Re: setuid/setgid binaries contained in the Debian repository.
On Sun, 3 Aug 2003 22:30:52 -0400, Joey Hess <joeyh@debian.org> said:
> Manoj Srivastava wrote:
>> I note that later discussion tried to paint this whole process as
>> getting people involved in auditing code, and not a mandatory
>> requirement (ie, if you do not get a consensus then your package is
>> buggy) that was in the original proposal.
> Fundamentally you make a wrong assumption. If policy requires that
> "developers MUST hop on one leg while uploading packages", and
> someone catches me sitting down during a long upload, a bug on my
> package will do nothing to correct that, and will be "fixed" by a
> bit-identical upload made in the privacy of my own home (while lying
> down, probably). Policy cannot mandate developer behavior outside
> the strings of bits we're allowed to put into Debian.
Policy can make it so that packages are not accepted into
Debian unless you hop through certain hoops. Like making sure the
upload has a signature. Or that it has an entry in the override
file. I can easily code an entry for katie and friends that takes a
new package, and marks up the ones with setgid bits set -- and the
ftp maintainers do not create override entries until they see a
consensus develop, or the security team says ok.
For gods sake, come up with some more intelligent arguments
for your point of view.
>> I have a full log of this email conversation, as indeed do the list
>> archives, so just go back and lok the whole thread up.
> It'd be great if you'd use your archive to read the thread and
> motivatons that led up to the draft proposal before you try to
> falsly accuse us as you do in the first paragraph I've quoted.
Are you saying that the review was not discussed as a gating
mechanism? If that is the case, then I admit I, for one, was fooled.
Message-ID: <[🔎] 20030801151852.GB15502@alcor.net>
Message-ID: <[🔎] 20030801153312.GA23610@uk.intasys.com>
>> All set[ug]id setups should be reviewed before they go into the
>> archive.
Sounds like this has more teeth than hopping on one leg. And,
unlike things like how many legs one is standing on.
>> Well, If this proposal was in plain text, not a properly formed
>> patch against current policy, and thus meant to be interpreted in
>> the context of the policy document, perhaps that would have been
>> clearer.
> It was clearly marked as a draft proposal, and not a formal policy
> proposal. And frankly, the thread was quite congenial and productive
> until you came along.
Sure. As long as there is no dissent, or disagreement,
everything is cosy and hunky dory. The first sign of disagreement,
though, the whole congeniality things frays apart.
The idea is not to only be nice and freindly to yes men, but
also to be able to discuss rationally with people who do not share
your view, without bringing in ridiculously insulting strawmen like
hopping on one foot.
manoj
--
Immigration is the sincerest form of flattery. Jack Paar
Manoj Srivastava <srivasta@debian.org> <http://www.debian.org/%7Esrivasta/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05 CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B 924B 21BA DABB BF24 424C
Reply to: