6 ms·

So. Us normal users will get the security fix on Thursday, but Heroku is somewhat special and gets early access? What does one have to do to become special? I

by pilif 14y ago

So. Us normal users will get the security fix on Thursday, but Heroku is somewhat special and gets early access? What does one have to do to become special? I don't like how this is being handled, no matter how serious the issue. I could kind of understand what the postgres team was doing until this point where they show that while everybody is equal, some are more equal than others and get early access to security fixes. Doing this does nothing but motivate the bad guys even more to find the hole on their own. The initial announcement got me scared already, but this just made it worse.

mrkurt 14y ago
Heroku is special, they host a huge number of Postgres setups that are publicly accessible and somewhat easily discovered. It's not a matter of equality, though, it's one of trust/privacy. Heroku is an easy company for the Postgres guys to trust since they have a pre-existing, healthy relationship.
- tensor 14y ago
  Meanwhile they are holding back a security fix for numerous other companies that also take security extremely seriously. This creates a situation where companies considering posgresql will now have to ask "will I get security fixes as soon as they are ready or will I intentionally be left vulnerable while more privileged users get early access?" Not a good precedent as far as I'm concerned.
  - andrewljohnson 14y ago
    It is open source. If you are so worried about the SLA you get from this open source software, maybe you should a) pay for better support or b) fix it yourself.
    - eksith 14y ago
      That's a cheeky cop-out. The original criticism is still valid, and we don't know how many companies outside of Heroku (if any) are getting the patch ahead of time. We don't all have the resources to a) Pay Oracle grade prices for support or b) the man power to comb through millions of lines of code to fix it ourselves. If these are the best excuses for lack of full transparency one could could come up with, then why would anyone choose a Linux distro? Or any of the *BSDs for that matter? Transparency and an expectation of due diligence is why a lot of companies (in IT and elsewhere) still stay in business while choosing Open Source software. Besides, Postgres isn't some run-of-the-mill startup with a dropped letter domain name. It's a venerable software foundation with almost 20 years of work and experience behind it. Which makes this a questionable course of action on their part despite the need for discretionary release.
      - sendob 14y ago
        I agree, I don't think this reflects well on the postgres community( in so far that Heroku is a member of that community ). Heroku has certainly done a lot to demonstrate how effective postgres can be practice, in addition to other contributions ). All that being said, we don't actually know what the fix looks like, or indeed what their code looks like either right? For all we know this could be being pushed upstream? It could in some other way be unsuitable for general consumption/adoption at this time. It is possible that the fact that Heroku is going to burn it in will end up uncovering an issue or some other fact that will benefit the project, or they may be uniquely "extra" vulnerable because of deviations. The PostgreSQL license cuts(so to speak) both ways in this case: http://www.postgresql.org/about/licence/ http://www.postgresql.org/about/licence/ Heroku has things like: https://postgres.heroku.com/fork https://postgres.heroku.com/fork they are a database as a service, not a distributor of software.
    - tensor 14y ago
      As far as I know, postgres has not had a history of "You only get up-to-date patches if you pay us." I've not even seen that you can pay for early access. If they want to use delayed patches as a source of revenue, they should be up front about it so that people can be ready for cases like this.
    - Narkov 14y ago
      But that is exactly the point - this patch isn't open source (at the moment). It's closed source and is being given to preferred "customers". If it was really open source then we wouldn't have this problem. I'm not an expert in this field but it seems like the proper thing to do would be to announce a release date that gives everyone sufficient time to prepare and then give it to everyone.
      - andrewljohnson 14y ago
        The patch isn't closed source - the patch is in production, and will soon be open sourced. Calling it closed source is just rhetoric. You just don't think they are moving fast enough or that there should be pragmatic reasons to give favorable treatment to any users. And so I think it's valid to say Postgres is open source, so fix it yourself if you don't want to wait for the people who are fixing it for you for free.
        Narkov 14y ago
        If it "will soon be open sourced" what is it if it's not "closed source"? Whilst it's not closed source in the traditional sense, it very much exists (there's no doubt about this) and isn't available to the general population so therefore, IMHO, is closed source. Don't get me wrong - I understand the need to stage the release however I don't agree with the priority/privileged access.
        tensor 14y ago
        And so I think it's valid to say Postgres is open source, so fix it yourself if you don't want to wait for the people who are fixing it for you for free. This is also rhetoric, not to mention damaging and insulting. You know damn well that nobody can "fix it themselves." It's not known what the problem is, let alone how to fix it. For any amount of money. It's not even about the wait time. The entire point of the embargo is that no one releases early. I initially thought this was an early release, though given that heroku uses a service model it probably isn't. The postgres team obviously cares deeply about handling this in the right way. A great many people value that, myself included.
  - cowsql 14y ago
    I would be more concerned about someone being able to reverse engineer the patch somehow and this leaking to those other users that way(seems unlikely). I will be curious to know who identified the problem initially.
  - mrkurt 14y ago
    I don't think you'll find many companies with the exposure (in terms of access to vulnerable Postgres installs) of Heroku, regardless of how seriously they take security. And I suspect most companies that use Postgres don't interact much with the authors/maintainers. I don't think you're being very fair here, honestly. I doubt anyone with any kind of Postgres responsibility is intentionally leaving people exposed, or considers some users more privileged than others.
  - res0nat0r 14y ago
    This is SOP for major open source projects. Most security release announcement lists for major projects consist of big companies whom would be most at risk to a 0day exploit. There is usually an embargo period during which said large companies get to patch their systems before the release goes public.
bdittmer 14y ago
iirc Heroku has several full time employees who have commit access to PG. ie they're paying for some of postgres's development.
- fdr 14y ago
  False (I work there), although some of my colleagues have submitted patches. Commit access is handed out very selectively at postgresql.org, and committing patches is not the bottleneck in making features (reviewing and writing the patches is).
seany 14y ago
There are similar problems with XEN. aws and linode getting early access etc.
benmmurphy 14y ago
this is happens with other opensource projects as well. you just don't hear about it. if you have contacts in the project then you have a good chance of getting early patches.
ig1 14y ago
This is true for most software vendors. In particular companies which make IDS software, control large number of deployments or are in highly-targeted sectors (defence, finance, etc.) will tend to have arrangements with software vendors to get early access to patches/vulnerability information. Typically to get that type of relationship you need to show the vendor that you have a real need for early access and that you have strong internal controls that would prevent any information gained from early access from leaking.
breser 14y ago
This is not an uncommon practice at all. There are other projects that provide early notifications to large vendors. Part of the point of that early notice is so binary packages can be available. Packages can't get built, tested and released alongside security announcements without someone getting early notification. Users are in a much better position if the binary packages are available when the announcement hits than if the announcement hits and the binaries are available a week later. If the issue leaks out early or someone independently finds it they're just in that much better of a position to release the fix. Vendors will be closer to having packages ready. Yes, it's probably not entirely fair. But there's no way to tell everyone without telling the bad guys too. The risk of telling select people to get the ball rolling is worth it if the entire ecosystem is ready when the announcement comes out. Dealing with these issues is always going to be about managing the risk. You can't draw a line in the sand.
- tensor 14y ago
  I thought the point of the delay was so that people could not reverse engineer the patch through the source or binaries? I suppose with Heroku being a service it might be the case that people don't have access to the new patched binaries. If that's the case, then there is no issue.
  - breser 14y ago
    I can't speak for the specifics of Postgresql or Heroku. But in my experience the expectation is that you're supposed to control access to the information. If you produce binaries you're not supposed to make them accessible prior to the embargo date. If you can upgrade without revealing the binaries I don't really see a problem with doing so.
- vetrom 14y ago
  Responsible versus full disclosure is a debate rooted in problems far older than HN. At least we get to see security issues in the light these days!
  - breser 14y ago
sneak 14y ago
You are not entitled to information just because you think you are, or because they have a tradition of publicizing information. Lose the sense of entitlement.
MichaelGG 14y ago
> Doing this does nothing but motivate the bad guys even more to find the hole on their own. Please explain the logic here. How does Heroku getting early access provide more motivation to discover vulnerabilities?
gcr 14y ago
How do we know that this "brief but important update" is related to the security fix?
- dserodio 14y ago
  Timing

by pilif 14y ago

mrkurt 14y ago

Heroku is special, they host a huge number of Postgres setups that are publicly accessible and somewhat easily discovered. It's not a matter of equality, though, it's one of trust/privacy. Heroku is an easy company for the Postgres guys to trust since they have a pre-existing, healthy relationship.

tensor 14y ago
Meanwhile they are holding back a security fix for numerous other companies that also take security extremely seriously. This creates a situation where companies considering posgresql will now have to ask "will I get security fixes as soon as they are ready or will I intentionally be left vulnerable while more privileged users get early access?" Not a good precedent as far as I'm concerned.
- andrewljohnson 14y ago
  It is open source. If you are so worried about the SLA you get from this open source software, maybe you should a) pay for better support or b) fix it yourself.
  - eksith 14y ago
    That's a cheeky cop-out. The original criticism is still valid, and we don't know how many companies outside of Heroku (if any) are getting the patch ahead of time. We don't all have the resources to a) Pay Oracle grade prices for support or b) the man power to comb through millions of lines of code to fix it ourselves. If these are the best excuses for lack of full transparency one could could come up with, then why would anyone choose a Linux distro? Or any of the *BSDs for that matter? Transparency and an expectation of due diligence is why a lot of companies (in IT and elsewhere) still stay in business while choosing Open Source software. Besides, Postgres isn't some run-of-the-mill startup with a dropped letter domain name. It's a venerable software foundation with almost 20 years of work and experience behind it. Which makes this a questionable course of action on their part despite the need for discretionary release.
    - sendob 14y ago
      I agree, I don't think this reflects well on the postgres community( in so far that Heroku is a member of that community ). Heroku has certainly done a lot to demonstrate how effective postgres can be practice, in addition to other contributions ). All that being said, we don't actually know what the fix looks like, or indeed what their code looks like either right? For all we know this could be being pushed upstream? It could in some other way be unsuitable for general consumption/adoption at this time. It is possible that the fact that Heroku is going to burn it in will end up uncovering an issue or some other fact that will benefit the project, or they may be uniquely "extra" vulnerable because of deviations. The PostgreSQL license cuts(so to speak) both ways in this case: http://www.postgresql.org/about/licence/ http://www.postgresql.org/about/licence/ Heroku has things like: https://postgres.heroku.com/fork https://postgres.heroku.com/fork they are a database as a service, not a distributor of software.
  - tensor 14y ago
    As far as I know, postgres has not had a history of "You only get up-to-date patches if you pay us." I've not even seen that you can pay for early access. If they want to use delayed patches as a source of revenue, they should be up front about it so that people can be ready for cases like this.
  - Narkov 14y ago
    But that is exactly the point - this patch isn't open source (at the moment). It's closed source and is being given to preferred "customers". If it was really open source then we wouldn't have this problem. I'm not an expert in this field but it seems like the proper thing to do would be to announce a release date that gives everyone sufficient time to prepare and then give it to everyone.
    - andrewljohnson 14y ago
      The patch isn't closed source - the patch is in production, and will soon be open sourced. Calling it closed source is just rhetoric. You just don't think they are moving fast enough or that there should be pragmatic reasons to give favorable treatment to any users. And so I think it's valid to say Postgres is open source, so fix it yourself if you don't want to wait for the people who are fixing it for you for free.
      - Narkov 14y ago
        If it "will soon be open sourced" what is it if it's not "closed source"? Whilst it's not closed source in the traditional sense, it very much exists (there's no doubt about this) and isn't available to the general population so therefore, IMHO, is closed source. Don't get me wrong - I understand the need to stage the release however I don't agree with the priority/privileged access.
      - tensor 14y ago
        And so I think it's valid to say Postgres is open source, so fix it yourself if you don't want to wait for the people who are fixing it for you for free. This is also rhetoric, not to mention damaging and insulting. You know damn well that nobody can "fix it themselves." It's not known what the problem is, let alone how to fix it. For any amount of money. It's not even about the wait time. The entire point of the embargo is that no one releases early. I initially thought this was an early release, though given that heroku uses a service model it probably isn't. The postgres team obviously cares deeply about handling this in the right way. A great many people value that, myself included.
- cowsql 14y ago
  I would be more concerned about someone being able to reverse engineer the patch somehow and this leaking to those other users that way(seems unlikely). I will be curious to know who identified the problem initially.
- mrkurt 14y ago
  I don't think you'll find many companies with the exposure (in terms of access to vulnerable Postgres installs) of Heroku, regardless of how seriously they take security. And I suspect most companies that use Postgres don't interact much with the authors/maintainers. I don't think you're being very fair here, honestly. I doubt anyone with any kind of Postgres responsibility is intentionally leaving people exposed, or considers some users more privileged than others.
- res0nat0r 14y ago
  This is SOP for major open source projects. Most security release announcement lists for major projects consist of big companies whom would be most at risk to a 0day exploit. There is usually an embargo period during which said large companies get to patch their systems before the release goes public.

bdittmer 14y ago

iirc Heroku has several full time employees who have commit access to PG. ie they're paying for some of postgres's development.

fdr 14y ago
False (I work there), although some of my colleagues have submitted patches. Commit access is handed out very selectively at postgresql.org, and committing patches is not the bottleneck in making features (reviewing and writing the patches is).

seany 14y ago

There are similar problems with XEN. aws and linode getting early access etc.

benmmurphy 14y ago

this is happens with other opensource projects as well. you just don't hear about it. if you have contacts in the project then you have a good chance of getting early patches.

ig1 14y ago

This is true for most software vendors. In particular companies which make IDS software, control large number of deployments or are in highly-targeted sectors (defence, finance, etc.) will tend to have arrangements with software vendors to get early access to patches/vulnerability information. Typically to get that type of relationship you need to show the vendor that you have a real need for early access and that you have strong internal controls that would prevent any information gained from early access from leaking.

breser 14y ago

This is not an uncommon practice at all. There are other projects that provide early notifications to large vendors. Part of the point of that early notice is so binary packages can be available. Packages can't get built, tested and released alongside security announcements without someone getting early notification. Users are in a much better position if the binary packages are available when the announcement hits than if the announcement hits and the binaries are available a week later. If the issue leaks out early or someone independently finds it they're just in that much better of a position to release the fix. Vendors will be closer to having packages ready. Yes, it's probably not entirely fair. But there's no way to tell everyone without telling the bad guys too. The risk of telling select people to get the ball rolling is worth it if the entire ecosystem is ready when the announcement comes out. Dealing with these issues is always going to be about managing the risk. You can't draw a line in the sand.

tensor 14y ago
I thought the point of the delay was so that people could not reverse engineer the patch through the source or binaries? I suppose with Heroku being a service it might be the case that people don't have access to the new patched binaries. If that's the case, then there is no issue.
- breser 14y ago
  I can't speak for the specifics of Postgresql or Heroku. But in my experience the expectation is that you're supposed to control access to the information. If you produce binaries you're not supposed to make them accessible prior to the embargo date. If you can upgrade without revealing the binaries I don't really see a problem with doing so.
vetrom 14y ago
Responsible versus full disclosure is a debate rooted in problems far older than HN. At least we get to see security issues in the light these days!
- breser 14y ago

sneak 14y ago

You are not entitled to information just because you think you are, or because they have a tradition of publicizing information. Lose the sense of entitlement.

MichaelGG 14y ago

> Doing this does nothing but motivate the bad guys even more to find the hole on their own. Please explain the logic here. How does Heroku getting early access provide more motivation to discover vulnerabilities?

gcr 14y ago

How do we know that this "brief but important update" is related to the security fix?

dserodio 14y ago
Timing