←back to thread

An analysis of the Keycloak authentication system

(security.humanativaspa.it)
189 points udev4096 | 5 comments | 14 Nov 24 13:32 UTC | HN request time: 0s | source
Show context
mickael-kerjean ◴[14 Nov 24 14:57 UTC] No.42136723[source]▶
What if instead of publicly blaming an OSS product, you try to get a support contract with some of the engineers behind it? If your company is too cheap for that, maybe a PR would have been nice?

Having very high expectations when using the software without contributing anything else than public shaming on something that clearly state in the license: "Licensor provides the Work ... WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND" shouldn't be ok, this is quite literally how you make open source developer to burn out

replies(7): >>42136837 #>>42136872 #>>42136966 #>>42137033 #>>42137338 #>>42137517 #>>42137650 #
some_furry ◴[14 Nov 24 15:06 UTC] No.42136837[source]▶
> What if instead of publicly blaming an OSS product, you try to get a support contract with some of the engineers behind it? If your company is too cheap for that, maybe a PR would have been nice?

Yeah, no. That's not how security research works.

If I disclose a security issue to you, it doesn't matter if you're a multinational trillion dollar corporation or a hobbyist in Nebraska, the onus is on you to fix it. Not the security researcher. Their job is done once it's disclosed.

From the timeline:

> 28/03/2024 – First communication sent with all details and a proposed fix.

After that point, any additional help (including a pull request) is going above and beyond.

I run into this attitude you're exhibiting a lot. Where proprietary software has the legal threats, the open source community is plagued by patch entitlement.

Knowledge of a security issue in a project is, in and of itself, a valuable contribution. Expecting a PR devalues this work.

replies(2): >>42136977 #>>42137118 #
noselasd ◴[14 Nov 24 15:16 UTC] No.42136977[source]▶
> If I disclose a security issue to you, it doesn't matter if you're a multinational trillion dollar corporation or a hobbyist in Nebraska, the onus is on you to fix it. Not the security researcher. Their job is done once it's disclosed.

On the other hand, if I'm a hobbyist, I have 0 obligations to do or fix anything I've made open source. Patches are welcome ofcourse.

replies(5): >>42136995 #>>42137081 #>>42137644 #>>42139052 #>>42161121 #
ziddoap ◴[14 Nov 24 15:24 UTC] No.42137081[source]▶
>I have 0 obligations to do or fix anything I've made open source.

While technically true, this seems pretty scummy when you're advertising security software for real people and companies to use as their identity management.

Nowhere on the Keycloak home page does it say "just a hobby project" or anything that would remotely indicate that it is not a serious project and that you shouldn't use the software.

Instead, it seems like they are trying very hard to be taken seriously as an identity management product.

replies(1): >>42137119 #
flanked-evergl ◴[14 Nov 24 15:28 UTC] No.42137119[source]▶
> Nowhere on the Keycloak home page does it say "just a hobby project" or anything that would remotely indicate that it is not a serious project and that you shouldn't use the software.

https://github.com/keycloak/keycloak/blob/main/LICENSE.txt#L...

Indeed

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.
replies(1): >>42137127 #
ziddoap ◴[14 Nov 24 15:28 UTC] No.42137127[source]▶
Point 7 buried in the license document of the github repository is very much not https://www.keycloak.org/
replies(4): >>42137368 #>>42137403 #>>42137626 #>>42137846 #
lucianbr ◴[14 Nov 24 15:50 UTC] No.42137403{3}[source]▶
You really feel that anything that is not directly on the home page does not matter? A link to a separate document explicitly named as containing the conditions of license, warranty and such should not count?

Seems like an absurd view to me.

For all that I think RedHat is not a poor hobbyist and morally at fault. It's just a different matter altogether. The terms under which the software is provided are clearly spelled and in public view. You're just inventing a reason to disregard them.

replies(1): >>42137434 #
1. ziddoap ◴[14 Nov 24 15:52 UTC] No.42137434{4}[source]▶
>You really feel that anything that is not directly on the home page does not matter?

No, that's not what I said.

When it comes to software like this (one of the most important components of your security architecture), hiding the fact that you wont fix vulnerabilities unless you feel like it halfway down in your legalese-filled license is unethical.

I think it's absurd that people are defending this position. We're not talking about a weather app made by Joe Somebody for a weekend project.

replies(2): >>42141105 #>>42147981 #
2. lucianbr ◴[14 Nov 24 20:54 UTC] No.42141105[source]▶
> Point 7 buried in the license document of the github repository is very much not https://www.keycloak.org/

Not a single word in this comment refers to "software like this (one of the most important components of your security architecture)". I guess you realized the absurdity of your position and moved the goalposts to something else.

replies(1): >>42141309 #
3. ziddoap ◴[14 Nov 24 21:16 UTC] No.42141309[source]▶
What?

Can you explain where you think I set goalposts, and how you think I moved them? Because I am not following.

4. LaSombra ◴[15 Nov 24 15:52 UTC] No.42147981[source]▶
The Linux kernel, probably one of the most critically important pieces of software nowadays, is licenced mainly under the GPL version 2.0[0], and other compatible licenses, and provides a section and 2 paragraphs on how there is no warranty for those who decide to use it.

"""

NO WARRANTY

11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

"""

No Linux kernel engineer is obliged to fix any bugs, even security vulnerabilities, if one decides to, but since there's so much at stake, kernel engineers will end up fixing at their own timeframes, as they see fit.

[0] https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html

replies(1): >>42148149 #
5. ziddoap ◴[15 Nov 24 16:07 UTC] No.42148149[source]▶
My complaint was not about the license, it was about how the product represents itself.

Linux.org is a much different website than keycloak.org in the way they represent themselves, how they communicate the product, etc.