←back to thread

An analysis of the Keycloak authentication system

(security.humanativaspa.it)
189 points udev4096 | 4 comments | 14 Nov 24 13:32 UTC | HN request time: 0s | source
Show context
mickael-kerjean ◴[14 Nov 24 14:57 UTC] No.42136723[source]▶
What if instead of publicly blaming an OSS product, you try to get a support contract with some of the engineers behind it? If your company is too cheap for that, maybe a PR would have been nice?

Having very high expectations when using the software without contributing anything else than public shaming on something that clearly state in the license: "Licensor provides the Work ... WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND" shouldn't be ok, this is quite literally how you make open source developer to burn out

replies(7): >>42136837 #>>42136872 #>>42136966 #>>42137033 #>>42137338 #>>42137517 #>>42137650 #
some_furry ◴[14 Nov 24 15:06 UTC] No.42136837[source]▶
> What if instead of publicly blaming an OSS product, you try to get a support contract with some of the engineers behind it? If your company is too cheap for that, maybe a PR would have been nice?

Yeah, no. That's not how security research works.

If I disclose a security issue to you, it doesn't matter if you're a multinational trillion dollar corporation or a hobbyist in Nebraska, the onus is on you to fix it. Not the security researcher. Their job is done once it's disclosed.

From the timeline:

> 28/03/2024 – First communication sent with all details and a proposed fix.

After that point, any additional help (including a pull request) is going above and beyond.

I run into this attitude you're exhibiting a lot. Where proprietary software has the legal threats, the open source community is plagued by patch entitlement.

Knowledge of a security issue in a project is, in and of itself, a valuable contribution. Expecting a PR devalues this work.

replies(2): >>42136977 #>>42137118 #
noselasd ◴[14 Nov 24 15:16 UTC] No.42136977[source]▶
> If I disclose a security issue to you, it doesn't matter if you're a multinational trillion dollar corporation or a hobbyist in Nebraska, the onus is on you to fix it. Not the security researcher. Their job is done once it's disclosed.

On the other hand, if I'm a hobbyist, I have 0 obligations to do or fix anything I've made open source. Patches are welcome ofcourse.

replies(5): >>42136995 #>>42137081 #>>42137644 #>>42139052 #>>42161121 #
ziddoap ◴[14 Nov 24 15:24 UTC] No.42137081[source]▶
>I have 0 obligations to do or fix anything I've made open source.

While technically true, this seems pretty scummy when you're advertising security software for real people and companies to use as their identity management.

Nowhere on the Keycloak home page does it say "just a hobby project" or anything that would remotely indicate that it is not a serious project and that you shouldn't use the software.

Instead, it seems like they are trying very hard to be taken seriously as an identity management product.

replies(1): >>42137119 #
flanked-evergl ◴[14 Nov 24 15:28 UTC] No.42137119[source]▶
> Nowhere on the Keycloak home page does it say "just a hobby project" or anything that would remotely indicate that it is not a serious project and that you shouldn't use the software.

https://github.com/keycloak/keycloak/blob/main/LICENSE.txt#L...

Indeed

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.
replies(1): >>42137127 #
ziddoap ◴[14 Nov 24 15:28 UTC] No.42137127[source]▶
Point 7 buried in the license document of the github repository is very much not https://www.keycloak.org/
replies(4): >>42137368 #>>42137403 #>>42137626 #>>42137846 #
jillyboel ◴[14 Nov 24 16:12 UTC] No.42137626[source]▶
Is this the first time you heard of open source licenses or something? This is standard boilerplate, and it's hilarious to think you get to ask for more from a project you're not even contributing to.
replies(1): >>42137711 #
ziddoap ◴[14 Nov 24 16:19 UTC] No.42137711[source]▶
I'm not asking for more. I'm saying I think it is scummy to do the bare minimum when you're advertising yourself as a critical piece of security software and encouraging the use of the software in real security-critical applications.
replies(1): >>42140150 #
sneak ◴[14 Nov 24 19:28 UTC] No.42140150[source]▶
They are literally explicitly stating that the software does not claim to be fit for purpose.

You can’t have it both ways.

replies(1): >>42140280 #
ziddoap ◴[14 Nov 24 19:39 UTC] No.42140280[source]▶
They are advertising on their website, extremely prominently, that they are fit for your all of identity management needs.

Are they allowed to put a single paragraph in their license file that runs counter to all of their other marketing, advertising, and communication efforts? For sure!

Is it shitty to do that? I think so. Just be upfront, it's not hard. If your software isn't fit for security-critical applications, don't pretend it is.

replies(1): >>42147029 #
jillyboel ◴[15 Nov 24 14:03 UTC] No.42147029[source]▶
I suppose it's best if you never use any open source software ever again because they all do that. Like I said, it's standard boilerplate and it's absurd to think you get to wish for more from an open source project that you aren't contributing to.

Of course this boilerplate is necessary else you get people like yourself demanding unreasonable things.

replies(1): >>42147852 #
1. ziddoap ◴[15 Nov 24 15:38 UTC] No.42147852{3}[source]▶
I'm not demanding anything, please stop reading my comments in the most uncharitable way you possibly can.

I'm not sure what has you in super-defense mode, but just as they are allowed to misrepresent themselves on their website, I'm allowed to think that it's shitty to do so. However, as I've said already (a few times, actually), they are more than free to continue doing so (and I'm more than free to keep saying it's shitty).

>[...] because they all do that.

No, they don't all do that.

replies(1): >>42147928 #
2. jillyboel ◴[15 Nov 24 15:48 UTC] No.42147928[source]▶
The point is they're not misrepresenting anything, you just don't seem to understand open source. Literally all of them have the same disclaimer, and obviously they're not going to make any guarantees to randos who haven't even paid them. If this is a problem for you, stop using open source. For a start, say byebye to linux.

As for why I'm "on the defensive", bashing open source projects is bad form. You're absolutely welcome to request a refund, though.

replies(1): >>42147993 #
3. ziddoap ◴[15 Nov 24 15:53 UTC] No.42147993[source]▶
>and obviously they're not going to make any guarantees to randos

This is what I mean by purposefully misreading my comments. I have never once said or asked for this. You are arguing in bad faith.

replies(1): >>42148022 #
4. jillyboel ◴[15 Nov 24 15:55 UTC] No.42148022{3}[source]▶
You literally started by calling them scummy. That is an implicit demand for change.