[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <55006ABD.4040208@oracle.com>
Date: Wed, 11 Mar 2015 16:18:05 +0000
From: John Haxby <john.haxby@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Another Python app (rhn-setup: rhnreg_ks) not
checking hostnames in certs properly CVE-2015-1777
On 11/03/15 15:48, Kurt Seifried wrote:
> On 03/10/2015 08:05 PM, Michael Samuel wrote:
>> Hi Kurt,
>>
>> Your corporate pissing match with Oracle is not helpful.
Indeed, please cut it out. You're dealing with an individual, me,
here. I'm just someone who is trying to improve things in small but
useful ways. Someone who, incidentally, is personally hurt all of this.
>
> I think there's probably some cultural disconnect here that is
> causing issues, a big part of Red Hat is "upstream first" and doing
> things the open source way.
We're actually no different, whatever you might think. (Obviously this
does not apply to the large suite of closed or semi-closed applications
that oracle produces; I'm only talking about the Linux group here.)
[snip]
> However here's the cool thing. If Oracle thinks they have a good
> solution they can participate with upstreams, or simply try it.
I think there's a misunderstanding here. I was asking for cooperation
to come up with a solution, participating with other people who, like,
I assumed, Red Hat, have an interest in solving this specific problem
without breaking existing (admitedly flawed) applications. I know it's
not straightforward, if it was I'd've just produced a patch. I'm still
happy to work with anyone to sort this out.
[snip]
> I am actually working on something that will hopefully provide a
> better solution (for values of speed and ease of fixing flaws) than
> a traditional audit/code fix, (I'd rather address entire classes
> of security flaw rather than one instance of the flaw at a time).
> But like all things security infinite workload delays specific
> projects.
If this fixes the specific problem as a side effect that would be
great. Details are lacking though, and there's no obvious link here
to making adapting PEP-466 for backwards compatibility (and I have
absolutely no arguments with the rejected solutions for Python).
This is my last message on the list on the subject.
jch
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
