Another bug on OpenSSL

[Álvaro Castillo]

Dear mailing list,

Few days was built an patch to solve an another vulnerability into
OpenSSL(http://bits.blogs.nytimes.com/2014/06/05/new-bug-found-in-widely-....
Some sources talks about that's bug was discovered a long time ago but
does not fixed.

However, OpenBSD was created a fork called LibreSSL try to solve this
issues. Should Fedora to move LibreSSL (http://www.libressl.org/)? Or
still use OpenSSL and wait what's bug could be found today, or
tomorrow, or few months to go similar Adobe Flash bugs?

[Jon Kent]

At present I have more trust in the OpenBSD guys than OpenSSL based upon
their previous work. So I'd prefer to move to LibreSSL once stable

Just my 2c worth.

Jon
On 8 Jun 2014 15:21, "Álvaro Castillo" <netsys(a)fedoraproject.org&gt; wrote:

>  Dear mailing list,
>
>  Few days was built an patch to solve an another vulnerability into
>  OpenSSL(
>
> http://bits.blogs.nytimes.com/2014/06/05/new-bug-found-in-widely-used-ope...
>  ).
>  Some sources talks about that's bug was discovered a long time ago but
>  does not fixed.
>
>  However, OpenBSD was created a fork called LibreSSL try to solve this
>  issues. Should Fedora to move LibreSSL (http://www.libressl.org/)? Or
>  still use OpenSSL and wait what's bug could be found today, or
>  tomorrow, or few months to go similar Adobe Flash bugs?
>  --
>  devel mailing list
>  devel(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/devel
>  Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

[Nico Kadel-Garcia]

It's not stable yet, and it's not ported to other operating systems.
the folks over at OpenBSD do import some powerful security tools and
keep them clean, such SSH. (No, they didn't writ it, they ported it
and maintain the core code.)

But that means it's unlikely to work well on other operating systems
until it's ported back: The folks there have some interesting policies
about randomization, chroot behavior, and coding to OpenBSD, not any
other OS, that will keep  it unstable for a while on other operating
systems.

Now, if you've got the expertise and time to help with that, it seems
a well founded and sensible project.


On Sun, Jun 8, 2014 at 10:34 AM, Jon Kent <jon.kent(a)gmail.com&gt; wrote:
>  At present I have more trust in the OpenBSD guys than OpenSSL based
> upon
>  their previous work. So I'd prefer to move to LibreSSL once stable
>
>  Just my 2c worth.
>
>  Jon
>
>  On 8 Jun 2014 15:21, "Álvaro Castillo" <netsys(a)fedoraproject.org&gt; wrote:
> >
> > Dear mailing list,
> >
> > Few days was built an patch to solve an another vulnerability into
> >
> >
> OpenSSL(http://bits.blogs.nytimes.com/2014/06/05/new-bug-found-in-widely-....
> > Some sources talks about that's bug was discovered a long time ago but
> > does not fixed.
> >
> > However, OpenBSD was created a fork called LibreSSL try to solve this
> > issues. Should Fedora to move LibreSSL (http://www.libressl.org/)? Or
> > still use OpenSSL and wait what's bug could be found today, or
> > tomorrow, or few months to go similar Adobe Flash bugs?
> > --
> > devel mailing list
> > devel(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/devel
> > Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
>
>
>  --
>  devel mailing list
>  devel(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/devel
>  Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

[Reindl Harald]

Am 08.06.2014 16:21, schrieb Álvaro Castillo:
>  Few days was built an patch to solve an another vulnerability into
>
> OpenSSL(http://bits.blogs.nytimes.com/2014/06/05/new-bug-found-in-widely-....
>  Some sources talks about that's bug was discovered a long time ago but
>  does not fixed.
>  
>  However, OpenBSD was created a fork called LibreSSL try to solve this
>  issues. Should Fedora to move LibreSSL (http://www.libressl.org/)? Or
>  still use OpenSSL and wait what's bug could be found today, or
>  tomorrow, or few months to go similar Adobe Flash bugs? 
you realized that LibreSSL *backported* the bugs you are
talking about?

*at the moment* it makes pretty no sense switch to a fork
which is at the begin of the work and currently most likely
has *much more bugs* simply because large changes in a
foreign codebase

frankly - nobody knows about the future of LibreSSL and
OpenSSL, maybe they get merged later or only one of the
projects survives

what are you doing if OpenSSL backports all the changes
and LibreSSL dies in a few years? regret the whole migration
and start the game again?

in a short: if it comes to security avoid actions by reflex

[Reindl Harald]

Am 08.06.2014 16:42, schrieb Reindl Harald:
>  Am 08.06.2014 16:21, schrieb Álvaro Castillo:
> > Few days was built an patch to solve an another vulnerability into
> >
> OpenSSL(http://bits.blogs.nytimes.com/2014/06/05/new-bug-found-in-widely-....
> > Some sources talks about that's bug was discovered a long time ago but
> > does not fixed.
> >
> > However, OpenBSD was created a fork called LibreSSL try to solve this
> > issues. Should Fedora to move LibreSSL (http://www.libressl.org/)? Or
> > still use OpenSSL and wait what's bug could be found today, or
> > tomorrow, or few months to go similar Adobe Flash bugs?
>  
>  you realized that LibreSSL *backported* the bugs you are
>  talking about? 
- backported the bug
+ backported the bugfixes

means there where found and fixed in OpenSSL and *after that* fixed in LibreSSL

[drago01]

On Sun, Jun 8, 2014 at 4:42 PM, Reindl Harald <h.reindl(a)thelounge.net&gt; wrote:
>  Am 08.06.2014 16:21, schrieb Álvaro Castillo:
> > Few days was built an patch to solve an another vulnerability into
> >
> OpenSSL(http://bits.blogs.nytimes.com/2014/06/05/new-bug-found-in-widely-....
> > Some sources talks about that's bug was discovered a long time ago but
> > does not fixed.
> >
> > However, OpenBSD was created a fork called LibreSSL try to solve this
> > issues. Should Fedora to move LibreSSL (http://www.libressl.org/)? Or
> > still use OpenSSL and wait what's bug could be found today, or
> > tomorrow, or few months to go similar Adobe Flash bugs?
>
>  you realized that LibreSSL *backported* the bugs you are
>  talking about?
>
>  *at the moment* it makes pretty no sense switch to a fork
>  which is at the begin of the work and currently most likely
>  has *much more bugs* simply because large changes in a
>  foreign codebase 
Well add to that that it currently is (Open)BSD only afaik.

[Matthew Miller]

On Sun, Jun 08, 2014 at 03:21:04PM +0100, Álvaro Castillo wrote:
>  However, OpenBSD was created a fork called LibreSSL try to solve
> this
>  issues. Should Fedora to move LibreSSL (http://www.libressl.org/)? Or
>  still use OpenSSL and wait what's bug could be found today, or
>  tomorrow, or few months to go similar Adobe Flash bugs? 
Well, meanwhile, also spurred by Heartbleed, there is
<http://arstechnica.com/information-technology/2014/05/openssl-to-get-a-se...

I think it's too early to pick a winner here.

-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader

[Paul Wouters]

That bug was not found by the rampaging libressl people either.

Perhaps moving from OpenSSL to NSS would be better if you are that worried about OpenSSL
bugs 

Sent from my iPhone

>  On Jun 8, 2014, at 10:21, Álvaro Castillo
> <netsys(a)fedoraproject.org&gt; wrote:
>  
>  Dear mailing list,
>  
>  Few days was built an patch to solve an another vulnerability into
>
> OpenSSL(http://bits.blogs.nytimes.com/2014/06/05/new-bug-found-in-widely-....
>  Some sources talks about that's bug was discovered a long time ago but
>  does not fixed.
>  
>  However, OpenBSD was created a fork called LibreSSL try to solve this
>  issues. Should Fedora to move LibreSSL (http://www.libressl.org/)? Or
>  still use OpenSSL and wait what's bug could be found today, or
>  tomorrow, or few months to go similar Adobe Flash bugs?
>  -- 
>  devel mailing list
>  devel(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/devel
>  Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

[Tomasz Torcz]

On Sun, Jun 08, 2014 at 12:21:08PM -0400, Paul wrote:
>  That bug was not found by the rampaging libressl people either.
>  
>  Perhaps moving from OpenSSL to NSS would be better if you are that worried about OpenSSL
> bugs  
  We've tried that: http://fedoraproject.org/wiki/FedoraCryptoConsolidation

-- 
Tomasz Torcz       ,,(...) today's high-end is tomorrow's embedded
processor.''
xmpp: zdzichubg(a)chrome.pl                      -- Mitchell Blank on LKML

[Paul Wouters]

On Sun, 8 Jun 2014, Tomasz Torcz wrote:

>  On Sun, Jun 08, 2014 at 12:21:08PM -0400, Paul wrote:
> > That bug was not found by the rampaging libressl people either.
> >
> > Perhaps moving from OpenSSL to NSS would be better if you are that worried about
> OpenSSL bugs
>
>   We've tried that: http://fedoraproject.org/wiki/FedoraCryptoConsolidation 
It's more a matter of upstream I guess.....

Paul

[Kevin Kofler]

Paul wrote:
>  Perhaps moving from OpenSSL to NSS would be better if you are that
> worried
>  about OpenSSL bugs 
The problem is that nss-compat-ossl is not a drop-in replacement and as such 
basically useless. Upstream projects tend to support only OpenSSL.

        Kevin Kofler

[Kevin Kofler]

Álvaro Castillo wrote:
>  However, OpenBSD was created a fork called LibreSSL try to solve
> this
>  issues. Should Fedora to move LibreSSL (http://www.libressl.org/)? Or
>  still use OpenSSL and wait what's bug could be found today, or
>  tomorrow, or few months to go similar Adobe Flash bugs? 
Since they deleted the FIPS mode among other things, I don't think it will 
show up in Fedora, ever. Red Hat needs FIPS compliance for RHEL.

        Kevin Kofler

[Darin Perusich]

On Tue, Jun 10, 2014 at 8:13 PM, Kevin Kofler <kevin.kofler(a)chello.at&gt;
wrote:

>  Álvaro Castillo wrote:
>  > However, OpenBSD was created a fork called LibreSSL try to solve this
>  > issues. Should Fedora to move LibreSSL (http://www.libressl.org/)? Or
>  > still use OpenSSL and wait what's bug could be found today, or
>  > tomorrow, or few months to go similar Adobe Flash bugs?
>
>  Since they deleted the FIPS mode among other things, I don't think it will
>  show up in Fedora, ever. Red Hat needs FIPS compliance for RHEL.
>
>  
Perhaps maintaining FIPS support as a patch set, much like how 
"features"
such as acl, slp, openssl, etc are added to rsync, would be a suitable
approach. This would keep the extra crap like FIPS out of LibreSSL then if
someone "needs" FIPS mode they could apply the patch set, open their
wallets, and seek validation.

--
Later,
Darin

[Rahul Sundaram]

Hi


On Tue, Jun 10, 2014 at 8:44 PM, Darin Perusich  wrote:

>  Perhaps maintaining FIPS support as a patch set, much like how  "features"
>  such as acl, slp, openssl, etc are added to rsync, would be a suitable
>  approach. This would keep the extra crap like FIPS out of LibreSSL then if
>  someone "needs" FIPS mode they could apply the patch set, open their
>  wallets, and seek validation.
>  
FIPS is already a patchset but certification is extremely expensive and
there should be a very compelling reason for commercial companies to
consider alternatives.

Rahul