Re: [gentoo-security] Re: Let's blow the whistle

[Dan Margolis]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Peter Simons wrote:
> Hans-Werner Hilse writes:
>
>  > But i doubt that you really manage to hack up my BIND,
>  > place a transparent proxy in my connection to the net or
>  > convince me to use your fake mirror.
>
> Step #1:  The problem doesn't exist.
>
> Step #2:  The problem may exist, but it isn't exploitable.
>
> Step #3:  The problem may be exploitable, but it is
>           extremely unlike to happen.
>
> Step #5:  Well, maybe it is a problem, but there are far
>           more serious problems, so we don't need to fix it.
>
> Step #6:  Even if it were worth fixing, it is way too
>           difficult to do.
>
> Step #7:  Alright, alright. We will fix it as soon as we
>           find the time.
>
> Step #8:  Great job, idiot, now that you have drawn attention
>           the fact that clueless user's machines can be
>           hacked, it is _your_ fault rather than the ours.
>
> Step #9:  Please download the latest Service Pack.
>

First, as a caveat, this is me speaking as me, not as a Gentoo dev.

Peter, please try to remember what Kurt said before, that Gentoo is a
community-based distro and that there really is no ``them.'' Your
mentality seems to be that we're acting as a commercial entity might to
try to quash and cover up vulnerabilities that make us look bad. I've
only been at Gentoo a relatively short time, but in that time, I've had
access to both public and confidential vulnerabilities, and had a chance
to witness the Gentoo security process from the inside. That process is
designed solely to promote the absolute best security we can offer,
never to save face or gain marketshare.

Perhaps that sounds like a lot of marketing itself, but keep this in
mind: if more people use Gentoo, I don't get anything out of it (but
perhaps a little personal satisfaction). But if we do things
poorly--from a security standpoint--not only do we look stupid, but I
and the rest of the team are personally responsible for those who suffer
the repurcussions of our mistakes. So we have very little incentive to
cover-up a vulnerability, and every incentive to do what we can to
promote the best security available.

So why is this not being acted on? Well, this (in that it's a Portage
vulnerability) is somewhat outside the scope of my regular skills, I'll
admit. So I can't give you any definitive explanation. But--and I don't
mean this to urge you not to publish anything you'd like, as this is
already public knowledge--I think you'd do best to trust Kurt's reasons
on this. Being a community-supported distro, if every developer is busy
on something else of higher priority to him (and of course, we can
hardly just hire someone else to fix this), this might languish for a
while. And of course, if a user wants to see it fixed, that user can
always submit a patch.

But I'm not clear on what *your* goal is here by making a public stink.
It would seem you're trying to encourage the Gentoo Project to fix this,
which sounds pretty good and noble. Yet I have to wonder, for the amount
of time you're spending on this, couldn't you just write the patch
yourself at some point and save a lot of trouble?

I guess my final point here is to remember that we're just a bunch of
guys doing something we enjoy, and hopefully making a product that you
and some other people find useful. We aren't making a profit. We aren't
Microsoft. We aren't taking your money and then screwing you over behind
your backs (uh, metaphorically, of course). So if it seems we're
unresponsive, or unhelpful, or don't fix everything you'd like, just try
sometimes to be a little more understanding.

Thanks, Peter,
Dan

- --
Dan "KrispyKringle" Margolis
Security Coordinator/Audit Project, Gentoo Linux
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iQEVAwUBQY+bdLDO2aFJ9pv2AQJ3ZQgAyK1HltQcW8OcaE1nRHkKv9QnV4ioqVQV
yu2m7uEU2OGtAd25Xj5CUEpBOJiqsM4d1A8XprAunvA0CT6bvkkNzI/L47KkU/up
E2OIClj72uuBGA7RYqCMlozZcnNP0dijheqI8whU9/10dJxKZEQ3AhTRrxWB8QEN
mPqTQAJbM4iNU2R2c/pjPwWW62aNn3EENpLjBSMXJngV7DLzG5COXuxvUXryBFZ+
V9L15YpAlgr9qfrDizmMj/335dfot9gK9nsPK22ODfVUnCNzQQ6ZlFl+1BuqBhK3
B9XGjXtm/47qQQ3C4ke60+bcdoMdycape8LtqMsBP9jZI2GAbdKhmA==
=afXK
-----END PGP SIGNATURE-----

--
gentoo-security@g.o mailing list