Open Sources 2.0

Chapter 4. Open Source and Security

Ben Laurie

More than two years ago, in a fit of frustration over the state of open source security, I wrote my first and only blog entry^[1] (for O’Reilly’s Developer Weblogs):

June and July were bad months for free software. First Apache chunked encoding vulnerability,^[2] and just when we’d finished patching that, we get the OpenSSH hole.^[3] Both of these are pretty scary—the first making every single web server potentially exploitable, and the second makes every remotely managed machine vulnerable.

But we survived that, only to be hit just days later with the BIND resolver problems.^[4] Would it ever end? Well, there was a brief respite, but then, at the end of July, we had the OpenSSL buffer overflows.^[5]

All of these were pretty agonising, but it seems we got through it mostly unscathed, by releasing patches widely as soon as possible. Of course, this is painful for users and vendors alike, having to scramble to patch systems before exploits become available. I know that pain only too well: at The Bunker,^[6] we had to use every available sysadmin for days on end to fix the problems, which seemed to be arriving before we’d had time to catch our breath from the previous one.

But I also know the pain suffered by the discoverer of such problems, so I thought I’d tell you a bit about that. First, I was involved in the Apache chunked encoding problem. That was pretty straightforward, because the vulnerability was released without any consultation with ...