Gentoo Archives: gentoo-project

From: Michael Orlitzky <mjo@g.o>
To: gentoo-project@l.g.o
Subject: Re: [gentoo-project] Re: [pre-glep] Security Project Structure
Date: Tue, 04 Dec 2018 22:06:03
In Reply to: [gentoo-project] Re: [pre-glep] Security Project Structure by Kristian Fiskerstrand
1 On 12/4/18 4:05 PM, Kristian Fiskerstrand wrote:
2 >
3 > I personally don't agree with part of this section; security is
4 > relative, and if it is stated to not be supported there are no security
5 > assumptions. If anything the removal of these arches as security
6 > supported demonstrates an active decisions not to support them, and
7 > signals to users of these arches that they can't depend on security
8 > information from Gentoo. Stable generally means a stable tree of
9 > dependencies, without security assumptions, if this is e.g used in a
10 > closed lab that likely doesn't impact much.
11 >
13 This is technically correct, but: how many users even know what a
14 security-supported arch is? I would guess zero, to a decimal point or
15 two. Where would I encounter that information in my daily life?
17 If I pick up any software system that's run by professionals and that
18 has a dedicated security team, my out-of-the-box assumption is that
19 there aren't any known, glaring, and totally fixable security
20 vulnerabilities being quietly handed to me.
22 Having a stable arch that isn't security-supported is a meta-fail... we
23 have a system that fails open by giving people something that looks like
24 it should be safe and then (when it bites them) saying "but you didn't
25 read the fine print!" It should be the other way around: they should
26 have to read the fine print before they can use those arches.