Return-Path: <tiff-bounces@lists.maptools.org>
Delivered-To: info@awaresystems.be
Received: (qmail 13496 invoked from network); 31 Aug 2008 22:19:12 -0000
Received: from judy.telenet-ops.be ([195.130.136.7])
          (envelope-sender <tiff-bounces@lists.maptools.org>)
          by angelia.telenet-ops.be (qmail-ldap-1.03) with SMTP
          for <info@awaresystems.be>; 31 Aug 2008 22:19:12 -0000
Received: from mindy.telenet-ops.be (mindy.telenet-ops.be [195.130.136.8])
	by judy.telenet-ops.be (8.13.1/8.13.1) with ESMTP id m7VMJC2J031491
	for <info@awaresystems.be>; Mon, 1 Sep 2008 00:19:12 +0200
Received: from localhost (localhost.localdomain [127.0.0.1])
	by mindy.telenet-ops.be (Postfix) with SMTP id 3C17160005
	for <info@awaresystems.be>; Mon,  1 Sep 2008 00:19:12 +0200 (CEST)
Received: from circe.telenet-ops.be (circe.telenet-ops.be [195.130.132.51])
	by mindy.telenet-ops.be (Postfix) with ESMTP id 354EF60003
	for <info@awaresystems.be>; Mon,  1 Sep 2008 00:19:12 +0200 (CEST)
Received: from duke.maptools.org (r153.dmsolutions.ca [209.217.116.153])
	by circe.telenet-ops.be (Postfix) with ESMTP id C5B9C33E6A
	for <info@awaresystems.be>; Mon,  1 Sep 2008 00:19:11 +0200 (CEST)
Received: from duke.maptools.org (duke.maptools.org [127.0.0.1])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m7VMHCAX012810;
	Sun, 31 Aug 2008 18:18:22 -0400
Received: from scooby.simplesystems.org (scooby.simplesystems.org
	[65.66.246.67])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m7VMH9fw012807
	for <tiff@lists.maptools.org>; Sun, 31 Aug 2008 18:17:09 -0400
Received: from freddy.simplesystems.org (freddy.simplesystems.org
	[65.66.246.65])
	by scooby.simplesystems.org (8.12.10+Sun/8.12.10) with ESMTP id
	m7VMH7CI016610; Sun, 31 Aug 2008 17:17:07 -0500 (CDT)
Date: Sun, 31 Aug 2008 17:17:07 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
X-X-Sender: bfriesen@freddy.simplesystems.org
To: Lee Howard <faxguy@howardsilvan.com>
Subject: Re: [Tiff] Some security fixes from RHEL
In-Reply-To: <48BB143F.4020301@howardsilvan.com>
Message-ID: <Pine.SOC.4.64.0808311704020.1110@freddy.simplesystems.org>
References: <200808300053.35585.even.rouault@mines-paris.org>
	<48BAB60F.7040207@pobox.com>
	<Pine.SOC.4.64.0808311028060.1110@freddy.simplesystems.org>
	<48BB143F.4020301@howardsilvan.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: tiff@lists.maptools.org
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.4
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org
X-SpamCatcher-Score: 10 [X]

On Sun, 31 Aug 2008, Lee Howard wrote:
>
> Maintainers and developers of any software should be committed to the 
> software development and to the health of the community that uses that 
> software.  Some degree of responsibility is expected.  When flaws in the 
> software are discovered, be they rather benign or security-related, the 
> community looks to developers and maintainers to take action.  Failure to

I agree.  One reason why Frank is feeling a bit jaded regarding 
security issues at the moment is that he is likely aware of ten or 
twenty equally significant issues which have yet to be properly 
fixed/addressed in libtiff.  Some of these are architecture specific.

> take action leads the community into an atmosphere of uncertainty and 
> mistrust... all of which further inhibits the software development cycle.

While libtiff is for the large part high quality software, the 
sophistication of the black-hats (and white-hats too) should not be 
underestimated.  Earlier this year I discovered a jackpot of malicious 
files (collected by a white-hat) and spent a few weeks fixing 
GraphicsMagick so that it was resistent to them.  The level of genius 
represented by these files is pretty astounding.  Some of the file 
formats were virtually forgotten and poorly specified yet the author 
of the maligned files managed to circumvent code which thought it was 
taking the necessary precautions to prevent improper access and 
overflows.  This shows that people are spending considerable time 
studying file formats and implementations to see how to crash the 
readers or cause them to execute user-supplied data.

Bob
======================================
Bob Friesenhahn
bfriesen@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
