15 years later: remote code execution in qmail

Re:15 years later: remote code execution in qmail by dependenttypes on Thursday May 21, 2020 @01:55AM (#23255243)

(regarding qmail) It was a security bug back in 2005. It stopped being a security bug when DJB mentioned on the official page about the memory limits.

Regarding the salsa20 implementation: I just mentioned in my previous message why this was not a bug and the only reason that people were upset over it was due to Filo's incompetence.

As for evidence of DJB dealing straightforwardly with security reports: https://news.ycombinator.com/item?id=23250748

I think that https://old.reddit.com/r/crypto/comments/72w42c/statement_re... would be a better example of DJB not properly handling security reports.

[ Parent | on HN ]

Re:15 years later: remote code execution in qmail by dullgiulio on Thursday May 21, 2020 @06:33AM (#23256809)

salsa20 was added in 2012, the warning file was added into the repository in 2016 the earliest (it is not clear when--which is vary bad for security and also shows the move was not advertised.)

Incompetence is a strong word on the wrong target...

[ Parent | on HN ]

Re:15 years later: remote code execution in qmail by dependenttypes on Thursday May 21, 2020 @07:11AM (#23257005)

> the warning file was added into the repository in 2016 the earliest

There is no official public repository. It gets released in tarballs.

This does indeed make him seem slightly less incompetent though.

> which is vary bad for security

It is a framework for benchmarking cryptographic algorithms.

[ Parent | on HN ]