oss-sec mailing list archives
Re: Why send bugs embargoed to distros?
From: Levente Polyak <levente () leventepolyak net>
Date: Sat, 23 Sep 2017 15:56:02 +0200
On 09/23/2017 01:44 PM, Hanno Böck wrote:
My understanding is that the purpose of the distros list is that updates can be prepared so after a disclosure the time between "vuln is known" and "patch is available" is short. However from all I can see this largely didn't happen.
[...]
The only distro I'm aware of that prepared packages and pushed them right after disclosure is Gentoo.
For Arch Linux I tested the patch beforehand and prepared the changed buildscripts locally. The final build/release/publication process was invoked just minutes after the public disclosure and the final artifact was signed and hit the repository just 20 minutes after the disclosure. The advisories were sent ~4 hours later once gone through a peer-reviewing process (yes this could have been done even faster). But that's not actually the primary goal of your mail, so lets focus on answering the more important questions below from my personal point of view.
All of this makes me wonder if the distros list serves its purpose. I'd be curious to hear: a) if any people felt that pre-disclosure of optionsbleed was helpful to them and in which way (after all - even if it only helps minor distros and major distros ignore it it may still be a good thing). b) if people think that they'd usually prepare a fixed package, however they didn't consider optionsbleed important enough. (Naturally I probably have a bias seeing my findings as more important as other people, but I could live with that.)
I think everyone should have come to the conclusion that this is potentially pretty bad for a shared hosting environment or anywhere where non-privileged users are able to fulfill the needed pre-requirements. Anyway, my personal believe is that the list is important, useful and in fact definitively helps preparing coordinated releases and doing all needed work before a final fixed package can be deployed for security relevant fixes. Most of the time the provided information (at least for me :P) helps to analyze and understand the underlying problem and its impact beforehand. If patches are available (like for optionbleed) those can be tested and possibly slightly adjusted or discussed when not fitting a specific version/branch. All this is part of the whole process before a problem is analyzed/understood, prioritized, build-requirements adjusted, artifacts prepared and finally released so being able to do the first steps in a coordinated way definitively helps. However, I indeed see your point and understand the frustration and the reason for your mail demonstrated via the optionbleed case. I neither say nor believe that every entity did perfectly to provide the users with fixed packages as that's obviously not the case. What I try to point out is that the list is IMO far from being useless and indeed serves its purpose. I think blaming or questioning the list itself is the wrong conclusion. Instead every entity on its own should rethink their process, prioritization and possibly lack of resources (I include myself to do this). This is not meant to anyone as blaming but we all share the goal to protect the users as good as possible and I believe that the distros list aids in doing so. cheers, Levente
Current thread:
- Why send bugs embargoed to distros? Hanno Böck (Sep 23)
- Re: Why send bugs embargoed to distros? Levente Polyak (Sep 23)
- Re: Why send bugs embargoed to distros? Anthony Liguori (Sep 23)
- Re: Why send bugs embargoed to distros? Simon McVittie (Sep 23)
- Re: Why send bugs embargoed to distros? Marc Deslauriers (Sep 23)
- Re: Why send bugs embargoed to distros? Kurt H Maier (Sep 23)
- Re: Why send bugs embargoed to distros? Till Dörges (Sep 23)
- Re: Why send bugs embargoed to distros? Marcus Meissner (Sep 23)
- Re: Why send bugs embargoed to distros? Ludovic Courtès (Sep 24)
- Re: Why send bugs embargoed to distros? Igor Seletskiy (Sep 24)
- Re: Why send bugs embargoed to distros? John Haxby (Sep 25)
- Re: Why send bugs embargoed to distros? Cliff Perry (Sep 25)
(Thread continues...)
- Re: Why send bugs embargoed to distros? Levente Polyak (Sep 23)