Re: [gentoo-project] Re: [pre-glep] Security Project Structure

[Kristian Fiskerstrand]

On 12/4/18 11:05 PM, Michael Orlitzky wrote:
> On 12/4/18 4:05 PM, Kristian Fiskerstrand wrote:
>>
>> I personally don't agree with part of this section; security is
>> relative, and if it is stated to not be supported there are no security
>> assumptions. If anything the removal of these arches as security
>> supported demonstrates an active decisions not to support them, and
>> signals to users of these arches that they can't depend on security
>> information from Gentoo. Stable generally means a stable tree of
>> dependencies, without security assumptions, if this is e.g used in a
>> closed lab that likely doesn't impact much.
>>
>
> This is technically correct, but: how many users even know what a
> security-supported arch is? I would guess zero, to a decimal point or
> two. Where would I encounter that information in my daily life?
>
> If I pick up any software system that's run by professionals and that
> has a dedicated security team, my out-of-the-box assumption is that
> there aren't any known, glaring, and totally fixable security
> vulnerabilities being quietly handed to me.
>
> Having a stable arch that isn't security-supported is a meta-fail... we
> have a system that fails open by giving people something that looks like
> it should be safe and then (when it bites them) saying "but you didn't
> read the fine print!" It should be the other way around: they should
> have to read the fine print before they can use those arches.

Well, in terms of CVEs the documentation matters quite a bit, the
question isn't necessarily what any user would do ... but what a
reasonable user would do.. and a reasonable user would consider the
documented practices of a project.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3