oss-sec mailing list archives
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022
From: Jeremy Stanley <fungi () yuggoth org>
Date: Wed, 7 Oct 2020 19:18:56 +0000
On 2020-10-07 21:00:35 +0300 (+0300), Georgi Guninski wrote:
https://lists.debian.org/debian-security/2020/10/msg00000.html === /home/loser is with permissions 755, default umask 0022 on multiuser machines this sucks much. on a multiuser debian mirror we found a lot of data, including the wordpress password of the admin. ===
It's tradition that on multi-user systems, users would want to share data with one another and also serve content from their home directories in Web sites. Further, it's not at all uncommon for sysadmins to not understand or consider the system defaults when making deployment decisions and failing to secure sensitive files. As a long-time Debian user myself, I agree that this default is showing its age, and can represent a risk for operators who overlook it.
Then in the thread someone with @debian.org email explains to me it is a feature, not a bug.
Nowhere in that response do they call it a feature, and it's disingenuous of you to imply that they did. It's a default, which is almost always going to be a balance between two (or more) competing needs. Also, I encourage you to take a guess at how many people there are "with @debian.org email" (hint, it's not a small number). A more informative response would probably have been to point you to https://wiki.debian.org/Debate/umask which provides pointers to where and how this would need to be solved in the long run.
In a addition, they suggest to tell them the mirror, lol.
Yes, do you fault them for wanting to remove a likely compromised server from the network of volunteer-run package mirrors?
Are debian detached from reality?
Your brusque and insulting attitude (saying their choices suck, calling them detached from reality, laughing at their explanations) is likely to trigger glib responses and cause people to be less inclined to pay attention to what you have to say. -- Jeremy Stanley
Attachment:
signature.asc
Description:
Current thread:
- Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Georgi Guninski (Oct 07)
- Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Jeremy Stanley (Oct 07)
- Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Noel Kuntze (Oct 07)
- Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Brian May (Oct 07)
- Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Solar Designer (Oct 12)
- Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Kurt H Maier (Oct 12)
- Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Jeffrey Walton (Oct 12)
- Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Brian May (Oct 12)
- Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Russ Allbery (Oct 12)
- Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Jeremy Stanley (Oct 07)
- Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 Eli Schwartz (Oct 13)