Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Mirrors removed from SORCERY (only smgl central site)

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Andrew <afrayedknot AT thefrayedknot.armory.com>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] Mirrors removed from SORCERY (only smgl central site)
  • Date: Fri, 8 Oct 2004 03:10:45 -0700

On Fri, Oct 08, 2004 at 10:45:59AM +0200, Eric Schabell wrote:
> On Fri, Oct 08, 2004 at 01:09:42AM -0700, Andrew wrote:
> > On Fri, Oct 08, 2004 at 09:56:55AM +0200, Eric Schabell wrote:
> > > Howdy all,
> > >
> > > Was just wondering when and why we no longer have extra mirrors for
> > > SORCERY (/etc/sorcery/mirrors/SORCERY)? Having only one is not a good
> > > idea if you ask me...
> > >
> > > erics
> >
> > seems like a bad idea to me having multiple mirrors and hoping they all
> > are actually synced up with the right bits all the time...especially
> > when i dont have access to them.
> >
> We do it with grimoires, what makes sorcery so special that we have to
> rely on one point of failure?

Well if you really want to have this discussion...the main reasons would
be security, and control. You have made the assumption that a single point
of failure is a bad thing, whereas on the flip side there could be a
number of sorcery mirrors and if just one of the gets the wrong bits
for some reason we're going to run into some potentially disastrous
problems. Furthermore we have control over the dns entries for all of
sourcemage.org, and thus if downloads.sourcemage.org goes down for an
extended period of time we can easily point it at someone elses box.

Of course, if downloads.sourcemage.org falls down, theres a pretty good
chance our website, bugzilla, and everything else hosted by ibiblio is
inaccesable too.

I'll point out that no one is stopping you from mirroring sorcery,
by all means go right ahead.

But on that note, im sure folks mirror the grimoire, but sorcery hardly
looks in more than one place for it...i would estimate that at least 95%
of our userbase gets the grimoire from downloads.sourcemage.org since
thats the default and when you scribe add test/games/z-rejected. You
have to actually go in and modify the GRIMOIRE file to get it from
somewhere else.

As far as sorcery goes, we have two models to support, devel sorcery, which
may be broken (although i try hard not let that happen), and we have
stable sorcery which occurs in very rigid well marked releases. Now
it used to be the case that stable (and test) were rebuilt and
published on the perforce server every hour, and then whatever mirrors
existed (unknown to me other than downloads.sourcemage.org) would
apparently download from the perforce server exports and then mirror
sorcery themselves.

However I was not comfortable with that level of abstraction over the
process. I dont want to wake up to discover that for some reason someone
decided to modify the test/stable code un-benknowngst to me, which caused
a cron job to update //sgl/dists/sorcery/sorcery-stable.tar.bz2 which
all the mirrors happily have picked up and are mirroring, or the case
where someone decided to just modify the file in dists directly.
Im not comfortable with a large network of cron jobs pushing things
around completely out of my control.

Since a number of people depend on stable sorcery to actually be
stable I dont exactly want mirrors I have no control over downloading
files (through ftp) and mirroring them. With our current setup
devel is auto-generated and mirrored from the main site. Test and
stable I (and the other leads who have access to the mirror) have
control over. This minimizes the margin of error from code "accidentally"
ending up somewhere it shouldn't.

Lets analyze a few case scenarios of how someone would hack a large
majority of the sourcemage under this scheme of having several sorcery
mirrors.

Fred (the evil-doer) have man-in-the-middle access between
innocent-mirror.smgl-user.org and smee.perforce.org, one day fred comes
up with a sorcery looking tarball that inserts some evil code into
/etc/sorcery/config. No one of course notices if it does whatever it
needs to do quickly. Some people end up downloading this borked version
of sorcery and have their boxes 0wn3d by fr3d.

Joe (the evil-doer) pretends to be a friendly enthusiastic new smgl user.
Fred offers to have a sorcery mirror. Good for Joe. We (being friendly
sorcery coders) add his box, friendly-joe.joe-is-nice.org, to the sorcery
mirrors list. This list eventually makes it down to stable sorcery and
after 3 months or so most of the sourcemage userbase has this version
of sorcery. One day joe wakes up and stops pretending to be nice and
rolls out an evil version of sorcery which he begins to mirror. Some
people end up downloading this borked version of sorcery and have their
boxes 0wn3d by j03. Joe could of course go one step further and make
sure he doesnt send the bad version of sorcery to developers (who can
be identified by ip-address).

If we're lucky people will notice and we'll quickly get a fixed
stable sorcery out without evil fred or joe's broken sorcery
availible. Then we'll scream from the rooftops about how everyone
must update their sorcery from somewhere other than the infected
mirror (hardly a foolproof process).

If we're unlucky a better part of our userbase will have hacked
machines and not even know it. This will continue for months on
end before anyone notices.

In either case we would probably have a significant amount of NEGATIVE
attention drawn towards us, we would lose a significant portion of
our userbase, who, im certain, would vehemently convince people NOT
to use sourcemage because we have such obvious security problems. And
who of course is to blame for this? Why its me! Its egg on my face, not
on fred or joe, why? because im in charge or sorcery. As lead I have
the responsibility of keeping BAD code out of sorcery.

Im certainly not risking all of our work on the trust of some servers
I have no control over mirroring the bits I think they're mirroring,
let-alone getting those bits via insecure protocols.

I agree that in a perfect world sorcery tarballs should be signed
and this problem could mostly go away. Seth and I have discussed this
in the past. Another, far more robust solution to mirroring sorcery is
to round-robin dns. From our dns server(s) we can easily control
what mirrors sorcery can live on, as opposed to having out of
date lists on all our users machines.

This entire discussion also seems to hinge on the assumption that the
sorcery tarballs are a critical resource that must be accessable at all
times by everyone. In reality it isn't, sure people wont be able to get
the same stable sorcery they are already running and re-install it for
the duration of the ibiblio outage, but they wont be able to get the
grimoires either, or anything else for that matter. So really, who cares?


-Andrew

--
__________________________________________________________________________
|Andrew D. Stitt | astitt at sourcemage.org |
|irc: afrayedknot | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus | |
|Sorcery Team Lead, Porting Team Lead | |
|Grimoire Guru ham/smgl | ftp://t.armory.com |
|Author and Maintainer of Prometheus | |
--------------------------------------------------------------------------

Attachment: pgpvFfPiAoyxG.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page