Re: Bits from the DPL: DSA and buildds and DAM, oh my!

["Gustavo Franco" <stratus@debian.org>]

On 2/28/07, Joerg Jaspert <joerg@debian.org> wrote:
> On 10944 March 1977, Gustavo Franco wrote:
>
> >> I disagree. RT has a very flexible and complex ACL management which
> >> lacks in BTS. So it can be potentially used to to ensure public view of some
> >> information without full disclosure.
> > I know and use RT daily. I've asked use-cases where we need to use
> > this 'complex ACL management'. What do you want to hide?
>
> Get a new machine sponsored somewhere. The sponsor will send you the
> initial root login which usually includes a password. You dont want
> anyone to see that.

Hi Joerg,

This use-case was already covered above without RT and BTS usage.

Do you really want that initial root login password flying in
plaintext until it reaches a private RT? What's the point of a private
RT then? mitm attack here is trivial, to say the least. As i said,
nobody should send it to BTS, RT or email directly in plaintext, these
sensible information might be sent by mail, out of the tracker and
encrypted. The tracker is still valid here because the issue title
would be something like "sponsored machine setup" and its status
should be available for anyone (not the server password itself, come
on), or at least any Debian developer, IMHO.

regards,
-- stratus
http://stratusandtheswirl.blogspot.com