RE: membership request to the closed linux-distros security mailing list

[Sona Sarmadi <sona.sarmadi () enea com>]

> On 02/04/15 07:43 PM, Seth Arnold wrote:
> > On Fri, Mar 20, 2015 at 02:00:29PM +0100, Sona Sarmadi wrote:
> > > On behalf of Enea  Software AB, I would like to request membership to
> > > the closed linux-distros security mailing list.
> >
> > Speaking strictly for myself, I'm still somewhat skeptical; the
> > security announce archives
> > http://mail.lists.enea.com/pipermail/security-announce/
> > do show some security updates, but (guessing) 15% of the actual patch
> > links I tried to follow no longer exist.
 All advisories should have a correspondent patch, Can you please let me 
know what patches are missing? 
> > Furthermore, the advisories all suggest downloading patches via http
> > and offer no mechanism to validate the patches before applying them.
> > Consider this recent advisory:
> > http://mail.lists.enea.com/pipermail/security-announce/20150326/000064
> > .html
Yes, we failed here, this was sent by one of our engineers (and not the security team) while I was attending ELC and 
Open Embedded.

> - there's no gpg signature on this advisory
> > - there's no cryptographic checksums in the advisory to authenticate
> >   the patch even if the advisory were signed
> > - there's no ascii-armored signatures in the patches
> > - there's no detached signatures at
> >   http://linux.enea.com/5.0-beta-m400/patches/
> >   or at
> >   http://linux.enea.com/4.0/patches/

I agree, we have plan to provide patches in a more secure way. Our intension is to do 
more for security. Security for embedded customers has not been a high prio in the 
past since most of these devices are isolated, not connected to the outside world. This
is however changing and thus security is becoming important.
To become a member in the Linux-distros list is not the only security concern for us, 
this is one of the items on our list.  This is a sign that we care about security, and we 
want to be part of this community, to contribute back to this community as much as we
can and also get help and inspiration to improve.  

> > If downloading patches and applying them by hand is really the
> > distribution model Enea has chosen, then it feels like the provenance
> > of updates is seriously lacking.

Patches to our customers are handled differently, basically the way each of our customers require. The publically 
available patches are primarily for non-customer Enea Linux users, but still we should provide security updates in a 
secure way.
Please note that Enea Linux is used in the embedded systems, so our customers don't want every day (binary/source code) 
patches. Some embedded devices are not easy to update. Instead we often deliver e.g. monthly updates or when the 
customer desires the update.


> > In my opinion, until some more of the security basics are covered,
> > joining linux-distros@ is premature.
>
> I guess Ubuntu has to be dropped from the linux-distros then, because
> www.ubuntu.com appears to be http-only and the ISO download is entirely
> insecure. The security notices are also served insecurely there:
>
> http://www.ubuntu.com/usn/
>
> Am I missing something... ? It doesn't make much sense to criticize this when
> you folks are doing the same. I do get the impression that Enea Linux is
> handling security poorly (where are all of the other issues?) but this
> bothered me.
 

Kind regards,
//Sona