Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Secure-Shell
[Top] [All Lists]

Re: On why debugging OpenSSH can be so hard

Subject: Re: On why debugging OpenSSH can be so hard
Date: Mon, 7 Jul 2008 17:18:01 -0400
Salut, Maurice Volaski,

On Mon, 7 Jul 2008 11:53:17 -0400, Maurice Volaski wrote:
 Again, I think you're confusing security with a lazy programming
 practice. We're talking open source here. The perfect oracle is
 already there, just not in plain English.

I'm not talking about exposing information about the source code, which is good, but disclosing information about the key material, which is not nearly as desirable. Please keep that in mind when you re-read my prior mails as you don't seem to have understood it.


Who said the key needs to be exposed to the client's debug log or even the server's? Are you trying to say that fixing this real example of lazy programming, https://bugzilla.mindrot.org/show_bug.cgi?id=1388, is somehow going to expose the key?
--


Maurice Volaski, mvolaski@aecom.yu.edu
Computing Support, Rose F. Kennedy Center
Albert Einstein College of Medicine of Yeshiva University

<Prev in Thread] Current Thread [Next in Thread>