Re: [gentoo-dev] bin packages

[Evan Read]

My beef with binary packages has always been with statically linked
apps.

Say there is a vulnerability in zlib. Some very notable pieces of
software statically linked to it and were vulnerable.  If you merely
install the zlib binary, you secure your dynamically linked stuff, but
not stically linked stuff.

With a source based distro, it is easy to "emerge system; emerge world"
(yes, recompile the lot). If you use packages that aren't freshened (ie,
you are made to bring the source down for things you previously got
binary), you are still possibly using vulnerable code. Maybe not, but to
be sure you either audit your install, or you recompile the lot.

This is the done thing in OpenBSD for security reasons.  Anytime a
security advisory is applied to the base system libraries, everyone does
a "build world".

Possibly, every time a library is known to be vulnerable (especially
core ones), one's package repository could be rebuilt and then "-r" tags
bumped up one.  But warning the user of updated binary packages isn't
built into portage yet.

I think if Gentoo gets big enough, binary packages will become a big
part of it for dialup (where downloads are longer than compiles - like
me) but the inbuilt logic of source recompile will hopefully never be
lost.  In otherwords, Gentoo users should always be prepared to
recompile (unless they don't care - which isn't the attitude to breed)

Evan.

On Mon, 2002-10-07 at 07:50, Cedric Veilleux wrote:
> I do agree with you, there are important security issues with pre-compiled
> packages.
>
> Although gentoo would not be the first distro / OS to provide binary packages.
> Does this mean that all others are insecure? Certainly not. Packages would
> simply have to come from a trusted source.
>
> Pre-compiled is certainly not for every users. I do prefer to compile my own
> packages most of the time. Although, some times I think it would be nice to
> have some kind of repository of pre-compiled packages where I could check if
> a particuliar package is available for my architecture and save hours of
> compile time.
>
>
> Thank you,
>
> Cedric
>
>
>
>
>
> On October 6, 2002 05:31 pm, Owen Stampflee wrote:
> > On Sunday 06 October 2002 2:30 pm, Cedric Veilleux wrote:
> > >         I seem to be one of the few gentoo user who would like to use a
> > > few binary packages to save some compilation time when needed... I made
> > > these packages available, hoping that more people will do the same and
> > > eventually some form of organized repository or peer 2 peer system is put
> > > in place..
> >
> > bad bad idea. Think security.
> > Malicious contributor a, puts out a package that includes some bad holes,
> > that malicious contributor now owns your computer.
> >
> > Have a nice day,
> > Owen
>
> _______________________________________________
> gentoo-dev mailing list
> gentoo-dev@g.o
> http://lists.gentoo.org/mailman/listinfo/gentoo-dev
>
-- 
For security use OpenBSD: http://eread.freeshell.org/
"The future comes 60 minutes an hour no matter who you are or what you
do."
        The Screwtape Letters - C.S. Lewis