Re: BitKeeper /tmp vulns

[Michael Scherer <misc () zarb org>]

On Tue, May 10, 2016 at 12:40:50PM -0700, Larry McVoy wrote:
> In the past, at least, BitKeeper was run inside a firewall and in an
> environment where users are trusted.  As such, I suspect that you have
> just begun to scratch the surface, I wouldn't be at all surprised to
> see dozens more like this.

If the security model is "everybody is trusted and we have firewall", the
frontpage of https://www.bitkeeper.com/ with "Hardened for the Enterprise.",
is a bit misleading, as is the part on "security" and "safety" on
https://www.bitkeeper.com/why_why_buy

I do get that "hardening", "security", "safety" can mean different things to different
people, but "insecure on a shared server" is not written anywhere in the documentation.

> We've never had anyone complain about this in a real world situation
> so we've never focussed on it.  

I am not sure to fully understand, so allow me to rephrase based on my understanding.

Because no one complained and found the problem before among your
clients, (that likely didn't had the source code to begin with, and also no
expectation of being able to read without likely infriging copyright), 
the BK team didn't focused on trying to be proactive and fixing security issues
that ook 5 minutes to be found ?

(or updating code bundled for a 15 years old CVE)

> If you care about this stuff we'll
> gladly take patches.

I am sorry, but that's not exactly the kind of answer that motivate me to work
on a software I do not use. 

But since you agree that's a security problem, I guess I can now officially request
CVE for the issues that do not have one.

-- 
Michael Scherer