Re: [Full-disclosure] Remote hole in OpenBSD 4.1



Gadi Evron wrote:
I formerly had a great deal of respect, bordering on admiration, for Theo
deRaadt's refusals to compromise his open source principles, even in the
face of stiff opposition. Although he has occasionally gone over-the-top,
recommended some frankly very dubious changes to OpenBSD, and is regularly
arrogant (which is even more annoying because he's so often right!), he's
always remained consistent in his devotion to the cause of GNU/Free Software.

Notice "formerly": my confidence in deRaadt has been soundly shaken by his
latest round of unfounded aspersions cast against Intel's Core 2 line of
CPUs. Instead of getting the facts with careful analysis and study, deRaadt
has jumped the gun by trying to preempt proper research with posts to the
openbsd-misc mailing list. This in itself wouldn't be so bad, but his only
proper citation is a 404 page, and his only other source is an old summary
of unverified errata from a hobbyist website.

The lack of fact-checking and complete absence of any credible sources for
his allegations is suspicious in itself, but he compounds it into a complete
boner by making an equally unsupported claim that the supposed (in fact
non-existent) CPU problems are security flaws:

As I said before, hiding in this list are 20-30 bugs that cannot be worked
around by operating systems, and will be potentially exploitable. I would
bet a lot of money that at least 2-3 of them are.

Without real references to backup his exaggerated concerns, deRaadt's post
crosses the line into outright libel and scare-mongering. It's obvious when
you know what to look for: the subtle use of neurolinguistic priming in
emotive leading phrases such as "some errata like AI65, AI79, AI43, AI39,
AI90, AI99 scare the hell out of us", "Open source operating systems are
largely left in the cold", "hiding in this list", and so forth. This does
not lead me to share Theo's purported fears; instead it leads me to believe
that he's trying to unduly influence Intel's reputation with lies.

I have an idea of why. It's the same reason deRaadt feels comfortable in
saying that he'd "bet a lot of money" on Intel's Core 2 processors having
multiple (not one, but several) security flaws originating from these
errata. Namely, one of Intel's largest competitors has supplied the OpenBSD
project with a substantial amount of monetary support since 2004, presumably
because they can't compete even in the open source market without propping
it up with a flow of money. They cannot maintain their position on the
processor front, so they're resorting to buying out open source software
developers. It's regrettably cheap to do so, even if they have deRaadt's
prestige, because their business models stifle income and so a monolith such
as AMD can trivially tempt them with greater incentives. In fact deRaadt is
an easier target for "donations" because he makes it clear that he has no
business model for OpenBSD.

Intel, by contrast, have no discernable incentive to deceive or play down
security flaws in their products; the consecutive f00f and FDIV bugs of the
past have taught Intel that their best course of action is to face up to
their errors and offer speedy fixes.

DeRaadt's claim that Intel must "be come [sic] more transparent" is most
unfounded, especially when one considers who stands to benefit from this
anti-Intel arrangement; the connections between the AMD-ATI leviathan and
deRaadt-driven projects are not hard to find. AMD make a point of
emphasising OpenBSD's place in the "AMD64 ecosystem", and, as already
mentioned, lends its deep pockets to deRaadt's grasp. And the connections go
both ways too: deRaadt has a blatant chip on his shoulder regarding Intel.

Ultimately, it hasn't been enough for deRaadt to level unsubstantiated
libels at Intel, or to elicit spurious security fears about its solidly
tested products. He's added an extra layer of hypocrisy on top by attacking
Intel for being opaque and complaining about made-up fatal flaws in their
Core 2 system. I would go as far as to posit that it is in fact deRaadt's
system for running the OpenBSD project which has a fatal flaw. This escapade
proves that deRaadt -- and by extension the OpenBSD project -- is simply too
vulnerable to external influence from corporations with a vested interest
and lots of lucre.



____________________________________________________________________________________Ready for the edge of your seat?
Check out tonight's top picks on Yahoo! TV.
http://tv.yahoo.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Nice try, but (Wrong list). Too little to late.

firstly you employ the trick of "accuse them first" when you get to
"neurolinguistic priming"
your text is full of it. Basically that's all your email is.

Theo's posts were quite some time ago, and then neither of the links
were 404.

Also your topic is misleading.

Your mail cites even fewer references. Does not contribute anything new.

You are basically saying you disagree. well ladida. That's your right.
Didn't need to use that
many ascii or fancy words for that.

If a major cpu does not perform to specifications, this is a big deal,
seeing as you only now
have come to hear about it, signifies how much it has been downplayed.

Theo's methods and arguments, are often flawed in several ways, and he's
sure been
known to overreact. However usually the underlying theme is pretty accurate.
And in this case he's saying. FCOL you are degrading my operating
system's quality
on these chips and not even releasing the information I need, to fix it.

"no discernable incentive to deceive" --> are you kidding here or just stupid?
- It has stock holders
- what would it cost to recall the chips? When there is no replacement yet?


Now I like Intel, I realize what adverse effects releasing all the details could be
concerning IP (yes these guys are kinda careful with that, stockholders again ..)
reputation, balance sheets, ...


I'm pretty sure this conversation has already taken place.We'll see how it plays out.



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/