From owner-freebsd-security@FreeBSD.ORG Wed Dec 15 17:38:50 2010 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0B734106566B for ; Wed, 15 Dec 2010 17:38:50 +0000 (UTC) (envelope-from rfarmer@predatorlabs.net) Received: from mail-qy0-f182.google.com (mail-qy0-f182.google.com [209.85.216.182]) by mx1.freebsd.org (Postfix) with ESMTP id BF5908FC08 for ; Wed, 15 Dec 2010 17:38:49 +0000 (UTC) Received: by qyk36 with SMTP id 36so2129992qyk.13 for ; Wed, 15 Dec 2010 09:38:49 -0800 (PST) MIME-Version: 1.0 Received: by 10.229.189.72 with SMTP id dd8mr731861qcb.18.1292434728714; Wed, 15 Dec 2010 09:38:48 -0800 (PST) Received: by 10.220.59.69 with HTTP; Wed, 15 Dec 2010 09:38:48 -0800 (PST) X-Originating-IP: [128.95.133.99] In-Reply-To: References: <4d08a854.w8rPywliRhHs/MXH%akosela@andykosela.com> <19720.57471.684530.72355@hergotha.csail.mit.edu> Date: Wed, 15 Dec 2010 09:38:48 -0800 Message-ID: From: Rob Farmer To: bf1783@gmail.com Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: freebsd-security@freebsd.org, Garrett Wollman Subject: Re: Allegations regarding OpenBSD IPSEC X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Dec 2010 17:38:50 -0000 On Wed, Dec 15, 2010 at 08:24, b. f. wrote: > I don't think that your reasoning about the government's willingness > to release this information, or the extent to which this is a partisan > issue, is correct. Well, the NSA wiretap thing was leaked only a couple years after it started. If you want to believe that *nobody* in Washington, through several election cycles and a change in majority party, would be interested in exposing this for political (or financial, in the case of the media) gain and his "NDA" accidentally timed out or whatever, feel free. > But the details of who was involved, and what > agreements were in place, are secondary to the issue of whether there > are vulnerabilities, intentional or otherwise, in the code. =A0For those > who have the time and ability to audit the code, there are some > possible problems to look for: > > http://marc.info/?l=3Dopenbsd-tech&m=3D129237675106730&w=3D2 > > b. > They won't be secondary if someone does find a minor bug in the network stack (regardless who introduced it or if it is even related), which will probably happen given the attention this will invariably receive. --=20 Rob Farmer