OpenSSH Vulnerability

* if you connect to a rogue server

>>52426065
More details:
http://www.undeadly.org/cgi?action=article&sid=20160114142733

PS.: OpenSSH client is not Linux exclusive, nor the only alternative available for Linux systems.

>>52426201
Of note from the provided link is that while most distributions have already fixed the issue and OpenBSD even stripped the functionality altogether:

UPDATE: For Mac OS X, the version of OpenSSH in MacPorts has been updated. Since Apple typically delays security fixes, you're advised to apply the workaround if using the bundled OpenSSH instead.

>>52426065
>linux vulnerability
This only affects OpenSSH, not Linux

Seems like open source was never a good idea eh? If you use open source shitware you might as well hand out blueprints of your house so a thief can break in and steal your shit.

>>52426065
for fuck's sake, C needs to be replaced.

not making arrays proper types is probably among the worst decisions made in any place in the last century.

>>52426432
Have you seen how fast the community reacted and fixed the packages? If it was closed we would still be vulnerable waiting for the grace of the developers to acknowledge the bug and fix it. Not to mention some who would sue the researcher who found the issue instead.

>>52426467
If you need anything more than a memory address and an offset to create arrays then you're a weak programmer who should use Java.

I use Java.

LibreSSL affected?

>>52426512
If it was closed the problem wouldn't have happened in the first place since paid developers whose jobs are on the line actually write good code

>>52426536
OpenSSH is a different set of tools so no.

>>52426560
oh fuck, how silly of me

File: flash.png (1MB, 1090x8140px) Image search: [Google]

1MB, 1090x8140px

>>52426539
>since paid developers whose jobs are on the line actually write good code
HA

Pic related. Code written by a billion dollar company.

>>52426432
still better than willingly giving all your possessions to the theft and even defending him at court

>>52426539
>closed source code is bug free
>there are no paid developers doing open source coding

You never stop surprising me /g/.

>>52426432
How do dumbfucks like you get by so long? Security through obscurity doesn't work. If this was a closed source package an attacker would still have figured it out and meanwhile a fix from the provider would still be coming "maybe eventually".

>>52426065
>gin access
What's that?

>>52426517
what are you even trying to say?
arrays need an element size (statically implicit in their type), a start pointer, and either an element count or a tail point.

the issue is that C arrays, even when declared in function scope, can't be passed through function arguments without losing their size, which has to be passed as a separate argument and tracked through a separate variable in the callee, which gets bungled by even "professional" and/or high profile projects like this.

> array/ptr decay is the great killer of our time

>>52426157
Every time exploit is found it's the end of the fucking world cause no one sees the fine print

File: 1451729369009.jpg (28KB, 400x433px) Image search: [Google]

28KB, 400x433px

>>52426065
>linux vulnerability

>>52426995
gain access

>>52426517
Real programmers like to use tools that encourage good coding practices and discourage bugs like this buffer overflow shit. They don't attempt to micromanage every little thing because that will inevitably lead to failure when working on anything nontrivial, even for experts. In other words, C is shit.

>>52426467
Cowboy coders like C too much, because it lets them vomit on the keyboard and have errors only turn up much later when it's exponentially harder to deal with them and tons of damage has already been done. We've had viable replacement(s) for decades.

>>52426971
You know what they call good security through obscurity? Passwords. Stop your memeing.

>>52428780
https://en.wikipedia.org/wiki/Kerckhoffs's_principle

>>52428780
>You know what they call good security through obscurity? Passwords.
Are private keys "security through obscurity" too?

>>52428957
Are they a specific piece of information that, if known or guessed by an attacker, would blow the whole thing wide open? Yes? Then of course they are. Just very well designed and controlled obscurity. More ordinary design flaws are isomorphic to a (usually weak) password/encryption key.

>>52426467
"Needs to be", and "is feasible to do so" are two very different things. No one thinks C is great, or even good, or at least no one who is at all a competent programmer. We are stuck with C for the simple fact that we are stuck with C. There's way too much existing C code, to just scrap it and start all over, and as long as that is the case C will still be used. As long as it is used, the more it will need to be used. There's just no easy way around that. Just the amount of code in the *Nix world is enough to make sure of that, several times over.

Pascal is for the most part dead these days. Contrary to what C programmers of yesterday claimed, it's actually every bit as powerful and capable as C, while being a much neater, and easier to use and maintain. But that doesn't matter even a little bit, because C is the one that won.

>>52426539
>what is volkswagen

Unlike open source programmers, closed source ones write the bare minimum they need to to create something that *appears* to work.

They will often cheat, lie and do straight up dangerous stuff but you'll never figure it out because its a black box

File: where_do_you_think.png (651KB, 1067x800px) Image search: [Google]

651KB, 1067x800px

>>52429195
>No one thinks C is great, or even good

>>52426065

did anyone actually read the link?

Just turn roaming off and your precious private keys are safe.

>>52426467
serious question, what's a good replacement?, what other languages compile to machine dependent executables and don't depend on a big rte?.

>the OpenSSH client
supports an undocumented feature called roaming
>Although roaming is not supported by the OpenSSH server, it is enabled
by default in the OpenSSH client
what in the fuck

>>52429362
The best one is Ada. Others that tend to get mentioned include D, Pascal, Rust and C++.

>>52428780
Password obscurity and vulnerability are not the same thing. A password that's selected carefully (not vulnerable to dictionary attack or whatever) has to be brute forced to discover. A program vulnerability can be found by analyzing input/output, attaching it to debugging tools, etc. How are these two at all related? Stop being autistic

>>52429526
>The best one is Ada.
best answer in all likelihood, despite being virtually unknown outside defense contracting

> Others that tend to get mentioned include
>D
not acceptable due to mandatory GC, which still can't be completely stopped

> Pascal
lost any chance of equivalent utility by not supporting non-statically sized arrays from the beginning. (added in early 90s, but too late to save the language)

> Rust
a year ago I might have agreed it had a future, but the community has gone full retard with peripheral (i.e., SJW bullshit) concerns instead of pushing the language to serious developers

> and C++
seems reasonable at first glance, but has a LOT of issues:
> lack of standard ABI/name mangling for linkers
> exceptions are basically landmines when allowed to escape an API
> inherits all the awful shit of C (unhygenic preprocessor macros, array decay, dogshit slow compilation requires stupid build system tricks, etc.)

>>52426539 (You)

>>52426617
is flash the worst major piece of software of all time?

>>52430472

I don't know about flash but Adobe have fucked up a lot

>>52430472
No. Java or Adobe Reader.

>>52430472
It's bad but not nearly as bad as the trash that has come out of Symantec.