oss-sec mailing list archives
Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 10 Mar 2015 09:56:38 -0600
On 10/03/15 03:41 AM, John Haxby wrote:
On 09/03/15 20:39, Kurt Seifried wrote:I find this really hard to believe based on the past. So you're saying Oracle is willing to work with Red Hat and the community in general now? Can we get access to the MySQL security bugs and test cases for example? This would be HUGELY helpful to the community.I have no link to MySQL. You need to take this up with those people.I'll believe Oracle is willing to work with the community when I actually see Oracle participate and help the community. Until then it's just words from some random Oracle employee and most likely isn't official policy.So prove to us you want to work with us (e.g. by opening up the MySQL security bugs/test cases) and we can definitely look at future cooperation.I would really like to be able to do that, but this is a political problem outside my control.
What you're saying simply is "what you asked me is to hard, so I won't do it, heck I won't even try it". This is not the Open Source way.
None of this, however, has anything to do with the matter at hand. If no one from Red Hat is unwilling to cooperate in getting a single backward-compatible resolution to incorporating PEP-466 into the distro python versions then perhaps someone else is.
My experience is a lot of people propose a LOT of things on email lists, but when it actually comes down to them doing the work, nothing happens because quite often the people proposing the work don't have the expertise or ability to do it. oss-security@ archives are littered with such examples (e.g. the whole code audit thing). So it's not that I'm unwilling, I simply don't see why you need massive corporate/community buy in at this point, premature optimization and all that. Build a solution, or more than one solution and try them out, then report back to oss-security@ with what works/doesn't work. In general the best way to determine what the best solution is for a problem is to try several solutions out. Prototype code and experimental data is worth 1000 meetings. Come back to us with data/a working solution and then I'd be willing to consider investing some time/energy into this, but until then this is simply an experimental project that may not even be needed (who knows, we don't because we're basically holding a useless meeting right now via email). -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777, (continued)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 05)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 06)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 06)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 08)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 09)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 09)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 09)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 10)
- Re: PEP-466 common compatible implementation. (was ... CVE-2015-1777) John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Donald Stufft (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 11)