4 ms·

Security for package maintainers

44 points by zdw 5y ago

goodpoint 5y ago
This is why Linux distributions exist.
- SethMLarson 5y ago
  Not sure I understand your comment. Distribution package maintainers would ideally want to adhere to the same sets of standards as language ecosystem package maintainers?
  - rattlesnakedave 5y ago
    Correct. We see less security issues w/ distro packages because they have better best practices, do more curation, and generally have more specialized xp doing this sort of thing. I remember an lwn article about Debian maintainers managing PGP keys a while back which was interesting- https://lwn.net/Articles/734767/ https://lwn.net/Articles/734767/
  - goodpoint 5y ago
    Distributions like Debian are way more strict than that: - peer reviews including licensing review - package signing - various types of build and integration tests - reproducible builds - freeze periods - build hardening flags and sandboxing - strong identity verification with PGP web-of-trust
    - mistrial9 5y ago
      I believe it is a combination of human social checks and math PGP, both .. that stand the test of time, since either one by itself can and will fail spectacularly, at exactly the wrong times
    - aaaaaaaaata 5y ago
      Which adds n days to their patch interval.
      - Vogtinator 5y ago
        Not necessarily caused by those points, if at all a specific implementation.
      - goodpoint 5y ago
        If anything, it's the opposite. Distributions provide security patches that upstream often do not.
mistrial9 5y ago
hard to read an article that starts with "scary" and then revisits all topics without referencing prior arts. taken further - newbs rewriting history from the lens of "me, my laptop and the Allmighty Github, a Microsoft company" does have some offensive elements to it.. you know, since grown-ups have been doing this for thirty years already?
nonrandomstring 5y ago
I've often thought that it's a key weakness when packages are maintained by a sole dev at a single location. Doesn't Debian (and other distros) kinda get around this by having packages built from multiple source repositories as redundancy? When you select an apt mirror you're also selecting an entirely different build right? If "digital twins" are maintained at unconnected sites with identical build paths, won't we be able to have package managers do a diff/hash comparison of packages to reveal if one has been tampered with? (Maybe apt-get already does that, but I am not sure). Is the main objection to this that keeping them all "in sync" would be prohibitively complex for a lone maintainer? Doesn't that suggest that developers are better off building relationships with a distro team as early as possible in their application's lifecycle - rather than distros just randomly "pulling in" things the feel like including?
- mhio 5y ago
  Debian mirrors sync the built package archive. I know Debian (and suse/arch) are striving for reproducible builds, but it hadn't reached 100% last time I checked due to the enormous coverage of packages. Maybe internally there is a stable subset of packages they can do comparative builds with? (particularly those that have the `required` and `important` apt priorities) https://reproducible-builds.org/reports/2022-01 https://reproducible-builds.org/reports/2022-01
Jiejeing 5y ago
> Your primary email account should be from a provider who has been around a long time and takes security seriously. My recommendations are Gmail or Outlook. Is this a joke? What are you going to do if google suddenly goes ballistic on your account as it is regularly the case? Yes, your email should not be burner-grade, but there are plenty of valid options that don’t go into the centralized internet monoculture (not to mention companies with a terrible track record like google). I do not have much to say on the other parts of the article, except that disk encryption should be way higher on the list.
- tgsovlerkhgsel 5y ago
  > What are you going to do if google suddenly goes ballistic on your account If you're a package maintainer for anything reasonably big: You tweet, and the problem gets solved. > disk encryption should be way higher on the list. Disk encryption is relevant only against a relatively rare threat. First, physical attacks are still relatively rare. Second, it only helps against one-shot, detectable physical attacks against a shutdown system. As soon as the attacker can tamper with the system without you noticing, most common FDE (especially on Linux) won't protect you.
- remram 5y ago
  Losing access to your account means you can't push new versions. Eventually your users have to manually move to other software or forks (by you or somebody else). If you account gets compromised (because your domain expired for example), someone else can push a new malicious version that your users will automatically install and run.
johnklos 5y ago
I agree vehemently with this: "Email security is your top priority" However, the author shows a complete lack of understanding of email security. Gmail is NOT secure. While it may be "secure enough" for many people, the fact that there are people out there who have unfettered access to your email can't be ignored. The fact that if Google decides to cancel your account you can do absolutely nothing about it can't be ignored. Someone who thinks Gmail or Outlook give you more security, and not less, than a good systems administrator can provide should learn more about how email works before making such recommendations.
- tgsovlerkhgsel 5y ago
  What's the alternative? Hosting it yourself means you now have a second full time job, which you will most likely do poorly, creating a lot of risk for yourself. It will also break at the most inopportune time, forcing you to spend time on it right then (within a window of a few days) or lose mail. You will also most likely host it on a rented server, which means you'll have just as much, if not more, attack surface than with email-as-a-service. As a package maintainer of anything reasonably important, you at least have access to "twitter support".
  - johnklos 5y ago
    There are more options than just monopolies or doing it yourself. Find a person or organization who does it and does it well, and use them. Do you think, for instance, that the FreeBSD project just runs email off of a technically inept service like outlook.com? Or would ever?

44 points by zdw 5y ago

goodpoint 5y ago

This is why Linux distributions exist.

SethMLarson 5y ago
Not sure I understand your comment. Distribution package maintainers would ideally want to adhere to the same sets of standards as language ecosystem package maintainers?
- rattlesnakedave 5y ago
  Correct. We see less security issues w/ distro packages because they have better best practices, do more curation, and generally have more specialized xp doing this sort of thing. I remember an lwn article about Debian maintainers managing PGP keys a while back which was interesting- https://lwn.net/Articles/734767/ https://lwn.net/Articles/734767/
- goodpoint 5y ago
  Distributions like Debian are way more strict than that: - peer reviews including licensing review - package signing - various types of build and integration tests - reproducible builds - freeze periods - build hardening flags and sandboxing - strong identity verification with PGP web-of-trust
  - mistrial9 5y ago
    I believe it is a combination of human social checks and math PGP, both .. that stand the test of time, since either one by itself can and will fail spectacularly, at exactly the wrong times
  - aaaaaaaaata 5y ago
    Which adds n days to their patch interval.
    - Vogtinator 5y ago
      Not necessarily caused by those points, if at all a specific implementation.
    - goodpoint 5y ago
      If anything, it's the opposite. Distributions provide security patches that upstream often do not.

mistrial9 5y ago

hard to read an article that starts with "scary" and then revisits all topics without referencing prior arts. taken further - newbs rewriting history from the lens of "me, my laptop and the Allmighty Github, a Microsoft company" does have some offensive elements to it.. you know, since grown-ups have been doing this for thirty years already?

nonrandomstring 5y ago

I've often thought that it's a key weakness when packages are maintained by a sole dev at a single location. Doesn't Debian (and other distros) kinda get around this by having packages built from multiple source repositories as redundancy? When you select an apt mirror you're also selecting an entirely different build right? If "digital twins" are maintained at unconnected sites with identical build paths, won't we be able to have package managers do a diff/hash comparison of packages to reveal if one has been tampered with? (Maybe apt-get already does that, but I am not sure). Is the main objection to this that keeping them all "in sync" would be prohibitively complex for a lone maintainer? Doesn't that suggest that developers are better off building relationships with a distro team as early as possible in their application's lifecycle - rather than distros just randomly "pulling in" things the feel like including?

mhio 5y ago
Debian mirrors sync the built package archive. I know Debian (and suse/arch) are striving for reproducible builds, but it hadn't reached 100% last time I checked due to the enormous coverage of packages. Maybe internally there is a stable subset of packages they can do comparative builds with? (particularly those that have the `required` and `important` apt priorities) https://reproducible-builds.org/reports/2022-01 https://reproducible-builds.org/reports/2022-01

Jiejeing 5y ago

> Your primary email account should be from a provider who has been around a long time and takes security seriously. My recommendations are Gmail or Outlook. Is this a joke? What are you going to do if google suddenly goes ballistic on your account as it is regularly the case? Yes, your email should not be burner-grade, but there are plenty of valid options that don’t go into the centralized internet monoculture (not to mention companies with a terrible track record like google). I do not have much to say on the other parts of the article, except that disk encryption should be way higher on the list.

tgsovlerkhgsel 5y ago
> What are you going to do if google suddenly goes ballistic on your account If you're a package maintainer for anything reasonably big: You tweet, and the problem gets solved. > disk encryption should be way higher on the list. Disk encryption is relevant only against a relatively rare threat. First, physical attacks are still relatively rare. Second, it only helps against one-shot, detectable physical attacks against a shutdown system. As soon as the attacker can tamper with the system without you noticing, most common FDE (especially on Linux) won't protect you.
remram 5y ago
Losing access to your account means you can't push new versions. Eventually your users have to manually move to other software or forks (by you or somebody else). If you account gets compromised (because your domain expired for example), someone else can push a new malicious version that your users will automatically install and run.

johnklos 5y ago

I agree vehemently with this: "Email security is your top priority" However, the author shows a complete lack of understanding of email security. Gmail is NOT secure. While it may be "secure enough" for many people, the fact that there are people out there who have unfettered access to your email can't be ignored. The fact that if Google decides to cancel your account you can do absolutely nothing about it can't be ignored. Someone who thinks Gmail or Outlook give you more security, and not less, than a good systems administrator can provide should learn more about how email works before making such recommendations.

tgsovlerkhgsel 5y ago
What's the alternative? Hosting it yourself means you now have a second full time job, which you will most likely do poorly, creating a lot of risk for yourself. It will also break at the most inopportune time, forcing you to spend time on it right then (within a window of a few days) or lose mail. You will also most likely host it on a rented server, which means you'll have just as much, if not more, attack surface than with email-as-a-service. As a package maintainer of anything reasonably important, you at least have access to "twitter support".
- johnklos 5y ago
  There are more options than just monopolies or doing it yourself. Find a person or organization who does it and does it well, and use them. Do you think, for instance, that the FreeBSD project just runs email off of a technically inept service like outlook.com? Or would ever?