Slashdot Mirror
Remote Root Exploit In lsh
skookum writes "After last week's OpenSSH patch-fest, a lot of people suggested GNU lsh as a replacement. Unfortunately, it seems that the lsh team has recently discovered a heap overflow bug of their own that can lead to compromise. An exploit was posted to BugTraq two days ago. Happy patching."
Another week, another bug, another thread bashing Microsoft for software weaknesses.
When will Slashdot moderators *get it* ?
All software has bugs! Due to popularity, some software bugs are more actively sought that others.
Yes, really.
"Sufferin' succotash."
...and I just set up my first Linux box (RH9) a few weeks ago. If I wanted this kind of abuse, I would stick with Microsoft!!! *Sigh* I was really loving Linux too...the freedom, the power, the non-MS-ness...
>;^(
Spread the RC luvin'
Well let's see, OpenSSH is bug ridden, ssh is non-free. That's one reason, you idiot (not that lsh is bug free, but that's not the issue here).
By your stupid reasoning, Postfix and Exim shouldn't exist, because sendmail is around. Never mind that sendmail is one big bug.
Good software !== no bugs ever.
Why the hell not? Good bridges are the ones that don't fall down.
I know perfectly well that it's difficult to write bug free, or at least security problem free, code of any meaningful size, but it's about time we start to change our software development focus. Reasonable development techniques exist which are more difficult to do, but which result in code with a high degree of verifiably secure code.
You can't just trust that "the code is out there, so someone will read it." Every piece of security-conscious code written needs to be peer-reviewed, at least twice, by equally competent programmers to the one who wrote it. The peer reviewers need to nitpick at every bad design and programming technique decision. Every piece of security-conscious code should be software-fault injected after every release build, and all anomalous subcompenent behavior handled in an appropriate manner (and then peer reviewed again).
I'm sure there are quite a few other equally solid techniques that aren't being implemented across the board for security critical code. There's no fundamental limit to human ability which says we can't write secure code, we just need better procedures to prevent, catch, and block human errors.
Only one remote hole in the default install, in more than 7 years!
Oops!
Given that the default install has lsh turned on, will they change it to "two remote holes" ?
How much do you want to bet they'll just sweep it under the carpet and hope people forget? If you follow misc@ carefully you have probably seen it done before. Lets make some noise and force Theo to finally update that!
It just proves that this site and most of its audience are dellusional/in denial on a mass scale.
In fact, you behave like some sort of pluricellular organism... your immune system has been arrowsed right now, as the prick of an uncomfortable foreign body has entered your system. All white blood cells are out there trying to 'eat up' any argument, and the rest of the immunitary response is antibody-coagulation-like self defensive irrational posts (which *should* be modded troll/flamebait but instead get the 5+ insightful).
All this made more effective by the fever-like physiological aide provided by posting when readership drops, and probably not duping this one important article.
Yay. I got karma to burn and enemies to make. I've stopped caring.
Too bad php sux0rs and prolly should be replaced by ruby or anything else.
--
"I'm not bright. Big words confuse me. But Wanda loves me and that should be enough for you." - Cosmo