Do many eyes make a bug shallow?

re: Do many eyes make a bug shallow?

breiter — Mon, 24 Jul 2006 17:12:07 GMT

"I have been among those requesting OpenSSH in Vista. However, I would specify that I think it needs to be a part of SUA on Vista Server rather than a workstation option."

I would like to see OpenSSH included in the base set of "unix utilities" shipped by Microsoft with SUA. But for some reason that is incomprehensible to me MSFT seems to want an arms-length distance there.

The complete OpenSSH suite is actively being maintained for Interix (SFU/SUA) by Rodney Ruddock of Interopsystems along with a fairly substantial portage. It is a free download, you just have to register with the site.

Rodney is one of the original developers of the Interix technology that is now "SUA". Interopsystems also has an enhanced OpenSSH that includes some GUI tools and chroot support for a reasonable fee.

This arms-length thing may actually be a blessing in disguise because Interopsystems is, in my experience, more knowledgeable and more responsive than the SUA development team at Microsoft.

[http://www.interopsystems.com/tools/warehouse.htm]

re: Do many eyes make a bug shallow?

fluke — Thu, 13 Jul 2006 22:37:04 GMT

In Mike Howard's blog, he give strcpy() as an example of a banned API call for security reasons. But in the Port 25 announced Longhorn Server Identity Management for UNIX components, there is a "ssod" application that must be run by root that calls strcpy() in 19 different places.

Is the procedures that Howard talks about being applied to MS interop products and how can you explain the use of banned API calls in the ssod code?

Thanks

Regarding my request for OpenSSH in Vista

einhverfr — Sun, 02 Jul 2006 07:46:15 GMT

I have been among those requesting OpenSSH in Vista. However, I would specify that I think it needs to be a part of SUA on Vista Server rather than a workstation option. There is no function I can think of for OpenSSH on the workstation that can't be either solved by GPO's or a client like PuTTY.

Yet, the server is different. One of the nice aspects of SFU was that it provided better remote commandline management capabilities to Windows Servers, thus allowing many people to be more productive wrt remote scripting. Unfortunately, this was horribly insecure.

OpenSSH ought to be seen the same way it is in the rest of the world-- as the successor of plain text telnet. And I see only two ways forward for Microsoft-- fully kerberize telnet (including session encryption) on both your client and server or offer a kerberized OpenSSH for the server.

If Telnet wasn't ever used, it would not have been included in SFU. For the right audience it is very helpful. And you hope that "Abbie" isn't administering your servers, don't you?

Best Wishes,
Chris Travers
Metatron Technology Consulting

Many eyes are irrelevant except for confidence

einhverfr — Sun, 02 Jul 2006 07:30:19 GMT

The openness of he platform is largely irrelevant except that it makes the process of analyzing the security of a given package a bit easier.

The best thing to take away from this interview is that one will never be able to prevent all attacks. That it is the structure and architecture of the software is what makes the software secure.

I wasn't expecting much from this interview. I still think that Microsoft does an unusually poor job in designing systems which fall back gracefully in the case of a security vulnerability. However, it is refreshing to understand that there are people at Microsoft who truly understand secure software design.

Best Wishes,
Chris Travers
Metatron Technology Consulting