[gentoo-dev] Re: git security (SHA-1)

[Duncan]

Ciaran McCreesh posted on Wed, 17 Sep 2014 12:36:16 +0100 as excerpted:

> On Wed, 17 Sep 2014 07:21:08 -0400 Tim Boudreau <niftiness@×××××.com>
> wrote:
>> If someone wants to commit malicious code into Gentoo, they're far more
>> likely to take the ugly but pragmatic approach of, say, forcing someone
>> to commit malicious code at gunpoint and then shooting them, than to go
>> to the vast effort it would take to come up with malicious code that
>> conveniently has the same SHA-1 hash as an existing commit.
>
> ...or getting themselves recruited. Even easier.

Getting recruited, involves at minimum "playing the gentoo game" for 
several months, learning some otherwise esoteric knowledge, working up a 
number of patches that are found useful, and otherwise in general gaining 
the trust of existing devs over a period of some months.

The (arguably reasonable put potentially invalid?) assumption is that 
there's easier ways to do it, should someone feel it worth the trouble, 
so this hurdle is as high as is required.

OTOH, Gunpoint commits and then disappearing the committer involves a few 
days max, and with devs around the world, one will likely even be 
accessible within a local or near-local jurisdiction.


It's worth noting that even with air-tight gpg signing, what's validated 
is possession of the secret key, *NOT* the real identity of the signer, 
whatever key signing parties and key-holder ID verification may or may 
have occurred at some point in the past.

And I think most will agree that an argument that penetrating the 
security of /some/ dev, any one of the ~250-ish out there, and getting a 
copy of their secret signing key, is likely to be *WELL* within the 
resources of someone with rather less resources than the NSA, and is 
likely to be FAR less trouble than EITHER the gunpoint commit or "playing 
the gentoo game for N months" scenarios.  *THAT* is the one we have to 
worry about, as demonstrated by reason and recent history (the kernel.org 
hack a couple years ago, among others) both.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman