Re: update on the djbdns bugs? (fwd)

On Fri, Mar 12, 2010 at 12:57:04AM -0500, Dean Anderson wrote:

> On Thu, 11 Mar 2010, Kevin wrote:
> 
> > Sorry, but you're reading things that aren't there. Read what you just
> > pasted again, looking for the word "patches" or "code" or anything
> > like that. The only mention of "patches" in any of what you pasted
> > below is from you.
> 
> I just sent an email with highlights of statements from //you//.
> 
> And this is a message from Jeff King on August, 9 2008
>                                         ^^^^^^
> http://marc.info/?l=djbdns&m=121824413130252&w=2

I have been trying to avoid the non-factual parts of this thread, but
since you are quoting me, I feel obliged to set the record straight.

> [Jeff wrote:]
> =====================
> I have written a patch that should address the problem (my name was
> given to Kevin because of my previous activity on this list). I am not
> posting the patch right at this moment because:
> 
>   - it is undergoing quality testing right now. A few people are running
>     the patch on their servers to give it some real world testing.
> 
>   - Kevin, myself, and others are trying to get the details right for
>     presenting a coherent argument that this is actually a problem. In
>     other words, we don't want to post a patch and say "this fixes a
>     security problem" until we are sure that it _is_ a problem.
> =====================

Just as Kevin says above, I don't say here that Kevin is collaborating
on the patch. I delivered the patches to him in August (see how I say "I
have written" in August?). He was working on the "coherent argument that
this is actually a problem" mentioned above. And I did collaborate with
him on that, in so far as he sent drafts and said "does this make
sense"? I don't recall providing any feedback beyond saying that it did.

The "others" I mention were folks like David Dagon, with whom Kevin
published the NDSS paper.

> You are plainly working with Jeff King and Dan Kaminsky on the patch and
> its design, and talking to me about it October 2008.  But later (and
> now) you deny it having anything to do with the patch.  I believe that
> King may have controlled the source repository and drew out the final
> patch diff in April, but I think you (Kevin) and Dan are programmers,
> and that King shared the code with you, and that you actually
> collaborated on both the code and its design.

This is all speculation, and it is wrong. The patches I delivered to
Kevin in August were the ones he eventually posted.

I have nothing more to say on the matter. Feel free to respond to this,
Dean, but I will not provoke further spam on the list by replying in
turn. I just felt my words were being misrepresented and wanted to set
the record straight for the onlookers. I no longer care about convincing
you of anything related to this "conspiracy".

-Peff