Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Wed, 31 Aug 2005 22:54:50 -0400

On Wed, 2005-08-31 at 18:24 -0700, Seth Alan Woolley wrote:
> > It's not my idea. It's what people do when they try to protect
> > something: they decide who or what is going to endanger the protected
> > entity. I believe it's called threat profile analysis, but don't take my
> > word for it.
>
> Your list was in no way exhaustive, so it shouldn't have been declared
> correct. My point was that you can add points depending on your bias.

Not really. Within the assumptions, it described the most likely
scenarios. I'm ready to discuss others, but those are the most important
ones.

> Threat profiles (as part of larger risk analyses) tend to best be done
> by outside consultants with no stake in the process.

I don't agree completely, but OK, let's find those ;-).

> 90% of what we distribute is third party code. That must present quite
> a conundrum.

Exactly. That's why we have to stick to matters that relate to
distribution and stay clear of trust issues. I *know* people will try to
call the distribution "more secure" because of signatures, but
verification of integrity is a small part of security.

> In any case, trusting code is an altogether different problem than we
> are solving with gnupg. We let the user trust as few third parties as
> possible (basesystem) and let them append software from there, third
> party as well as second and first party.

Let's not start it again.

> The user shouldn't be using us to figure out whether or not to trust a
> package anyways -- we might include opera, for example, but who knows
> what security vulns are in it?
>
> Our bargain is that if they trust the vendor, we should get them what
> the vendor intended -- if the vendor makes it difficult to establish
> intent, we work on a best guess basis.

I agree up to here. It's a "conundrum" for me how people arrived at a
twisted notion that we have to do something vendors are not up to. But
again, let's not start it.

> > I'm far from pushing anybody. On the contrary, I consider myself pushed,
> > but that doesn't matter who's the bully here. The decision has to be
> > made on factors other than personalities.
>
> I was referring to people other than yourself, if that means anything,
> and I'm trying to keep my replies shorter :)

I'm bound to pick a lesser of two evils here: either I respond to more
questions, or remove more unwanted lines. Notice that throughout my
submissions to the list I always remove excessive quoting, and I usually
put my reply above the original message for easy no-scroll reading. This
thread wore me down, so I no longer care.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page