3 ms·

I don't see what the system here mentioned here (a list of centrally tracked keys in git) doesn't do that a PKI system does. I'm also not sure why a distro wou

I don't see what the system here mentioned here (a list of centrally tracked keys in git) doesn't do that a PKI system does. I'm also not sure why a distro would be interested in signing keys for third parties, why isn't said software packaged by the distro?

notepad0x90 1y ago
A distro is an OS. it is responsible for the security of the system. third party packages running on it securely is also its responsibility. Right now, that responsiblity is offloaded to users, expecting them to add the right keys and repos. If you look at Windows, MacOS, Android, iOS, virtually any other mass-adapted OS, the OS provides authentication and integrity services for all packages, including third-party packages and programs. Providing a framework where developers can attest their software and ensure it is trusted is a bare-minimum expectation for a modern OS. The Git tracking part isn't an issue, what they should instead do is Git track CA root and intermediate certs and setup a website or workflow where details like the developer, the security checks done, the permissions and privacy implications of the software are attested by the distro and a certificate is issued. The ideal state is such that all software not developed on that system should not be allowed to run unless its authenticity and integrity are validated and the admin/user signs off on the authenticated properties of the software.
- aragilar 1y ago
  The article was talking about the Linux kernel. The kernel doesn't care about the software is runs with, so why should they run a CA (and if the Linux Foundation did run a CA, no one would care, see what happened to LSB)? The distro is a compete system, and doesn't care about your third party software (again, why should they), as they already have a system to manage software, if the developer wants to do their own thing, that's a them problem. If you want to install random unpackaged stuff, go ahead, it's your machine (as nearly every OS allows), and if you don't want to run random stuff, don't install it.
  - notepad0x90 1y ago
    The Linux foundation should handle kernel module validation and sign-off, by default only certified signers should be allow to load modules just like every other modern OS. users/devs can always override that. Distros should do the same thing but for user space. Your attitude on the last paragraph is a big pet-peeve of mine. All problems while someone uses a distro are the distro's problem. period. If I have to install third-party software, the distro is allowing me to do that, it is not "my" problem. It is the distros problem in that they should facilitate secure third-party software package installation and management. They already do that by allowing management of third party repos and package signing keys. Saner distros like ubuntu have a whole third party app market place. It isn't "random stuff" as you put it, it is software like any other that people want to run. The distro's role is to make that happen best they can. Not every package will be in their repo or managed in a repo. things will never be perfect but this attitude of passing the buck to users instead of at least acknowledging the problem is endemic.
    - aragilar 1y ago
      Are you paying either the Linux Foundation or your distro for that work, the work that a) few people value, given few (relatively) pay for it b) few people want to do (otherwise why would this be an issue) ? Otherwise their roles are what they think their roles are.

notepad0x90 1y ago

A distro is an OS. it is responsible for the security of the system. third party packages running on it securely is also its responsibility. Right now, that responsiblity is offloaded to users, expecting them to add the right keys and repos. If you look at Windows, MacOS, Android, iOS, virtually any other mass-adapted OS, the OS provides authentication and integrity services for all packages, including third-party packages and programs. Providing a framework where developers can attest their software and ensure it is trusted is a bare-minimum expectation for a modern OS. The Git tracking part isn't an issue, what they should instead do is Git track CA root and intermediate certs and setup a website or workflow where details like the developer, the security checks done, the permissions and privacy implications of the software are attested by the distro and a certificate is issued. The ideal state is such that all software not developed on that system should not be allowed to run unless its authenticity and integrity are validated and the admin/user signs off on the authenticated properties of the software.

aragilar 1y ago
The article was talking about the Linux kernel. The kernel doesn't care about the software is runs with, so why should they run a CA (and if the Linux Foundation did run a CA, no one would care, see what happened to LSB)? The distro is a compete system, and doesn't care about your third party software (again, why should they), as they already have a system to manage software, if the developer wants to do their own thing, that's a them problem. If you want to install random unpackaged stuff, go ahead, it's your machine (as nearly every OS allows), and if you don't want to run random stuff, don't install it.
- notepad0x90 1y ago
  The Linux foundation should handle kernel module validation and sign-off, by default only certified signers should be allow to load modules just like every other modern OS. users/devs can always override that. Distros should do the same thing but for user space. Your attitude on the last paragraph is a big pet-peeve of mine. All problems while someone uses a distro are the distro's problem. period. If I have to install third-party software, the distro is allowing me to do that, it is not "my" problem. It is the distros problem in that they should facilitate secure third-party software package installation and management. They already do that by allowing management of third party repos and package signing keys. Saner distros like ubuntu have a whole third party app market place. It isn't "random stuff" as you put it, it is software like any other that people want to run. The distro's role is to make that happen best they can. Not every package will be in their repo or managed in a repo. things will never be perfect but this attitude of passing the buck to users instead of at least acknowledging the problem is endemic.
  - aragilar 1y ago
    Are you paying either the Linux Foundation or your distro for that work, the work that a) few people value, given few (relatively) pay for it b) few people want to do (otherwise why would this be an issue) ? Otherwise their roles are what they think their roles are.