| 1 |
On Thu, 2004-03-25 at 20:11, Chris Bainbridge wrote: |
| 2 |
|
| 3 |
> Do you believe that this is the case for all developers? Even if it were, |
| 4 |
> there are many programs other than daemons that connect to the internet that |
| 5 |
> may contain exploitable code. Web browsers, email, irc, ftp, cvs, ssh, |
| 6 |
> usenet, p2p; developers use these programs often, and many exploits have been |
| 7 |
> found in client implementations in the past. |
| 8 |
So shouldn't we focus on creating reliable software and only add package |
| 9 |
managment etc. when the software is "good enough" ? |
| 10 |
We have to accept a certain level of "bugginess", otherwise allmost no |
| 11 |
software would exist. |
| 12 |
|
| 13 |
> Know that a developer checks out |
| 14 |
> cvs from some other project? Hack the server, and when his ip address |
| 15 |
> connects, send trojan code. Then there are physical attacks; is a developer |
| 16 |
> at your uni? Pick his door lock and install a hardware key logger. |
| 17 |
So ... what stops me from r00ting an rsync server? |
| 18 |
What stops me from taking some devs as hostages to get the keys? |
| 19 |
|
| 20 |
I think that we _should_ focus on high-profile risks. That includes the |
| 21 |
compromise of a small number of computers. Any large-scale attack will |
| 22 |
succeed. |
| 23 |
|
| 24 |
> All of these things might individually be less likely than a direct attack, |
| 25 |
> but together the possibility that one small security breach, for a single |
| 26 |
> developer, might occur is more than comparable to the possibility that the |
| 27 |
> rsync code, which has been extensively audited, might contain an external |
| 28 |
> exploit. |
| 29 |
So ... what if hypothetically there was more than one service running on an |
| 30 |
rsync server and the server was compromised due to something unrelated to rsync? |
| 31 |
|
| 32 |
Hmmm, that reminds me of a gentoo rsync server that was compromised... |
| 33 |
|
| 34 |
</sarcasm> |
| 35 |
|
| 36 |
It is good that you, as well as many other Gentooists, are very aware of |
| 37 |
security risks, but I think that this discussion is slowly slipping into |
| 38 |
a paranoid worst-case analysis that says that we can't trust nobody. |
| 39 |
|
| 40 |
The security system has to be robust (because people make mistakes) and |
| 41 |
simple (because we are lazy). So any complex n+1 signatures with |
| 42 |
certificate from m+1 servers will not work because some devs will not |
| 43 |
keep the high standard of security that would be needed for such a |
| 44 |
system. (e.g. ignore warnings because there are too many) |
| 45 |
|
| 46 |
|
| 47 |
hth, |
| 48 |
Patrick |
| 49 |
|
| 50 |
|
| 51 |
-- |
| 52 |
gentoo-dev@g.o mailing list |
Archives