Re: [gentoo-security] Re: Trojan for Gentoo, part 2

[Chocron J.]

Hi, 

I have read all 42 messages that deal with this problem. I have been a Gentoo 
since the very beginning of the distro, and quite a paranoid one too. 
However, if I understand what has been said here, even if we sign all ebuilds 
and source packages, an issue would still remain : trust. You will have to 
trust that the signature you have gotten is not compromised, and that the 
source code has not been compromised before it was signed. Moreover, you 
would have to trust that the person that signed the ebuild has both the 
skills and ethics necessary.

What I'll say now, can be taken as a rather simplistic view of the problem. If 
I am wrong, I will stand corrected, but I would like an explanation :

While I was reading those mails, I was drinking my favorite orange juice. It 
occurred to me then that I had absolutely no assurance that it was not 
poisonned. In effect, I have to trust the people that grew and collected the 
oranges (in our case the people that programmed the source package), the 
people that pressed the oranges and put the juice into a bottle (the devs who 
design the ebuild), the people who conveyed the bottle to my local 
supermarket (i.e people that manage the mirrors) not to have put poison in my 
orange juice. Moreover, I have to trust them to have stood guard to ensure 
that no third party had had access to my orange juice  at any moment in the 
process to put poison in it. However, there I was, drinking it. And I would 
not for the life of me demand that my orange juice be signed digitally to 
ensure that it is safe to drink.

The thing is, I trust the package's devs, I trust the Gentoo devs, I trust the 
mirror maintainers, I trust their ISP and mine. So I actually do not see the 
problem we have here. And just for the sake of the analogy, yes it is 
actually quite as easy to poison my orange juice as to compromise a package 
at any stage.

Again, I do not know if this is relevant, but if it is not, I would really 
like to know why I am wrong to consider things this way.

-- Jonathan

Le Dimanche 7 Novembre 2004 18:52, Dan Margolis a écrit :
> gpgkeys: WARNING: this is an *experimental* HKP interface!
> gpgkeys: key B0CED9A149F69BF6 not found on keyserver
>
> Andreas Waschbuesch wrote:
> > I could open some - as ist seems - "usefull" sourceforge-project and
> > inject any "additional" code on gentoo systems, while submitting a
> > perfectly "legal" ebuild, signed to "heavenly" trust.
>
> The point is that if we implement signing, a user can say, ``Well, I
> distrust the authors of this sourceforge project'' if they wish. But if
> we do not, they may trust the authors and yet still not be able to trust
> the source.
>
> So the reasonable, expected behavior from portage is that the source
> downloaded is the source it claims to be. If we do not trust the
> original source, we needn't install the package, but if we do, we should
> be able to trust the package implicity. Right now, we cannot trust the
> package, even if we trust the original authors. Signing fixes this problem.
>
> Again, this is like saying that since we have not had the NSA conduct
> background checks on each and every open source developer, we should not
> trust their products. Well, fine, then don't install them. But if you
> decide you trust the folks at kernel.org, or KDE, or GAIM, or whatever,
> you should be able to trust the vanilla-sources ebuild, or the kde
> ebuild, or the gaim ebuild. Right now, you cannot. So even when one does
> choose to trust upstream, he cannot trust portage. That is broken.
>
> --
> Dan "KrispyKringle" Margolis
> Security Coordinator/Audit Project, Gentoo Linux

--
gentoo-security@g.o mailing list