<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>All</div><div>I’ll keep it short; amazing work; I can’t stand the nifty name game , a lot of researchers have adopted .</div>We should all try to get someone to name their newly found issue after a bit of Aztec mythology.<div><br></div><div>I want to see the <span style="background-color: rgba(255, 255, 255, 0);">Centzonmimixcoa exploit .</span><br><br><div id="AppleMailSignature">---<div>Mark Saad | <a href="mailto:mark.saad@ymail.com">mark.saad@ymail.com</a></div></div><div><br>On Oct 16, 2017, at 5:30 PM, Andy Kosela <<a href="mailto:akosela@andykosela.com">akosela@andykosela.com</a>> wrote:<br><br></div><blockquote type="cite"><div><br><br>On Monday, October 16, 2017, Siobhan Lynch <<a href="mailto:slynch2112@me.com">slynch2112@me.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div></div><div><br>On Oct 16, 2017, at 09:37 AM, Raul Cuza <<a target="_blank">raulcuza@gmail.com</a>> wrote<br><span><br><br>From <a href="https://www.krackattacks.com/" target="_blank">https://www.krackattacks.com/</a><br>[quote]<br><br>Why did OpenBSD silently release a patch before the embargo?<br><br>OpenBSD was notified of the vulnerability on 15 July 2017, before<br>CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt<br>replied and critiqued the tentative disclosure deadline: “In the open<br>source world, if a person writes a diff and has to sit on it for a<br>month, that is very discouraging”. Note that I wrote and included a<br>suggested diff for OpenBSD already, and that at the time the tentative<br>disclosure deadline was around the end of August. As a compromise, I<br>allowed them to silently patch the vulnerability. In hindsight this<br>was a bad decision, since others might rediscover the vulnerability by<br>inspecting their silent patch. To avoid this problem in the future,<br>OpenBSD will now receive vulnerability notifications closer to the end<br>of an embargo.<br>[/quote]<br><br>Because the OpenBSD project has quick turn around time on bug patches,<br>they will now be given the information later so they will not release<br>patches before other projects. Why does this remind of a story from<br>Flash Boys by Michael Lewis?<br><br>Raúl<br><br>------<br><br>LOL, yeah I noticed that as well.... its been a minute since I was neck-deep in the BSD community, but my reaction was "wow .... some things never change" - it's nice to know Theo and the OpenBSD folx are pretty much exactly the same as they've always been. Some things will always remain constant.... OpenBSD's nature seems a constant. :)<br><br>-Trish</span></div><div><blockquote type="cite"><div></div></blockquote></div><div><br></div></blockquote><div><br></div><div>A few months embargo?? You must be kidding me. It seems that only OpenBSD project is taking seriously their userbase and their security.</div><div><br></div><div>--Andy </div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>talk mailing list</span><br><span><a href="mailto:talk@lists.nycbug.org">talk@lists.nycbug.org</a></span><br><span><a href="http://lists.nycbug.org/mailman/listinfo/talk">http://lists.nycbug.org/mailman/listinfo/talk</a></span></div></blockquote></div></body></html>