[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Debian Membership

[still not subscribed to -newmaint, just keeping the cross-post]

Frans Pop wrote:
> On Saturday 14 March 2009, Leo 'costela' Antunes wrote:
>> IMHO that's a false notion of "security through laziness" :).
> Black hats are lazy too. They go after easy targets for maximum profit.
> Getting into Debian currently takes a certain amount of demonstrated 
> dedication to the project through actual hard work. You should not 
> underestimate that.

I do agree it plays a role, but I don't think we should overestimate its
deterring factor either, so I wouldn't use it as an argument against
careful reworking of the NM process. (though I do see the value of
pointing it out!)

> That's useless IMO: just upload the first version of a package without the 
> trojan and include it in -2 after it has passed NEW.


>> [...] and a good identity check when signing someone's key [...]
> Which only helps to sanction the black hat after his misdeeds have been 
> discovered. It does nothing to prevent them.

But this should fit with the "lazy" argument above. If you consider the
time and work it takes to automatically infect potentially millions of
Debian machines a deterrent, then certainly the trouble of your actions
being easily traced back to you should act as just as big (if not
greater) a deterrent.

>> Not to mention the almost mythical "1000 eyeballs make any bug shallow"
>> effect, which should apply - at least tangentially - to security as
>> well...
> Only AFTER a bug has been detected. My point is about prevention. The risk 
> that a trojan will remain undetected for an extended period is quite 
> large if you select the packages to put it in a bit carefully.

Agreed. The point - which I should have made clearer - was just that the
chance of a trojan being caught this way is directly proportional to the
user base of the infected package and thus also to the amount damage it
could make (which I guess is exactly what you mean by "select the
packages carefully" :) ).


Leo "costela" Antunes
[insert a witty retort here]

Attachment: signature.asc
Description: OpenPGP digital signature

Reply to: