Gentoo Archives: gentoo-project

From: Michael Orlitzky <mjo@g.o>
To: gentoo-project@l.g.o
Subject: Re: [gentoo-project] Re: [pre-glep] Security Project Structure
Date: Tue, 04 Dec 2018 22:06:03
In Reply to: [gentoo-project] Re: [pre-glep] Security Project Structure by Kristian Fiskerstrand
On 12/4/18 4:05 PM, Kristian Fiskerstrand wrote:
> > I personally don't agree with part of this section; security is > relative, and if it is stated to not be supported there are no security > assumptions. If anything the removal of these arches as security > supported demonstrates an active decisions not to support them, and > signals to users of these arches that they can't depend on security > information from Gentoo. Stable generally means a stable tree of > dependencies, without security assumptions, if this is e.g used in a > closed lab that likely doesn't impact much. >
This is technically correct, but: how many users even know what a security-supported arch is? I would guess zero, to a decimal point or two. Where would I encounter that information in my daily life? If I pick up any software system that's run by professionals and that has a dedicated security team, my out-of-the-box assumption is that there aren't any known, glaring, and totally fixable security vulnerabilities being quietly handed to me. Having a stable arch that isn't security-supported is a meta-fail... we have a system that fails open by giving people something that looks like it should be safe and then (when it bites them) saying "but you didn't read the fine print!" It should be the other way around: they should have to read the fine print before they can use those arches.