OpenSSH 5.0 released

It is to do so in the release announcement.  Leave such things for a private (or at least not
in the announce mail) discussion with the debian maintainer. 

Its a hard claim to accept that Debian didn't follow good procedure when the bug was reported
in a public forum and existed there for nearly 3 months for all the internet to see. If this
bug was reported via private channels such as vendor-sec and then Debian went about releasing
it to the world anyways, then yes you would be right, but once its out there, its out there.
I'm sorry, but there is no undo on the internet.

Wow, two of the first three paragraphs of that press release are spent complaining about
Debian.  Tell us more about good procedure?  Especially as related to discrete communication?
:)

Wow, what an incentive.  'Don't make any mistake ever, and we won't spend our entire release
announcement calling you idiots.'  Your generosity is matched only by your kindness.

(Of course, Novell employees are idiots when they make a typo introducing one security bug,
but whoever made this mistake is doubtless not an idiot.)

Here's the Fedora openssh repo, if anyone is interested.
http://cvs.fedoraproject.org/viewcvs/rpms/openssh/

Actually, I didn't say there were 50+ patches.  What I said was that THIS patch has been
applied to 50+ different Red Hat openssh RPM versions, since it was first discovered in 2005.
I have no idea how many different patches Red Hat is carrying for openssh, although that would
be interesting to look at.

You're right, we don't know whether Red Hat tried to report this upstream, and was rebuffed,
or not.  However, there's no indication (in the bug report etc.) that such an attempt was
made.  I have also heard rumors that it can be difficult to get bugs reported upstream for
openssh, probably because of the odd way it is packaged where the developers maintain only the
OpenBSD port and other people are left to maintain all the other ports: in some cases it might
be tricky to convince the developers that the bug exists in the original OpenBSD version as
well.

Still, as I said, even without the security implications being reported it seems like this is
an obvious bug that they would have been interested to hear about.

You're right about all these errors, but you left out the one specific error I called out as
the most egregious one:

x) Red Hat does not report the bug and its fix upstream to OpenSSH back in 2005, when they
found it.

Of course it can be quite difficult to determine whether a bug is a security risk, especially
if that's not how you came across it in the first place.  I certainly don't blame Red Hat for
not recognizing the security implications.  Regardless, however, good community participation
demands that when you find a bug you report it upstream to the developers.  It's true we don't
know for a fact that this was not done, but we can have a reasonable suspicion since there was
no indication of this in the bug report, and the bug was not fixed upstream after all this
time.

I don't know, that might work. Some projects are forever at version 2.6.x, 
and they seem to do all right ;}

"we treat our version number as a simple counter"

Any reason it's not just version "50" then?

But when "real progress" occurs, that's exactly when you DO bump the major number!

By making the same increment for all changes, whether "one security fix" or "6 months of heavy
development", you're reducing the informational value (at least in common practice) that is
implied, for example, in the bump from 4.9.0 to 4.9.1 compared to 4.9.1 to 5.0.

Disclaimer: Of course reading the version number does not substitute for reading the release
notes. :)

Hear, hear. This is the single biggest fault in OpenSSH, to my mind, and 
one I hear constantly from users. It's this great strong 
authentication-and-connection toolkit, but other than the manpages and a 
book you have to buy (so nobody does: ssh is often a small component of 
larger systems, so the documentation should be incorporatable into the 
docs for those systems: but it's in book form, so it isn't), there is *no 
useful documentation*, and for a security system that is *really* 
unfortunate, because if you make an error in configuring a security system 
you tend to introduce insecurity without even knowing it. (This may or may 
not be true of OpenSSH: I can't tell.)

I mean I've been using OpenSSH since it forked from SSH: I read the 
changelogs religiously and know the manpages pretty much by heart, but I 
still have *no* idea what the moduli file is for, what the consequences 
are when it gets changed in some OpenSSH release (there must be 
consequences or 'make install' would overwrite, but there can't be 
consequences or newer fresh installs would have trouble talking to older 
upgraded installs), why I might want to use  a different MAC from the 
default, why I might want to use a different cipher from the default (that 
I *think* I know, but where security is concerned that's not really good 
enough)... I only know how subsystems work because I read the code, and 
when I did I was jumping around babbling about how cool this is, oh look 
you can attach anything that can chatter to stdin/stdout as a subsystem 
and ride on OpenSSH's authorization/authentication/networking layer...

... but nobody who hasn't read the code knows that, and things like that 
really should not lie hidden for ten years because of a total absence of 
useful docs.


*Are* there useful docs somewhere? (The manpages, for these purposes, are 
not useful. There's too much they leave unsaid. Printed books are 
minimally useful: you can't grep them, you never have them around when you 
need them, and you can't point confused customers in Australia at them 
when they're having trouble getting their end of some SSH tunnel up).

Otherwise, well, I'd write some better docs, but that's sort of hard since 
there's too much I don't know. Someone who actually knows SSH has to do 
it, and as far as I can tell that set consists largely of the maintainers.