oss-security - Re: Re: Some fun with tcp

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Thu, 16 Apr 2009 12:45:49 +0200
From: Tomas Hoger <thoger@...hat.com>
To: wietse@...cupine.org
Cc: oss-security@...ts.openwall.com
Subject: Re: Re: Some fun with tcp_wrappers

On Wed, 15 Apr 2009 14:53:22 -0400 (EDT) wietse@...cupine.org (Wietse
Venema) wrote:

> Wietse Venema:
> > > "test-hostsctl servicename unknown IP unknown" is what some
> > > applications do expecting tcp_wrappers to resolve IP to hostname.
> > 
> > I think that it would be a mistake to change a documented API that
> 
> On the other hand, if you could add a new function under a new name
> that does have the expected behavior, then there would be no
> confusion, no risk of cross-platform applications breaking, and I
> would withdraw my objection.

That does not sound like a viable alternative and is likely to damage
portability lot more, let me explain:

- Application upstreams will not (should not) use any API that is
  vendor-specific extension and not included upstream.  Even if there
  is some new upstream version, it might take years to get into wide
  enough use to applications to use new API, and result in
  incompatibility with old systems.

- Applications change would be required.  If that is done, there's
  little reason to change to new API instead of existing hosts_access.

I fail to see benefits of new API, only greater risk.  Sorry.

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.