4 ms·

"Trust" as two meanings in English: - You can trust someone as in "think they're honest and won't betray me". - You can trust someone as in "think they are co

"Trust" as two meanings in English: - You can trust someone as in "think they're honest and won't betray me". - You can trust someone as in "think they are competent and won't screw-up". In this case, we trust distributions packagers in both ways. Not only do we trust that they are non-malicious, we also trust that they won't clumsily package code without even skimming through it.

woodruffw 2y ago
The point was not about competency. I think typical distribution packagers are very competent. "They won't screw up" is the wrong way to look at security: humans always screw up. We're essentially fallible. We would all do well to remember that the xz backdoor was not caught by distribution code review: it was caught due to a performance side effect that the next adversary will be more careful to avoid. Software stacks are getting bigger, largely due to engineering pressures that are outside of the control of distributions. It's a basic fact that that means work for the same (or fewer) people, which in turn means less time spent on more complicated packages. Under those conditions, competency is not the deciding factor. This is, separately, why having lots of little packages can be (but isn't necessarily) a good thing: small packages that decompose into well-understood units of work can be reviewed more quickly and comprehensively, and can be assigned capabilities that can be tracked and audited with static analysis. You can't do that as easily (or at all) when every package decides to hand-roll its own subcomponents.
- PaulDavisThe1st 2y ago
  > "They won't screw up" is the wrong way to look at security: humans always screw up. We're essentially fallible. Sure. So pick a system that includes at least one extra possible barrier to them screwing up than the system that has none.
  - woodruffw 2y ago
    It’s not “either or.” It’s been decades since a “package the world” approach has been practical at human scales. (I think it’s great that distributions provide one extra set of eyes. But we’re deluding ourselves if we think that can scale to the actual realized demand for both new software and continuous change to software. It’s also not very fair to the distributions.)
akerl_ 2y ago
The average distro package maintainer is not reviewing the underlying code changes in packages to determine if they are malicious, nor is the average disto package maintainer qualified to spot intentionally obfuscated malicious code. The the average distro package maintainers is “person who cares that package repos stay up to date and is willing to commit their time to that work”
rad_gruchalski 2y ago
You are making a sweeping assumption that people who create container images are incompetent.

woodruffw 2y ago

The point was not about competency. I think typical distribution packagers are very competent. "They won't screw up" is the wrong way to look at security: humans always screw up. We're essentially fallible. We would all do well to remember that the xz backdoor was not caught by distribution code review: it was caught due to a performance side effect that the next adversary will be more careful to avoid. Software stacks are getting bigger, largely due to engineering pressures that are outside of the control of distributions. It's a basic fact that that means work for the same (or fewer) people, which in turn means less time spent on more complicated packages. Under those conditions, competency is not the deciding factor. This is, separately, why having lots of little packages can be (but isn't necessarily) a good thing: small packages that decompose into well-understood units of work can be reviewed more quickly and comprehensively, and can be assigned capabilities that can be tracked and audited with static analysis. You can't do that as easily (or at all) when every package decides to hand-roll its own subcomponents.

PaulDavisThe1st 2y ago
> "They won't screw up" is the wrong way to look at security: humans always screw up. We're essentially fallible. Sure. So pick a system that includes at least one extra possible barrier to them screwing up than the system that has none.
- woodruffw 2y ago
  It’s not “either or.” It’s been decades since a “package the world” approach has been practical at human scales. (I think it’s great that distributions provide one extra set of eyes. But we’re deluding ourselves if we think that can scale to the actual realized demand for both new software and continuous change to software. It’s also not very fair to the distributions.)

akerl_ 2y ago

The average distro package maintainer is not reviewing the underlying code changes in packages to determine if they are malicious, nor is the average disto package maintainer qualified to spot intentionally obfuscated malicious code. The the average distro package maintainers is “person who cares that package repos stay up to date and is willing to commit their time to that work”

rad_gruchalski 2y ago

You are making a sweeping assumption that people who create container images are incompetent.