Followup on Inquiry about regreSSHion postmortem

Rene Malmgren
2025-08-20T22:22:42Z

First its fully ok for you to assume I am acting maliciously. I am a contractor
that work defense, I don't make money by telling my customers that the world
is a pink and happy place, you don't hire us if you want to gamble with your
data.

If the project is up to snuff then it should withstand a stupid user asking
stupid questions even with malicious intent.

I totally concur that people make mistakes, especially under duress. The problem
is that most people don't plan to make their mistakes. This is when things
get interesting.

If you take a look at Heartbleed, you can see by following the paper trail that
several crucial actions were taken by the developer that are very much out of
the ordinary, and that have no obvious reason other than building up for the
"mistake" to happen. There is no sleep deprivation or stress involved
when you decide to write a document as an RFC that contains several known
hazards and then take 2 of your buddies to review it. And sadly, you see the
same pattern here.

Why do you introduce line numbers in error messages, we all know it fucks up the
code with macros, this is a very very well known hazard? What extra information
do you provide too the user, is this a feature that was requested?
Why do you then decide to rename all of the functions and then move them to the
bottom of the file? This is the classical way to fuck up the diff. I recently
fixed a few name inconsistencies in bitcoinJ and accidently did autoformat in
the editor, that fucked up the diff. They rightfully threw it in my face and
told me to redo it. Here its ok.

Then comes the "mistake", I assume that if this this is standard
operational procedure that the #ifdef are not in the "OpenBSD" repo,
then they need to be manually inserted every time you do this? This must be a
known hazard, and one that de Raadt is even proud of. Yet they decide to protect
against CVE-2006-5051 with and #ifdef, something that must have been known to
the developers back in 2006. This is slopy, and with a total disregard for the
safety of the non-OpenBSD users that the OpenBSD project is legendary for, but
malicious, no, its laziness combined with apathy.

Note that the function sigdie was crafted specially for this reason, and both
djm and deraadt signed off on it.

Is it 100% sure that djm remembered all of this 12 years later? No, the
plausible deniability is there, it's not as clear cut as my first
assumption. Does it improve the assessment in favor of the project, yes but not
much. If the act was malicious then he knew at check-in that he would be able to
claim plausible deniability if discovered. And it's a forgone conclusion
that people would protect him, and claim Hanlon?s razor, and so on. It's the
best software on the planet, an example to others, best track record, jidi jada.
And anybody that would raise their voice would be flamed.

On the flip side of the coin is it 100% sure that this was a mistake and not a
preplanned malicious act that cleverly used, for the culprit's known
information, to spike the private budget by selling the non-OpenBSD users'
integrity to somebody? No, we can't say, and no information so far provided
seems to be able to answer the question.

So, everybody has to make a decision based on their situation and state of
paranoia, how much risk are you willing to accept. In the case of our clients
the answer is easy, we can't recommend then to take the risk to have their
data sold on the grey market, and OpenSSH is usually front-line software, it
needs to be up to snuff.

We were triple checking when djm decided to have the discussion
"public", so we are having it public, it's fine.

I know the difference between insanity and stupidity, and in this case sloth.

Not that it matters but until 2024 we used to recommend OpenSSH as one of three
pillars of defense for the most demanding deployments for secure development
environments. Because our clients demand that they should be able to survive 1-2
00 attacks. Then we saw XZ and we said, that was too close for comfort, and now
this.

/Rene


________________________________
From: Hendrik Visage <hvisage at hevis.co.za>
Sent: Wednesday, August 20, 2025 11:42 PM
To: Rene Malmgren <rene.malmgren at redtoken.ae>
Cc: Theo de Raadt <deraadt at openbsd.org>; Stuart Henderson <stu at
spacehopper.org>; openssh-unix-dev at mindrot.org <openssh-unix-dev at
mindrot.org>
Subject: Re: Followup on Inquiry about regreSSHion postmortem

Okay Rene,

 I?m going to take your own words and philosophy below and make the statement:
You are maliciously attacking OpenSSH for your own malicious ideas and greed
(the facts at hand at this point in time using your own philosophy below)


Now lets answer it as a person that had been using SSH since like version 1.1.x,
before OpenSSH was a twinkle in the developer?s eyes, and not as a project
member, just a supporter that likes to stay abreast of things:

On 20 Aug 2025, at 20:40, Rene Malmgren <rene.malmgren at redtoken.ae>
wrote:

I make an assessment based on the facts at hand,

You know the folklore about Ronald Opus? check Wikipedia so you obviously have
not investigated and double and triple checked stuff before you just make your
first and half baked half informed blatantly malicious claims?

Now the trouble when you try to distinguish between malice and insanity is that
malice is usually hidden as insanity.

Seems you totally confuse the wording and meaning?s of Hanlon?s Razor. Refer to
Wikipedia

My personal rule of thumb is not to attribute to insanity what could be
attributed to malice unless other data point in that direction.

Yeah, that is the problem, looking for the devil behind each rock, instead of
understanding the problems with humans making mistakes, and your own actions. In
fact, the issue at hand (and here your lack of the English vernacular is
starting to show) is NOT insanity, but rather ?stupidity?? or just plain common
human error and oversight. Quite? different from the word insanity :P

So, a programmer that makes a "mistake" that is way below their
expected performance and then says oh it was a mistake, well usually you should
take a very much closer look.

Nope, I?ve made SEVERAL mistakes as a seasoned sysadmin MANY times? and usually
when under pressure or lack of sleep. I owned up to those mistakes, and
corrected it and took the rap and put the next thing inplace to try to prevent
similar in future? and then pressure caused me to take yet another short cut for
time/monetary reasons as pressure by the clients and I made the mistake again..
sorry, 30+years in IT as sysadmin is showing my B.o.F.H. side

So no, I did not assume you had a process that was so hazardous, and that you
cared so little for the safety of your non OpenBSD users.

Again you are mistaken, and assigning the wrong faults to the wrong (persons)
processes. The ?Portable" version is not a first class citizen in OpenBSD,
and OpenBSD team I have respect for (I wish I could?ve used it at the same scale
and deployments I am using Linux, but that is a financial discussion outside of
this one)

That said, I?ll refer you to the Qualsys report on this issue !

Obviously coming from the outside, you have to make assumptions,

No, you first have to LEARN and ASK and UNDERSTAND *before* you make
assumptions.. like the saying: To ASSUME, is making an ASS of U and ME.
Assumptions in the mother of all wars? and other cluster<french_word>s ..
so when you make assumptions, you are already in the wrong and have to
understand that

 that is a disadvantage.

No, it is malicious, ie. what is your malicious intent here Rene? you want to
show a client to buy something else from you as they went instead of OpenSSH and
you want to get back at them? that is the facts I see at hand here Rene.

You are also not colored by loyalty to the project or organization, that is an
advantage.

Depends, from an auditors perspective perhaps, but then I?ve had to endure so
many audits, and everytime they?ve come back with stuff similar to your ?audit?
and once they?ve been educated.. the reports suddenly change from the whacking
red to more peaceful yellow and green? much like the South African
Springboks' Green and Gold? but now I?m digressing late at night.

Now the way you structure your organization does not help.

Does not help your malicious intent (which based on your, that is Rene?s
philosophy to assign malice instead of stupidity first), it does however assist
the OpenBSD and OpenSSH *official* in their design testing and operations of a
security first Operating System. GO install OpenBSD and try find that exact same
problems you?ve been complaining about and then come complaining again

It was your collogue that wanted to have a public discussion, so we are having a
public discussion. I think it's good because these questions need to be
answered (or not answered) so that we know where we stand.

No Rene, you started to maliciously (again, following your own philosophy here)
attack the project?s porter of official to portable (for your client?s
convenience...) and there by blaming OpenSSH in totality by claiming malice and
naming it regreSSHing

Question, if they (your clients) and you are so security conscious Rene, why
aren?t you using and advocating OpenBSD to them? Then you would not have had
this problem to worry about in the first case!!!

It's generous that you are providing "free" software for us,
unfortunately SAFE provided free software for ByBit and that kind of free cost
ByBit 1.5 BUSD, and yes SSH is used to protect way more in assets than ByBit has
/ had.

No, on a bit of a different topic, do you know why your server, when asked about
a file that looks very similar to a file a regular diff from your repo, easily
posted as a reference in an email.

That was me, a outsider seeing a malicious attacker named Rene Malmgren and
trying to educate him in his malice.. eh.. now shown to be an insanely stupid
person after evidence presented ;(

https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/log.c.diff?ipk=fF83_JCDCKqCJ85QEwn7jbP5Ag2cF3ZCTZ6QbjGp4RE&r1=1.52&r2=1.53&f=h

Redirects your browser via 301 to https://theannoyingsite.com/

don?t know where you get that, unless your own browser is compromised, and I
pointed you to the direct source to show you your malice.. apologies you?ve now
brainwashed me .. your stupidity/insanity of not investigating and asking the
right questions before jumping on the blame game bandwagon?

Is this that standard way of handling discussion regarding security in OpenSSH?

When you assign malice where human error was at fault, you are asking to be
ridiculed.

W.r.t. Security: AGAIN GO INSTALL OpenBSD and stay away from anything Linux if
you are really valuing your and your clients' security as much as you claim,
as Linux, even though it is my bread an butter,  is not as secure as I wanted it
to be? but that is a personal point of view and financial decisions as Linux is
a business/money maker, and decisions are monetary based not security first,
unlike OpenBSD and OpenSSH *official*.

Hendrik Visage

---
Hendrik Visage
Director - HeViS.Co Systems Pty Ltd
T/A  Envisage Cloud Solutions
Mobile: +27-84-612-5345
hvisage at hevis.co.za<mailto:hvisage at hevis.co.za>
hvisage at envisage.co.za<mailto:hvisage at envisage.co.za>
Instant messaging: https://t.me/hvisage


/Rene








________________________________
From: Theo de Raadt <deraadt at openbsd.org>
Sent: Wednesday, August 20, 2025 6:09 PM
To: Rene Malmgren <rene.malmgren at redtoken.ae>
Cc: Stuart Henderson <stu at spacehopper.org>; openssh-unix-dev at
mindrot.org <openssh-unix-dev at mindrot.org>
Subject: Re: Followup on Inquiry about regreSSHion postmortem

Rene,

You have already

- decided to not figure out how -portable merges are handled,
- written a long conclusion accusing malice

Now, after that long conclusion you have "questions" ?

I'm pretty sure nothing will change your mind.

Ok I should be clearer here, yes there are merges, but explain to me how a merge
conflict would remove the two critical flags. I am not talking about surface
here. I am talking about a clear step by step analysis, that shows how the flags
got removed.

/Rene
________________________________
From: Stuart Henderson <stu at spacehopper.org>
Sent: Wednesday, August 20, 2025 3:07 PM
To: Rene Malmgren <rene.malmgren at redtoken.ae>
Cc: openssh-unix-dev at mindrot.org <openssh-unix-dev at mindrot.org>
Subject: Re: Followup on Inquiry about regreSSHion postmortem

On 2025/08/20 10:41, Rene Malmgren wrote:
Actually, there is no evidence in the available data that such a merge even has
happened

This is simply the way that cross-platform OpenSSH commits are done:

- they are first made to OpenBSD's CVS tree

- then they are later merged to openssh-portable git with an "upstream:
XX" comment and OpenBSD-Commit-ID line (with the RCS ID line synced with
that from the OpenBSD tree in the commit)

there is plenty of evidence of this, and nothing on the surface unusual
about this merge commit compared with others

_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev at mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev at mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev


---

Hendrik Visage

hvisage at hevis.co.za

HeViS.Co Systems Pty Ltd