Re: [gentoo-security] Gentoo security policy

[Joshua Brindle]

Tobias Weisserth wrote:
> Hello everybody,
>
> There seems to be a HUGE problem with consistency in Gentoo security
> announcements and coordination among Gentoo maintainers.
>
> Step by step:
>
> Why does it take Gentoo that long to react to security issues?
>
> Where can I get information about who is responsible for announcing
> Gentoo security related issues? Is there an official Gentoo security
> team like Debian has? Is there a single, responsible security
> manager/director?
>
> Why are security announcements not handled in a consistent way? Just one
> example: There are at least three places where I have found Gentoo
> security announcements but not a single of these announcements appeared
> in all of these places. Rather I have to search for all of those
> announcements across several non-related media to collect them all. This
> is outrageous.
>
We have instated a new way of handling GLSA's, stay tuned

> Take the latest OpenSSL issue. Aida Escriva-Sammer posted a security
> announcement to full-disclosure. WHY CAN'T I FIND THIS SAME ANNOUNCEMENT
> IN THE OFFICIAL GENTOO ANNOUNCEMENT LISTS?!?!?! Sorry for the screaming,
> but if the people behind Gentoo want Gentoo to be considered a
> professional and productive distribution that is equal to Debian, Red
> Hat, SuSE and the like, then you need to handle these matters in a
> professional way. What you are doing right now IS NOT professional. It
> is dangerously careless. You are irresponsible by acting this way,
> endangering everybody who chooses to use Gentoo by making them believe
> their distribution is maintained properly because they saw some good
> looking security announcement at some point while they miss almost 60%
> of other critical issues.
>
Everyone involved is doing what they can, if you feel this isn't enough 
feel free to join the team and help out, security is a bit underpowered 
at the moment. I'd like to remind you that we don't get paid like 
Redhat, SuSE and "the like".

> The latest security announcement on gentoo-announce is "Honeyd remote
> detection vulnerability" by Tim Yamin. This is just embarrassing. If you
> look at
> http://forums.gentoo.org/viewforum.php?f=16&sid=fbf41b023affaed791f083666ea5352b you'll see that the latest announcement there is "Linux kernel do_mremap local privilege escalation". HOW DO YOU EXPLAIN THESE INCONSISTENT ANNOUNCEMENTS?
>
> Security announcements are totally out of sync, some are never issued
> using the appropriate channels and most them are released hours,
> sometimes days after other distributors do.
>

We are currently not priv to the information other distributions are. 
Although we are trying to get on the vendor-sec list we have been unable 
to do so thus far.

> I can only advise you to take security more serious. Running any machine
> in a productive environment with Gentoo is totally out of the question
> as long as these matters are not handled in an appropriate way. So long,
> Gentoo is only suitable for use at home to play around unless of course
> every Gentoo user is his own security team.
>

You are treading dangerously thin here, I assure you we take security 
seriously.

> I hope this is a wakeup call. Take care.
>

This wasn't anything that we didn't already know about, we already know 
we don't have access to vulnerability reports before the 'mass public', 
we already know we are undermanned, we already know our process is in a 
transition state. What *you* need to know is that we are doing what we 
can with the resources we have, and trying every day to get more 
resources. If you don't like it you can help us, we *are* a community 
distribution, not a commercial distribution that can pay for a full time 
security team, nor are we a distribution with the amount of 'clout' it 
takes to get early advirsories.

My suggestion to you is one of the following
1) help make the team better by participating
2) paying for a full time security team
3) deal with it.


Joshua Brindle

--
gentoo-security@g.o mailing list