Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Tavis Ormandy <taviso () gmail com>]

On 2024-03-30, Marc Deslauriers wrote:
> On 2024-03-30 11:37, Tavis Ormandy wrote:
> > On 2024-03-30, Marc Deslauriers wrote:
> > > That is the problem, having more eyes on a 0-day also means more eyes from
> > > malicious entities. Neither having an embargo nor immediately posting publicly
> > > are ideal solutions. There needs to be a compromise, and while I understand and
> > > respect your point of view, I don't think we'll ever see eye-to-eye on what the
> > > acceptable compromise should be.
> >
> > Yeah, but your acceptable compromise *must* include Canonical having
> > advance knowledge of backdoors, correct?
>
> Not necessarily. 

Okay, you could unsubscribe from distros to help make the embargo stronger? :)

> For example, I don't have access to embargoed Chrome 0-days 
> before the updates come out, and a lot of other folks don't either. Should all 
> Chrome 0-days be public before the updates are available? Are you advocating for 
> this?

Yes! If you have knowledge of *any* software that is backdoored or
compromised or is being actively exploited with a 0day, I'm advocating
-- please -- for you to make that public.

This applies to literally *any* software, hardware or other product.

> > There are a lot of other users and organizations out there, and I think
> > most of them also like having some agency, I know I do. If our roles
> > were reversed -- my organization was on distros and yours was not -- do
> > you think you would still be arguing for embargoes on backdoors?
>
> I'm not necessarily arguing for embargoes on backdoors, I'm saying that posting 
> publicly about it before even knowing what it was would have resulted in a worse 
> outcome. That's my opinion, you may think it's a wrong.

Yes, I think it's wrong.

> Perhaps the question here is why isn't your organization on one of the multitude 
> of places where this issue was discussed in private for a few hours, and where 
> it was decided that this should be public?

I think maybe you're saying that if I was on the list, then I would like
embargoes too!

It's definitely better for the organizations on the list, no question.
As you know, I was a distros and vendor-sec member for years, so I do
know how they work :)

Tavis.

-- 
 _o)            $ lynx lock.cmpxchg8b.com
 /\\  _o)  _o)  $ finger taviso () sdf org
_\_V _( ) _( )  @taviso