Slashdot Mirror
OpenBSD Vulnerabilty
*no comment* writes "Normally vulnerability reports on slashdot wouldn't make it because there are so many. This one however is for the normally very secure OpenBSD. Someone can crash an OpenBSD bridge using a newly discovered ICMP exploit. More can be read here. This shouldn't affect most people as this only affects people that use OBSD as a bridge."
slashdotted already?
Obligatory "No remote exploits in 0 days."
Normally vulnerability reports on slashdot wouldn't make it because there are so many
This might be unusual but it's really not that big a news. I suppose it shows that even the best are not infallible. Nice to see it's already been patched =).
This shouldn't affect most people as this only affects people that use OBSD
That is to say, this won't affect anyone, as *BSD is dead.
Normally vulnerability reports on slashdot wouldn't make it because there are so many.
That is, unless it's a vulnerability in Microsoft software.
One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.
You don't need to be a Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.
FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.
Let's keep to the facts and look at the numbers.
OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.
All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.
Fact: *BSD is dying
You mean that they aren't usually posted unless there's a way to blame Microsoft for the security problem?
Here:
i cm p-payload-00.txt
http://openbsd.org/errata.html
"All architectures
016: RELIABILITY FIX: August 26, 2004
As reported by Vafa Izadinia bridge(4)
with IPsec processing enabled can be crashed
remotely by a single ICMP echo traversing the
bridge.
A source code patch exists which remedies this problem.
015: RELIABILITY FIX: August 25, 2004
Improved verification of ICMP errors
in order to minimize the impact of ICMP attacks
against TCP.
http://www.ietf.org/internet-drafts/draft-gont-
A source code patch exists which remedies this problem."
Nevertheless, I still like its excellent record
in security stat's... OpenBSD, here I come...
One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.
You don't need to be an Amazing Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.
FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.
Let's keep to the facts and look at the numbers.
OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.
All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.
Fact: *BSD is dead
Shut up retard. You may have noticed that the article was for OpenBSD not FreeBSD. You're cut+paste troll is for FreeBSD. Even if you were talking about OpenBSD, why did they patch the OS then? Cuz it's still under active development, that's why. In fact, OpenBSD 3.6 is due Nov 1st. FreeBSD 5.3 will be out a few weeks. DragonFly BSD released 1.0 one month ago.
BSD is dying my ass.
11:55:08 <Niels> OK, man, whatever you say. So who submitted the bug report in the first place?
11:56:23 <Theo> Who cares? It's B-O-G-U-S! Now leave me alone, can't you see I'm busy?! 11:56:29 <Niels> Jeez, would it kill you to give me the details on this alleged bug?
11:59:51 <Niels> Theo? Are you there, man?
^An^Ap
12:00:00 *** Signoff: Theo (Read error: EOF from client)
^^ typed in shock in an attempt to do a
Because the worst you can do with it is crash the system, not gain access.
That's life. There are winners. There are losers. BSD lost.
Hi, my name is Randall. I'm a former employee of SCO, formerly Caldera Systems. I've had the opportunity to use OpenBSD for the first time, and was highly impressed with it's great balance of security and ease of use. I was so interested that I decided to download the source code and take a look inside. Then I started to notice familiarities, deja vu if you will. It didn't really dawn on me until I saw a simple comment: // remove this function, debug only -- Randall
Now, with all the Linux/SCO nonsense going on (don't worry, I think the code being stolen from SCO is hogwash), I couldn't believe it. Here in front of my face was real stolen code from SCO Unix in OpenBSD. I didn't even know how to react. I decided posting this anonymously was the best way to go. Rather than try anything legal (since I'm no longer employed at SCO group), posting this and letting everyone decide for themselves (because, let's face it, most people won't listen to this) is my best option for clearing my conscience. Go, look for it. It's there.
For the uninitiated: BSD is a free, completely legal flavour of UNIX developed at UC Berkley, rather than a unixlike OS.
But then if you're reading posts for a BSD you probably already know that
- Laci Peterson
- Lori Hacking
- Nicole
Simpson
- OpenBSD
Submit your response along with a stamped self-addressed envelope.See contest rules for details. Void where prohibited.
You forgot Darwin/BSD among that lot.
By Chinese Karma Whore, Version 1.0
Everyone knows about BSD's failure and imminent demise. As we pore over the history of BSD, we'll uncover a story of fatal mistakes, poor priorities, and personal rivalry, and we'll learn what mistakes to avoid so as to save Linux from a similarly grisly fate.
Let's not be overly morbid and give BSD credit for its early successes. In the 1970s, Ken Thompson and Bill Joy both made significant contributions to the computing world on the BSD platform. In the 80s, DARPA saw BSD as the premiere open platform, and, after initial successes with the 4.1BSD product, gave the BSD company a 2 year contract.
These early triumphs would soon be forgotten in a series of internal conflicts that would mar BSD's progress. In 1992, AT&T filed suit against Berkeley Software, claiming that proprietary code agreements had been haphazardly violated. In the same year, BSD filed countersuit, reciprocating bad intentions and fueling internal rivalry. While AT&T and Berkeley Software lawyers battled in court, lead developers of various BSD distributions quarreled on Usenet. In 1995, Theo de Raadt, one of the founders of the NetBSD project, formed his own rival distribution, OpenBSD, as the result of a quarrel that he documents on his website. Mr. de Raadt's stubborn arrogance was later seen in his clash with Darren Reed, which resulted in the expulsion of IPF from the OpenBSD distribution.
As personal rivalries took precedence over a quality product, BSD's codebase became worse and worse. As we all know, incompatibilities between each BSD distribution make code sharing an arduous task. Research conducted at MIT found BSD's filesystem implementation to be "very poorly performing." Even BSD's acclaimed TCP/IP stack has lagged behind, according to this study.
Problems with BSD's codebase were compounded by fundamental flaws in the BSD design approach. As argued by Eric Raymond in his watershed essay, The Cathedral and the Bazaar, rapid, decentralized development models are inherently superior to slow, centralized ones in software development. BSD developers never heeded Mr. Raymond's lesson and insisted that centralized models lead to 'cleaner code.' Don't believe their hype - BSD's development model has significantly impaired its progress. Any achievements that BSD managed to make were nullified by the BSD license, which allows corporations and coders alike to reap profits without reciprocating the goodwill of open-source. Fortunately, Linux is not prone to this exploitation, as it is licensed under the GPL.
The failure of BSD culminated in the resignation of Jordan Hubbard and Michael Smith from the FreeBSD core team. They both believed that FreeBSD had long lost its earlier vitality. Like an empire in decline, BSD had become bureaucratic and stagnant. As Linux gains market share and as BSD sinks deeper into the mire of decay, their parting addresses will resound as fitting eulogies to BSD's demise.
Clearly the parent has been in the security or networking business for more than a few years.
In fact, I recall when RH7.0 came out and was followed almost immediately by 7.1 because of so many remote holes. I've seen several friends have their Linux boxes rooted, and I'm moderator on a Linux forum where we get at least one person a week (some times one a day) asking how they can repair their system because it was cracked.
On the other hand, none of my OpenBSD boxes have ever been cracked... come to think of it, none of my Windows or Mac boxes ever have been, either.
Someone is WRONG on the Internet!
One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.
You don't need to be an Amazing Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.
FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.
Let's keep to the facts and look at the numbers.
OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.
All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.
Fact: *BSD is dying
None of my Windows boxes have ever been rooted, either. What's your point? You can secure any OS, so what's really important is the default state. Someone who immediately connects a box with Red Hat to a network will get rooted just as fast as someone who connects a default install of Win2K.
Someone is WRONG on the Internet!
Since when does "security" mean "not letting anybody gain access"? "Security" means eliminating risks. Somebody crashing all your routers counts as a risk in my book.
Since when does "security" mean "not letting anybody gain access"? "Security" means eliminating risks. Somebody crashing all your routers counts as a risk in my book.
Denial of service, by itself, is never a security risk. It might contribute to one, but by itself it is not.
Even in the real world, if you close down a building to prevent someone from placing a bomb, the building is secure. None of the usual business gets done, but it's still secure because the bad guys stay out. A traffic jam right outside your house will prevent you from leaving, but your home is still secure. Your money is still secure on a bank holiday.
Security is about keeping unauthorized people from gaining control of your resources. Merely stopping you from using them does not count.
Security is about keeping unauthorized people from gaining control of your resources.
Restating it doesn't make it any more truer. You do realise that you just ignored what I said entirely and repeated the original mistake without anything new to add, don't you?
Security is about keeping your systems secure. "Secure" does not mean "unauthorised people can't get access". "Secure", in layman's terms, means "safe". That's safe from unauthorised intruders, safe from denial of service, safe from floods in the location of your servers, safe in the event of fires, hurricanes, etc. Safe. That's what secure means. Go and look it up in the dictionary, or, even better, take a few computer security courses.
It's not just about script kiddies. That's the mistake I pointed out, and it's the point that completely went over your head.