Re: NetBSD/pkgsrc membership on distros list

[Alistair Crooks <agc () pkgsrc org>]

On 16 May 2017 at 10:21, Solar Designer <solar () openwall com> wrote:
> Hi Alistair,
>
> Thank you for the prompt response.
>
> On Tue, May 16, 2017 at 10:04:12AM -0700, Alistair Crooks wrote:
> > Yeah, we're here, we are the same as previously, still trying to go
> > about our business with maximum effect and minimal fuss, and we're
> > listening.
> >
> > We haven't contributed anything (much) recently, but we don't really
> > go in for massive "me too"s, and had kinda hoped that the "no drama"
> > approach would work here. It seems my assumptions were wrong. I will
> > attempt to do a better job at posting - sorry about that, mea culpa.
>
> It wasn't just that, and in fact mere "me too"s are discouraged.

Yup.

> Over the last few days, there have been repeated requests to get a
> response specifically from NetBSD in a thread on the distros list.
> There was no response.  Additionally, the reporter of a vulnerability
> mentioned getting no response to their direct e-mail to your
> security-officer address.

It hit my inbox when I'd just come back from 2 weeks vacation.

When it finally got my attention, the mail itself did little to make
me think it was legit, since I saw an attachment and a subject line
that was generic in the extreme. Mentally, I filed it as spam.
Virtually, too.

I saw more traction on oss-security with the same subject, and
realised (too late, I fear) that it wasn't yet another phishing
attempt. I also heard from other channels that people were trying to
contact me.

My fault. Sorry.

The security team at NetBSD have done an analysis, and have our own
comments to make. I'll do that in due course.

> At least the distros' list messages were being accepted by the NetBSD
> mail server.  (I checked our logs.)
>
> I think you're one of the people subscribed to distros for NetBSD (until
> I suspended the subscription for reasons mentioned above half an hour
> ago).  Right?  Did you receive those messages?  If not, let's
> troubleshoot that now.  If you did, then why the lack of response?
>
> Are you also on oss-security?  I can't find you among the subscribers.

I used to be on oss-security. Don't know what happened if I've been thrown off.

> > What are we doing these days? We're looking into the pre-announcement
> > that everyone else is looking at for NetBSD, and pkgsrc is even more
> > vibrant than ever, runs on a huge number of platforms, and is still
> > reporting CVEs in the usual way - we were told some minor Linux
> > distributions use the pkgsrc notification mechanism, so, for their
> > sakes, I'd ask that you continue to keep us in the loop, please.
>
> Sounds reasonable, but let's figure out what went wrong above first.
>
> I'm sorry for maybe creating drama, but this was already first brought
> up on the distros list itself (and elicited no response from any NetBSD
> person), and besides stuff on the distros list isn't meant to stay
> private forever anyway (even though this normally applies to
> vulnerabilities rather than to administrivia).

Best,
Alistair