Re: Screw this

On Wed, Apr 02, 2003 at 02:57:08PM -0800, Adam Megacz wrote:

> Emiliano, I can tell that you're upset.

OK, so this is how to get a point across.

> I apoligize for what has happened in the last month.  In terms of
> guarantees that you will not *lose* functionality, the launcher.war
> shoehorn.jar and xwt-0281.* on dist.xwt.org right now are a complete
> setup that works (except below), and you can keep your own copies of
> them and be certain that you will never lose this functionality.  So
> you can be certain that things will never regress below the level of
> functionality that you have right now.

My major gripe, up there with stuff simply not working, is not being
informed. As I have said numerous times now, I can plan around people
not being available. I cannot plan around people being uncommunicative.

> Something I'd like to see developed in the future is a "quick start"
> kit that you can download which includes the launcher and latest
> signed shoehorn and binaries for all platforms.  This would make it
> easy for people to run sites 100% independent of xwt.org.

I have that right now. I'll send the patch to the patch proposal list
today. This still leaves the question of the shoehorn (which you are
still not willing to talk about, it seems).

As I said to you in private mail earlier, what happens if you have a
sporting accident, or get involved in a pile-up? As much as that would
suck for you (trust me on this one), it would also suck for us, since we
couldn't fix any problems that we spot until you come back. Corey, for
example, wants PPC linux added. He can't submit a patch on this since it
needs help from the shoehorn. And no-one can patch the shoehorn but you.
I am extremely curious as to why you are so shy to talk about it.

> Until now, I didn't realize that you were so focused on xmlrpc.xwt.org
> because you needed the resolver in order to deploy your app.

I think I've posted a number of messages that included this problem
(although I was a lot more calm in my wording then). For example,
http://lists.xwt.org/pipermail/dev/2003-March/002596.html . And an
opportunity to flash this to my manager (which I posted a message about
a week or so ago) has come and gone now; I'll have to see when/if another
opportunity arises.

> Yes, I don't like it either.  I'm trying to figure out how to make it
> go away, but there doesn't seem to be a safe way to do that.
> 
> Please note that the trusted resolver ONLY comes into play when your
> users are using a proxy AND they do not have access to a DNS server
> (resolver).

One that does not resolve public addresses, anyway. Wich is exactly my
problem.

> Right now it is becoming more and more apparent in the security
> community that it is actually extremely unsafe to have users accessing
> the internet through a proxy *without* offering them access to a DNS
> resolver as well.  The best thing for you to do right now is to send
> an equally vitriolic email to your network administrator demanding
> access to a DNS server, on security grounds.  I recommend that you
> cite www.xwt.org/sop.txt to justify this request.

People write vitriolic email to our admins all day long. Look up
'clueless' and 'paranoid except where it pays off' in MW, and you'll
find their pictures. The chances of getting this fixed within any
reasonable timeframe are nil.

> Unfortunately there's more going on here than you realize, or than I
> can tell you within the responsible disclosure guidelines.
> 
>   http://lists.xwt.org/pipermail/dev/2003-April/002622.html
> 
> About all I can say on a public list is that this problem turned out
> to be way bigger than anybody thought.  I'm spending tomorrow at
> Macromedia's brick-and-mortar offices tomorrow to advise them on how
> to proceed.  Keep an eye on CERT.

OK, I'll trust you on this one. This actually sounds like a good deal,
since a CERT report might force our admins to resolve the issue. Or they
could cordon off internet access alltogether. With them, you never can
tell. Which would still leave me to deal with similar environments that
would still depend on the TR.

I'm still confused why the TR would not simply pass on the vulnerability
to quick-swap DNS, but I'll wait for the CERT report if it's that big of
a deal.

> In the long term I want to get rid of the trusted resolver altogether,
> but I have to wait until I can hide behind whatever decision
> Macromedia makes.  And since I can't "unsign" old builds, I'm not
> willing to sign one that doesn't use the resolver until I know for
> sure that my ass is covered.

I can live with that for the time being.

Emile

_______________________________________________
http://lists.xwt.org/listinfo/dev