3 ms·

Debian adds a lot of value in tracking and patching security issues. Debian adds a lot of value in dependency management. Debian adds a lot of value in commun

by dsr_ 6y ago

Debian adds a lot of value in tracking and patching security issues. Debian adds a lot of value in dependency management. Debian adds a lot of value in community. All of these things can and are done by other organizations, but Debian is definitely doing it.

lmm 6y ago
Debian adds negative value on security issues. The Debian ssh key vulnerability was among the worst vulnerabilities ever seen in general-purpose computing, and also a predictable result of Debian policies which remain in place to this day. It will happen again sooner or later.
- jcranmer 6y ago
  The ssh key vulnerability was as much a fault of the upstream as it was Debian: the Debian maintainer who made the patch explicitly asked the OpenSSL mailing list if it was okay, and they indicated at least acquiescence in the change. Given that upstream OpenSSL itself would have the Heartbleed bug revealed a decade later, with all the revelations of its source code quality made more notable as a result, I'm willing to place more blame on OpenSSL than Debian here.
  - lmm 6y ago
    > The ssh key vulnerability was as much a fault of the upstream as it was Debian: the Debian maintainer who made the patch explicitly asked the OpenSSL mailing list if it was okay, and they indicated at least acquiescence in the change. IIRC they asked a list that was not the main project list and not intended for security-critical questions. Code that actually goes in to OpenSSL gets a lot more scrutiny from the OpenSSL side, and other big-name distributions either have dedicated security teams that review changes to security-critical packages, or don't modify upstream sources for them. Debian is both unusually aggressive in its patching (not just for OpenSSL; look at e.g. the cdrecord drama) and unusually lax in its security review. > Given that upstream OpenSSL itself would have the Heartbleed bug revealed a decade later, with all the revelations of its source code quality made more notable as a result, I'm willing to place more blame on OpenSSL than Debian here. Heartbleed was a much more "normal"/defensible bug IMO. Buffer overflows are a normal/expected part of using memory-unsafe languages; every major C/C++ project has had them. Not using random numbers to generate your cryptographic key is just hilariously awful.
- shoo 6y ago
  > Debian ssh key vulnerability was among the worst vulnerabilities ever seen in general-purpose computing interesting, I wasn't aware of the history of this vulnerability. For anyone else curious, here's an analysis of what happened: https://research.swtch.com/openssl https://research.swtch.com/openssl
bayindirh 6y ago
Debian adds another two things which are priceless IMHO: - Set and forget servers (enable automatic security updates and just let it run). - Painless and guaranteed stable to stable upgrade paths.
gorgoiler 6y ago
I have great respect for the project, and IMHO you missed the headline feature: Debian’s Free Software Guidelines and the commitment to true freedom in main is an important contribution to the ethos of a universal operating system. And you’re right about Debian Security Advisories. They are an important part of a stable base OS for anything internet facing. (The days of local users attacking each other via vulnerabilities seem less relevant in 2020.)
- sudosysgen 6y ago
  The days of hacked routers and IoT devices harken back to that, though.
m463 6y ago
also, afaik no telemetry.
- asymptotically2 6y ago
  You can opt-in to sharing some info with the popcon tool.
  - dsr_ 6y ago
    Yeah, the biggest problem I have with Debian is that they tend to take popcon statistics as evidence. No corporate installation ever adds popcon. Nobody sensitive to their privacy adds popcon. It's a small, self-selected group, and massively overrepresents desktops and laptops at the cost of servers.
    - gsich 6y ago
      Main problem with telemetry. The reverse is also true. Software that has it enabled by default will just get data from noobs, because more technical users will disable it. (Looking at Firefox)
    - debiandev 6y ago
      > that they tend to take popcon statistics as evidence Please provide a source to back that claim.
      - dsr_ 6y ago
        Sure. Go read debian-devel on the topic of systemd.
        debiandev 6y ago
        ...

by dsr_ 6y ago

lmm 6y ago

Debian adds negative value on security issues. The Debian ssh key vulnerability was among the worst vulnerabilities ever seen in general-purpose computing, and also a predictable result of Debian policies which remain in place to this day. It will happen again sooner or later.

jcranmer 6y ago
The ssh key vulnerability was as much a fault of the upstream as it was Debian: the Debian maintainer who made the patch explicitly asked the OpenSSL mailing list if it was okay, and they indicated at least acquiescence in the change. Given that upstream OpenSSL itself would have the Heartbleed bug revealed a decade later, with all the revelations of its source code quality made more notable as a result, I'm willing to place more blame on OpenSSL than Debian here.
- lmm 6y ago
  > The ssh key vulnerability was as much a fault of the upstream as it was Debian: the Debian maintainer who made the patch explicitly asked the OpenSSL mailing list if it was okay, and they indicated at least acquiescence in the change. IIRC they asked a list that was not the main project list and not intended for security-critical questions. Code that actually goes in to OpenSSL gets a lot more scrutiny from the OpenSSL side, and other big-name distributions either have dedicated security teams that review changes to security-critical packages, or don't modify upstream sources for them. Debian is both unusually aggressive in its patching (not just for OpenSSL; look at e.g. the cdrecord drama) and unusually lax in its security review. > Given that upstream OpenSSL itself would have the Heartbleed bug revealed a decade later, with all the revelations of its source code quality made more notable as a result, I'm willing to place more blame on OpenSSL than Debian here. Heartbleed was a much more "normal"/defensible bug IMO. Buffer overflows are a normal/expected part of using memory-unsafe languages; every major C/C++ project has had them. Not using random numbers to generate your cryptographic key is just hilariously awful.
shoo 6y ago
> Debian ssh key vulnerability was among the worst vulnerabilities ever seen in general-purpose computing interesting, I wasn't aware of the history of this vulnerability. For anyone else curious, here's an analysis of what happened: https://research.swtch.com/openssl https://research.swtch.com/openssl

bayindirh 6y ago

Debian adds another two things which are priceless IMHO: - Set and forget servers (enable automatic security updates and just let it run). - Painless and guaranteed stable to stable upgrade paths.

gorgoiler 6y ago

I have great respect for the project, and IMHO you missed the headline feature: Debian’s Free Software Guidelines and the commitment to true freedom in main is an important contribution to the ethos of a universal operating system. And you’re right about Debian Security Advisories. They are an important part of a stable base OS for anything internet facing. (The days of local users attacking each other via vulnerabilities seem less relevant in 2020.)

sudosysgen 6y ago
The days of hacked routers and IoT devices harken back to that, though.

m463 6y ago

also, afaik no telemetry.

asymptotically2 6y ago
You can opt-in to sharing some info with the popcon tool.
- dsr_ 6y ago
  Yeah, the biggest problem I have with Debian is that they tend to take popcon statistics as evidence. No corporate installation ever adds popcon. Nobody sensitive to their privacy adds popcon. It's a small, self-selected group, and massively overrepresents desktops and laptops at the cost of servers.
  - gsich 6y ago
    Main problem with telemetry. The reverse is also true. Software that has it enabled by default will just get data from noobs, because more technical users will disable it. (Looking at Firefox)
  - debiandev 6y ago
    > that they tend to take popcon statistics as evidence Please provide a source to back that claim.
    - dsr_ 6y ago
      Sure. Go read debian-devel on the topic of systemd.
      - debiandev 6y ago
        ...