? OpenBSD announced an errata on 30 August 2017 that silently prevented our key reinstallation attacks. More specifically, patches were released for both OpenBSD 6.0 and OpenBSD 6.1.
> We notified OpenBSD of the vulnerability on 15 July 2017, before CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt replied and critiqued the tentative disclosure deadline: “In the open source world, if a person writes a diff and has to sit on it for a month, that is very discouraging”. Note that I wrote and included a suggested diff for OpenBSD already, and that at the time the tentative disclosure deadline was around the end of August. As a compromise, I allowed them to silently patch the vulnerability. In hindsight this was a bad decision, since others might rediscover the vulnerability by inspecting their silent patch. To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.
In other words: "We said they could make their users more secure by applying the patch, and they did."
I'm not saying that he has agreed to embargoes and then broken them. I'm saying that he has made it clear that he isn't interested in acting as a productive member of the community.
What Theo and others, including myself, have made clear is that embargoes suck, and we will complain about them as is our right, but we will attempt to honor them if that's how it going to be.
I disagree. Embargoes are good for users, as long as (a) people actually respect the embargoes (rather than leaking details, whether to Theo or on a public Linux kernel mailing list), (b) the right people are part of the embargo, and (c) the embargo is not unreasonable long (Intel in particular fails here).
The decision to not work together on lazy FPU was made before Theo got involved.
Leaving aside the question of who refused to sign an NDA, after details were leaked to Theo he made a decision to go public rather than attempting to work productively with other vendors.
What Theo and others, including myself, have made clear is that embargoes suck, and we will complain about them as is our right, but we will attempt to honor them if that's how it going to be.
You can complain all you want, but if you want other people to give you advance notice of vulnerabilities they find, you should be prepared to give people advance notice of vulnerabilities you find. As long as OpenBSD has a policy of "bugs we find get fixed immediately, without talking to other vendors" you're going to run into problems here.
We need to be honest that embargoes serve a couple different purposes. One might be to prevent the leaking of information to malicious actors, and another is to protect vendors and HW manufacturers from embarrassment. As a user I don't care about the latter. Also, as someone concerned with the state of the world I dislike secret clubs, and I fear the reliance on secret clubs provides a false sense of secretivenss. Secrets leak.
If the bug is important enough to warrant an embargo it needs to be fixed ASAP. A month is too long to run with an important vuln in running code. It's always going to be a balance, and as a user not involved in any secret security clubs I want those bugs fixed and in the public space as quickly as reasonably possible.
Who exactly wasn't willing to work with who here?
Is OpenBSD supposed to comply with secret terms that they are purposely not made aware of, nor have agreed to?
That's a pretty unfair standard don't you think?
I've witnessed conversations since then between Intel people and FreeBSD people basically consisting of FreeBSD people saying "you guys really need to include OpenBSD" and Intel people saying "yeah... can you help get us connected with the right people?" so I don't think it's fair to suggest that OpenBSD is being purposely excluded.
Is OpenBSD supposed to comply with secret terms
I think that OpenBSD should follow the norms of the security community, i.e., contacting other operating system vendors and coordinating disclosures -- regardless of how they come across a vulnerability.
So that one day they might get invited to the cool kids secret club?
Not breaking embargoes doesn't seem to have done that for them yet.
Instead we get people like you FUDing about how they are unable to keep secrets and are justifiably being blocked from information.
I'd rather they look out for me, a user, than get the worst of both worlds, just because one day it might pay off.
these kind of memes last literally forever, in 10 years they will still be talking about how OpenBSD "broke" the KRACK embargo, and we shouldn't tell them anything.
You discovered the secret, but recognize that embargoes still have value even if you weren't part of it. Be the better project, show magnanimity, and don't place end users of other projects at undue risk.
> That's a pretty unfair standard don't you think?
"An eye for an eye makes the whole world blind".
Its pretty much beyond debate that multiple malicious parties knew about the Intel issues many months before they were allowed to be fixed.
Coordinated disclosure is not some kind of unmitigated good.
I played a small role in that after Theo announced the Lazy FPU issue, by writing exploit code and telling Intel (via the FreeBSD people in the embargo) "shorten the embargo or else".
If you want to lead market in mission-critical product, there's a certain amount of responsibility that you have to your customers and more than once Intel has lost sight of that.
Don't project your opinions about disclosure to other people and their intentions.