[mosh-devel] Concerns about mosh's security at the Broad Institute

[Jérémie Courrèges-Anglas]

Hi,

Keith Winstein <keithw at cs.stanford.edu> writes:

[...]

> To be sure: this is not the first time we have heard concerns about
> the use of an environment variable to convey keying material.
> Generally these concerns are about the possibility that a future
> operating-system vulnerability might accidentally expose environment
> variables to other users on the same client machine. We recognize that
> OS vendors do make mistakes, and the developers are sensitive to this
> concern and, frankly, are sympathetic to it. (OpenBSD did have such an
> exposure briefly in 2012 and patched it.)

Just to clear up a few details: traditionally BSD systems (among other)
did not restrict access to other users' environment.  Whether it was
a bad decision at that time is discussable, but once the practice is out
there, it doesn't seem prudent to overlook it in code intended to be
portable.

The access to other users' environment variables was always there in
OpenBSD, its developers were well aware of that fact.  Until the day
where it was decided to remove that admittedly hazardous (especially
with external software) behavior; this happened on 2013/01/16, we added
net/mosh to the OpenBSD ports tree on 2013/04/21.  No kitten was harmed. :)

-- 
jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF  DDCC 0DFA 74AE 1524 E7EE