4 ms·

The claim that Chrome was not updated on the unstable branch for weeks is wrong. The two releases in question are: 88.0.4324.96 on Jan 19: https://chromerelea

by dnr 5y ago

The claim that Chrome was not updated on the unstable branch for weeks is wrong. The two releases in question are: 88.0.4324.96 on Jan 19: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html https://chromereleases.googleblog.com/2021/01/stable-channel... 88.0.4324.146 on Feb 2: https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2021/02/stable-channel... The commits updating them in nixpkgs are: https://github.com/NixOS/nixpkgs/commit/5b6d3c4b13e50540d044a7edd2e15051f09126d0 https://github.com/NixOS/nixpkgs/commit/5b6d3c4b13e50540d044... https://github.com/NixOS/nixpkgs/commit/4fe69d33aeb6dac647e424d8f190a7635b34ef70 https://github.com/NixOS/nixpkgs/commit/4fe69d33aeb6dac647e4... The first landed in master on Jan 19 (the same day), the second landed in master on Feb 3 (one day late). The way nix works, the CI has to build and verify a large chunk of packages before it gets promoted to unstable. So when did they hit nixos-unstable? It's not possible to tell from git alone, but the history of the channel is archived here: https://channels.nix.gsc.io/ https://channels.nix.gsc.io/ I did the search and the first release hit nixos-unstable on Jan 21 18:20:45 (UTC), and the second on Feb 6 08:30:17 (UTC). So around two days and four days. The backports to nixos-20.09 hit that branch on Jan 26 16:55:17 and Feb 6 13:45:20, so seven days and four days. I'm not sure what the parent commentor was doing that led to them missing these updates. To be clear, this is not a great record. I was running nixos-20.09 and I updated my system ahead of the channels (which is fairly easy, not at all difficult as the parent comment implies). But it's not "weeks", and it's not that bad for a volunteer project.

hollerith 5y ago
I appreciate your digging into that. The interval of time during which I was most concerned about unpatched holes in Nixos-unstable's google-chrome was the days leading up to Mar 12.
- dnr 5y ago
  Chrome stable 89.0.4389.90 was released on March 12: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html https://chromereleases.googleblog.com/2021/03/stable-channel... Version bump in nixpkgs: https://github.com/NixOS/nixpkgs/commit/5f8b95113983c8f31d635c0930d9a6681e929bdb https://github.com/NixOS/nixpkgs/commit/5f8b95113983c8f31d63... on March 13 (one day later) Released in nixos-unstable on Mar 16 11:11:22 UTC (four days later) Backport to 20.09: https://github.com/NixOS/nixpkgs/commit/26ba8cd77b5a4408799ffb02b281cd40382c8688 https://github.com/NixOS/nixpkgs/commit/26ba8cd77b5a4408799f... on March 13 (one day later) Released in nixos-20.09 on Mar 16 16:31:31 UTC (four days later) Again, four days is not great for a Chrome zero-day. NixOS doesn't have a professional security team, and if you need that assurance, maybe you can't use it. But please don't exaggerate and muddy the facts. Most of the delay is due to hydra having to build everything that came in ahead of that change on the master branch, and sometimes the master branch is just broken.... I wish there was a fast-track process that could bump urgent security changes ahead of other ones, but it seems like it could complicate things a lot. Of course, as I said above, it's relatively easy for you to update your local install without waiting for all that, if you're aware of the release and its severity.

by dnr 5y ago

hollerith 5y ago

I appreciate your digging into that. The interval of time during which I was most concerned about unpatched holes in Nixos-unstable's google-chrome was the days leading up to Mar 12.

dnr 5y ago
Chrome stable 89.0.4389.90 was released on March 12: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html https://chromereleases.googleblog.com/2021/03/stable-channel... Version bump in nixpkgs: https://github.com/NixOS/nixpkgs/commit/5f8b95113983c8f31d635c0930d9a6681e929bdb https://github.com/NixOS/nixpkgs/commit/5f8b95113983c8f31d63... on March 13 (one day later) Released in nixos-unstable on Mar 16 11:11:22 UTC (four days later) Backport to 20.09: https://github.com/NixOS/nixpkgs/commit/26ba8cd77b5a4408799ffb02b281cd40382c8688 https://github.com/NixOS/nixpkgs/commit/26ba8cd77b5a4408799f... on March 13 (one day later) Released in nixos-20.09 on Mar 16 16:31:31 UTC (four days later) Again, four days is not great for a Chrome zero-day. NixOS doesn't have a professional security team, and if you need that assurance, maybe you can't use it. But please don't exaggerate and muddy the facts. Most of the delay is due to hydra having to build everything that came in ahead of that change on the master branch, and sometimes the master branch is just broken.... I wish there was a fast-track process that could bump urgent security changes ahead of other ones, but it seems like it could complicate things a lot. Of course, as I said above, it's relatively easy for you to update your local install without waiting for all that, if you're aware of the release and its severity.