BugTraq
SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Mar 23 2006 09:41AM
Gadi Evron (ge linuxbox org) (5 replies)
Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Mar 24 2006 04:27AM
Eric Allman eric+bugtraq (at) neophilic (dot) com [email concealed] (eric+bugtraq neophilic com) (1 replies)
Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Mar 24 2006 03:08AM
Claus Assmann ca+bugtraq (at) zardoc.endmail (dot) org [email concealed] (ca+bugtraq zardoc endmail org) (2 replies)
Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Mar 24 2006 02:52AM
Theo de Raadt (deraadt cvs openbsd org) (2 replies)
Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Mar 24 2006 03:13PM
Martin Schulze (joey infodrom org) (1 replies)
Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Mar 24 2006 10:17PM
Theo de Raadt (deraadt cvs openbsd org) (4 replies)
Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Mar 25 2006 08:12AM
Pim van Riezen (pi madscience nl)

On Mar 24, 2006, at 11:17 PM, Theo de Raadt wrote:

> I did not decide that OpenSSH should become a critical part of the
> internet, or that it should become a virtual monopoly. We made it
> free. Again, the community decided to make it Internet
> infrastructure.
>
> Now you want to tell us that because the Internet community made
> decisions like these, that we should be held responsible. That we
> have to follow YOUR procedures. That we have to answer to YOU.
>
> What if we ignore your procedures? What if we say no? What will you
> do then? Continue to verbally attack us? To what end? To show that
> you are thankless dogs?

Mr. De Raadt,

Perhaps you had no intention for your software to have such an
influence over the internet. You did not create it in a vacuum
either, on dangerous ground as I may be in second guessing people's
motivations, I cannot imagine a developer releasing a quality piece
of software, not hoping for it to be used by a large group of people.
When you rise to such a position of influence, there comes the
inevitable fact that many people will have opinions on how you use
this influence, especially where it affects their daily lives.
Getting upset about this is as pointless as it is for a rockstar to
complain about the paparazzi.

It is true that a developers of a free product, even if their product
rose to the level of popularity that it can be considered critical
infrastructure, have no formal obligations towards their userbase at
all. It would be silly to claim, however, that they are not
responsible for the effects their decisions have on a larger
community. People of character like yourself understand this
responsibility. Where people's decisions have such tremendous impact,
declaring outside criticism invalid counters that.

This is not to say that I don't feel empathy for your despair in the
face of thousands of people that are probably overloading you with
'helpful suggestions' for your projects, but I think it is best to
utter such frustrations in the privacy of one's home and let the
people make their noise. Who knows, sometimes interesting sound rises
up from such noise.

Kind Regards,
Pim van Riezen

[ reply ]
trusting SMTP [was: SendGate: Sendmail Multiple Vulnerabilities] Mar 23 2006 09:59AM
Gadi Evron (ge linuxbox org) (1 replies)


 

Privacy Statement
Copyright 2010, SecurityFocus