[HN Gopher] Security for package maintainers
___________________________________________________________________
Security for package maintainers
Author : zdw
Score : 41 points
Date : 2022-03-02 04:42 UTC (18 hours ago)
(HTM) web link (sethmlarson.dev)
(TXT) w3m dump (sethmlarson.dev)
| goodpoint wrote:
| This is why Linux distributions exist.
| SethMLarson wrote:
| Not sure I understand your comment. Distribution package
| maintainers would ideally want to adhere to the same sets of
| standards as language ecosystem package maintainers?
| goodpoint wrote:
| Distributions like Debian are way more strict than that:
|
| - peer reviews including licensing review
|
| - package signing
|
| - various types of build and integration tests
|
| - reproducible builds
|
| - freeze periods
|
| - build hardening flags and sandboxing
|
| - strong identity verification with PGP web-of-trust
| mistrial9 wrote:
| I believe it is a combination of _human_ social checks and
| _math_ PGP, _both_ .. that stand the test of time, since
| either one by itself can and will fail spectacularly, at
| exactly the wrong times
| aaaaaaaaata wrote:
| Which adds n days to their patch interval.
| Vogtinator wrote:
| Not necessarily caused by those points, if at all a
| specific implementation.
| rattlesnakedave wrote:
| Correct. We see less security issues w/ distro packages
| because they have better best practices, do more curation,
| and generally have more specialized xp doing this sort of
| thing.
|
| I remember an lwn article about Debian maintainers managing
| PGP keys a while back which was interesting-
| https://lwn.net/Articles/734767/
| nonrandomstring wrote:
| I've often thought that it's a key weakness when packages are
| maintained by a sole dev at a single location.
|
| Doesn't Debian (and other distros) kinda get around this by
| having packages built from multiple source repositories as
| redundancy? When you select an apt mirror you're also selecting
| an entirely different build right? If "digital twins" are
| maintained at unconnected sites with identical build paths, won't
| we be able to have package managers do a diff/hash comparison of
| packages to reveal if one has been tampered with? (Maybe apt-get
| already does that, but I am not sure).
|
| Is the main objection to this that keeping them all "in sync"
| would be prohibitively complex for a lone maintainer? Doesn't
| that suggest that developers are better off building
| relationships with a distro team as early as possible in their
| application's lifecycle - rather than distros just randomly
| "pulling in" things the feel like including?
| johnklos wrote:
| I agree vehemently with this: "Email security is your top
| priority"
|
| However, the author shows a complete lack of understanding of
| email security. Gmail is NOT secure.
|
| While it may be "secure enough" for many people, the fact that
| there are people out there who have unfettered access to your
| email can't be ignored. The fact that if Google decides to cancel
| your account you can do absolutely nothing about it can't be
| ignored.
|
| Someone who thinks Gmail or Outlook give you more security, and
| not less, than a good systems administrator can provide should
| learn more about how email works before making such
| recommendations.
| tgsovlerkhgsel wrote:
| What's the alternative?
|
| Hosting it yourself means you now have a second full time job,
| which you will most likely do poorly, creating a lot of risk
| for yourself. It will also break at the most inopportune time,
| forcing you to spend time on it right then (within a window of
| a few days) or lose mail.
|
| You will also most likely host it on a rented server, which
| means you'll have just as much, if not more, attack surface
| than with email-as-a-service.
|
| As a package maintainer of anything reasonably important, you
| at least have access to "twitter support".
| johnklos wrote:
| There are more options than just monopolies or doing it
| yourself. Find a person or organization who does it and does
| it well, and use them.
|
| Do you think, for instance, that the FreeBSD project just
| runs email off of a technically inept service like
| outlook.com? Or would ever?
| Jiejeing wrote:
| > Your primary email account should be from a provider who has
| been around a long time and takes security seriously. My
| recommendations are Gmail or Outlook.
|
| Is this a joke? What are you going to do if google suddenly goes
| ballistic on your account as it is regularly the case? Yes, your
| email should not be burner-grade, but there are plenty of valid
| options that don't go into the centralized internet monoculture
| (not to mention companies with a terrible track record like
| google).
|
| I do not have much to say on the other parts of the article,
| except that disk encryption should be way higher on the list.
| tgsovlerkhgsel wrote:
| > What are you going to do if google suddenly goes ballistic on
| your account
|
| If you're a package maintainer for anything reasonably big: You
| tweet, and the problem gets solved.
|
| > disk encryption should be way higher on the list.
|
| Disk encryption is relevant only against a relatively rare
| threat. First, physical attacks are still relatively rare.
| Second, it only helps against one-shot, detectable physical
| attacks against a shutdown system. As soon as the attacker can
| tamper with the system without you noticing, most common FDE
| (especially on Linux) won't protect you.
| mistrial9 wrote:
| hard to read an article that starts with "scary" and then
| revisits all topics without referencing prior arts.
|
| taken further - newbs rewriting history from the lens of "me, my
| laptop and the Allmighty Github, a Microsoft company" does have
| some offensive elements to it.. you know, since grown-ups have
| been doing this for thirty years already?
___________________________________________________________________
(page generated 2022-03-02 23:02 UTC)