Re: Should we be alarmed at our state of security support?
On 02/19/2015 08:24 AM, Michael Stone wrote:
> On Thu, Feb 19, 2015 at 07:29:29AM -0600, John Goerzen wrote:
>> However, part of what I was trying to figure out here is: do we have a
>> lot of unpatched vulnerabilities in our archive?
>
> Yes. Every system (not just debian) has unpatched vulnerabilities. In
> some cases those vulnerabilities are known, and in some cases those
> vulnerabilities are unknown. Fixing all of the vulnerabilities in
> general purpose software is effectively impossible. So the real
> question is, are there unfixed vulnerabilities worth fixing? The
> answer to that depends on the level of risk one is willing to take,
> and may include patching only vulnerabilities that are likely to be
> exploited, applying all potentially security-related patches, or
> intensively auditing the code and trying to fix all vulnerabilities.
> The question is made more difficult by the fact that applying patches
> can introduce new vulnerabilities--so fixing all low-risk
> vulnerabilities could potentially make things worse rather than better.
So, let's put aside the vulnerabilities that are unknown for the
purposes of this discussion.
Right now, the security tracker has, apparently, three status for each
version of Debian:
not vulnerable
vulnerable
fixed
What if we add a fourth:
not worth fixing
This could more clearly communicate what is being said by the "no DSA"
comments, as well as allow debsecan to be improved with this sort of
information. What do you think?
>
> There are no good answers, and the better answers all require a great
> deal of effort. Debian may be able to do a better job of communicating
> why certain bugs are prioritized over others, but what really should
> matter to you is whether the assumptions used to prioritize each bug
> are valid for your particular environment. (That is, you need to
> review each bug at length.) For most people that level of effort isn't
> justified, and they are content to accept whatever is prioritized by
> their vendor. If there are specific cases where you think that the
> debian made the wrong call, it's reasonable to bring those up for
> discussion--people do make mistakes. But do understand that we will
> never get to zero bugs.
Understood. I am just looking, then, for the security-tracker to
reflect this reality in a way that can be automatically understood by
tools like debsecan and more clearly communicated to users.
John
>
> Mike Stone
>
>
Reply to: