DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 52690TmC342151
Date: Thu, 6 Mar 2025 09:59:21 +0100
To: cygwin@cygwin.com
Subject: Re: Cygwin OpenSSH version detection by Tenable
Message-ID: <Z8lj6aZTX26v_H9j@calimero.vinschen.de>
Mail-Followup-To: cygwin@cygwin.com
References: <PH0PR84MB18364E960950D1F0C2080315A5CB2@PH0PR84MB1836.NAMPRD84.PROD.OUTLOOK.COM>
 <19A5E907-7DDF-4FB8-9004-0C8A6B269C1A@unified-streaming.com>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <19A5E907-7DDF-4FB8-9004-0C8A6B269C1A@unified-streaming.com>
Precedence: list
From: Corinna Vinschen via Cygwin <cygwin@cygwin.com>
Reply-To: cygwin@cygwin.com
Cc: Corinna Vinschen <corinna-cygwin@cygwin.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces~archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>

On Mar  5 20:49, Dimitry Andric via Cygwin wrote:
> In my opinion, it is wrong that scanners rely on this information. :-)

Exactly.

> I guess something similar could be done in the Cygwin package. This is
> up to the Cygwin maintainers of course.

And that doesn't change if some distros tweak their identification
string but others don't.  Fedora, for instance doesn't do that either.
So a security scanner relying on that, is simply wrong.

Cygwin's OpenSSH package is from the stock sources without local change
for ages, since Cygwin is one of the supported upstream platforms.  Any
necessary change will go upstream, so that the Cygwin version can be
built from stock upstream again.


Corinna

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple