Subject: Re: OpenSSH Priv Sep and Remote Exploit?
To: Sean Davis <dive@endersgame.net>
From: Theo de Raadt <deraadt@cvs.openbsd.org>
List: tech-security
Date: 06/24/2002 18:48:20
> I don't really care about a bug description. But I do feel that having a fix
> and not releasing it is a little irresponsible. It doesn't seem to me like too
> much to ask that the authors provide fixes to their software.
You are so entirely out of touch with reality. Less than 24 hours
after we produce a patch, there will be a public exploit. You'll see.
But we've got another patch. It's this big thing called privsep, and
it does not point a big arrow at the little exact bug.
But you don't understand. Wow the world has an overabundance of
entirely stupid people in it.