<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Oct 18, 2017, at 9:55 AM, Malcolm Matalka <<a href="mailto:mmatalka@gmail.com" class="">mmatalka@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Andy Kosela <<a href="mailto:akosela@andykosela.com" class="">akosela@andykosela.com</a>> writes:<br class=""><br class=""><blockquote type="cite" class="">On Monday, October 16, 2017, Siobhan Lynch <<a href="mailto:slynch2112@me.com" class="">slynch2112@me.com</a>> wrote:<br class=""><br class=""><blockquote type="cite" class=""><br class="">On Oct 16, 2017, at 09:37 AM, Raul Cuza <<a href="mailto:raulcuza@gmail.com" class="">raulcuza@gmail.com</a><br class=""><javascript:_e(%7B%7D,'cvml','<a href="mailto:raulcuza@gmail.com" class="">raulcuza@gmail.com</a>');>> wrote<br class=""><br class=""><br class="">From <a href="https://www.krackattacks.com/" class="">https://www.krackattacks.com/</a><br class="">[quote]<br class=""><br class="">Why did OpenBSD silently release a patch before the embargo?<br class=""><br class="">OpenBSD was notified of the vulnerability on 15 July 2017, before<br class="">CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt<br class="">replied and critiqued the tentative disclosure deadline: “In the open<br class="">source world, if a person writes a diff and has to sit on it for a<br class="">month, that is very discouraging”. Note that I wrote and included a<br class="">suggested diff for OpenBSD already, and that at the time the tentative<br class="">disclosure deadline was around the end of August. As a compromise, I<br class="">allowed them to silently patch the vulnerability. In hindsight this<br class="">was a bad decision, since others might rediscover the vulnerability by<br class="">inspecting their silent patch. To avoid this problem in the future,<br class="">OpenBSD will now receive vulnerability notifications closer to the end<br class="">of an embargo.<br class="">[/quote]<br class=""><br class="">Because the OpenBSD project has quick turn around time on bug patches,<br class="">they will now be given the information later so they will not release<br class="">patches before other projects. Why does this remind of a story from<br class="">Flash Boys by Michael Lewis?<br class=""><br class="">Raúl<br class=""><br class="">------<br class=""><br class="">LOL, yeah I noticed that as well.... its been a minute since I was<br class="">neck-deep in the BSD community, but my reaction was "wow .... some things<br class="">never change" - it's nice to know Theo and the OpenBSD folx are pretty<br class="">much exactly the same as they've always been. Some things will always<br class="">remain constant.... OpenBSD's nature seems a constant. :)<br class=""><br class="">-Trish<br class=""><br class=""><br class=""><br class=""></blockquote>A few months embargo?? You must be kidding me. It seems that only OpenBSD<br class="">project is taking seriously their userbase and their security.<br class=""><br class="">--Andy<br class=""></blockquote><br class="">According to an OpenBSD dev, they agreed to the initial embargo<br class="">reluctantly and then the rules around the embargo changed and they<br class="">weren't willing to go along with it so they went by the original<br class="">embargo:<br class=""><br class=""><a href="https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbhnfz" class="">https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbhnfz</a><br class=""></div></div></blockquote><div><br class=""></div><div>Tangent: Ruckus, one of the best enterprise APs out there (on the RF side) STILL</div><div>does not have this patched and will not have it patched until at least 10/30. They </div><div>are on the list of companies that had access to the details in August. How sad </div><div>is that?</div><div><br class=""></div><div>Charles</div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class=""><br class=""><blockquote type="cite" class="">_______________________________________________<br class="">talk mailing list<br class=""><a href="mailto:talk@lists.nycbug.org" class="">talk@lists.nycbug.org</a><br class="">http://lists.nycbug.org/mailman/listinfo/talk<br class=""></blockquote><br class="">_______________________________________________<br class="">talk mailing list<br class=""><a href="mailto:talk@lists.nycbug.org" class="">talk@lists.nycbug.org</a><br class="">http://lists.nycbug.org/mailman/listinfo/talk</div></div></blockquote></div><br class=""></body></html>