<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">1. First of all OpenSSH != OpenSSL</div><div class="">2, It is the sysadmins’ responsibility to install software/package from trusted source</div><div class="">3. the patch you share is a patch to weaponize ssh instead of injecting malicious code and create backdoor to the local sshd.</div><div class="">4. It is the users’ freedom to launch an attack (in this case).</div><div class="">5. unless we force users stick with the exact version of the SSL library, there’s no way to validate it as i know (which in fact make it less secure the users’ are less likely to receive latest patch on time).</div><div class=""><br class=""></div><div class="">It’s like asking how to validate a compiler does not to inject malicious instructions to the binary.</div><div class=""><br class=""></div><div class="">Cheers</div><div class=""><br class=""></div><div class=""><div class=""><div class=""><blockquote type="cite" class=""><div class="">On May 17, 2017, at 7:00 PM, Joy Keys via swift-server-dev <<a href="mailto:swift-server-dev@swift.org" class="">swift-server-dev@swift.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">How does Server Side Swift validate the critical components and libraries to assure the compiled code does not contain backdoors and MITM?<div class=""><br class=""></div><div class="">I found there is a rogue patch<br class=""><div class=""><a href="https://github.com/jtesta/ssh-mitm" class="">https://github.com/jtesta/ssh-mitm</a><br class=""></div></div><div class=""><br class=""></div></div></div></blockquote></div><br class=""></div></div></div></div></div></body></html>