Re: (ITS#7367) [PATCH] MozNSS: update list of supported cipher suites

[jvcelak@redhat.com]

Hello,

On Tuesday 02 of October 2012 14:01:16, hyc@symas.com wrote:
> Let's be very clear. I'm not rejecting patches because they come from Red
> Hat. Anyone can plainly see that we have accepted many patches from Red
> Hat. I'm rejecting patches because the relevant code sucks, and when things
> related to them break, the OpenLDAP Project takes the heat even though
> we're not responsible for the breakage. There are CVEs issued against
> OpenLDAP security holes, even though the bugs are in MozNSS, not OpenLDAP.
> I wouldn't have a problem with these patches if they actually worked, or if
> Red Hat took the blame when they don't work, but that's not what has
> happened. Instead we get CVE-2012-2668. We get users asking why their TLS
> connections don't work after upgrading from one RedHat release to the next.
> We get a pointless support burden because users say "we have to run the Red
> Hat packages otherwise they won't support us" but then they don't actually
> ask Red Hat for support, they ask us.

Sometimes a security bug appears. We are not flawless. I do not know how we 
should take the blame. The CVE clearly stated that this is a problem only with 
Mozilla NSS backend. Which is used only by Fedora, RHEL, and their derivates. 
And the affected code was from RH, anyone can see it in VCS. Tell me what did 
you expect us to do and we can try to do it next time.

If our users have a problem, they should first contact our support. Or create 
a bug in our issue tracker. We cannot prevent them from contacting upstream. 
And you can always say them 'Sorry, we cannot help you.' if the question is 
not general enough or the problem depends on our build.
I understand that you don't want to support older OpenLDAP versions, builds 
with non-default libraries, etc. But the users will rather use the package 
from their distribution, instead of compiling it by themselves. And we cannot 
support users' builds, because we do not have the sources and the build 
environment under control. And we cannot rebase the packages freely.

On Tuesday 02 of October 2012 14:18:49, hyc@symas.com wrote:
> Back to this point - surely OpenLDAP libldap is not the only piece of
> software  that expects to use OpenSSL-style cipher suite names. libldap is
> certainly not the best place to put this translation.

I'm not sure about that. We tried to go a "compatible" way with OpenLDAP, 
don't know about other projects. I will take a look.

Jan