Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel > #117703

Re: New contributor experience

From Russ Allbery <rra@debian.org>
Newsgroups linux.debian.devel
Subject Re: New contributor experience
Date 2025-06-17 19:20 +0200
Message-ID <KYI8x-beRO-1@gated-at.bofh.it> (permalink)
References (7 earlier) <KYpSh-b3kz-1@gated-at.bofh.it> <KYqbD-b3Hg-1@gated-at.bofh.it> <KYxwt-b8bQ-1@gated-at.bofh.it> <KYDix-bbVQ-1@gated-at.bofh.it> <KYHPb-bevw-1@gated-at.bofh.it>
Organization The Eyrie

Show all headers | View raw

Otto Kekäläinen <otto@debian.org> writes:

> Sure it is more convenient to, you as you most likely have some well
> optimized Emacs email setup going on. But more secure? Surely signed
> commits and a system that tracks real git commits and who pushed what
> from where is more secure than plain-text patches in e-mail.

In general, no. Using a forge introduces numerous opportunities for race
conditions (reviewing a PR and having someone else update it before you
merge it, for instance) and compromises of other systems (the forge shows
you something different than what it would merge when you press the merge
button). It is then possible to configure the forge to eliminate those
again, but it has to be done carefully and nearly all users of forges do
not do so.

In contrast, if you carefully review a diff that is sitting locally on
your computer because, for instance, it is in your email, and then you
apply exactly that diff that you reviewed rather than pulling it from
somewhere else or clicking on a button on a web site, this is indeed
inherently more secure. It reduces the security risk to only compromise of
your local system and your own failure to understand the diff that you're
reviewing, both of which are going to be an issue under most review
systems and are mostly not avoidable.

You generally lose some other ancillary properties
(cryptographically-attested authorship, for instance), but in terms of the
security of the code itself, it's generally a better approach.

I think you're assuming that because email itself is insecure, Ted's
approach is less secure, but Ted's point is that he's doing a detailed
code review and therefore doesn't care very much about anything that
happens upstream of that. It's the code review that creates the security
properties he's after, and doing that locally in his email produces a very
tight and close chain of custody between the code review and the commit,
whereas a forge weakens that chain of custody considerably.

All of security is a trade-off and a lot of people prefer the user
experience of a forge for other reasons and are willing to accept the
additional security risk or carefully configure the forge for the security
properties they want. Those folks are not wrong to do that. It is to a
very large extent a matter of opinion about competing trade-offs.

But if what you care about the most is ensuring that the code that was
reviewed is the code that was committed, Ted's approach is going to win in
most security scenarios that I can think of.

-- 
Russ Allbery (rra@debian.org)              <https://www.eyrie.org/~eagle/>

Back to linux.debian.devel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

New contributor experience Joachim Zobel <jz-2017@heute-morgen.de> - 2025-05-30 11:00 +0200
  Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-05-30 11:20 +0200
    Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-05-30 14:50 +0200
      Re: New contributor experience Antonio Terceiro <terceiro@debian.org> - 2025-05-30 15:30 +0200
        Re: New contributor experience Simon McVittie <smcv@debian.org> - 2025-05-30 15:40 +0200
          Re: New contributor experience "Theodore Ts'o" <tytso@mit.edu> - 2025-05-30 17:20 +0200
      Re: Re: New contributor experience Antoine Le Gonidec <debian@vv221.fr> - 2025-05-30 20:00 +0200
  Re: New contributor experience Joachim Zobel <jz-2017@heute-morgen.de> - 2025-05-30 16:30 +0200
    Re: New contributor experience Joachim Zobel <jz-2017@heute-morgen.de> - 2025-05-30 17:10 +0200
      Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-05-30 17:20 +0200
      Re: New contributor experience Soren Stoutner <soren@debian.org> - 2025-05-30 19:50 +0200
        Re: New contributor experience Jonas Smedegaard <jonas@jones.dk> - 2025-05-30 21:40 +0200
        Re: New contributor experience gregor herrmann <gregoa@debian.org> - 2025-05-30 22:30 +0200
          Re: New contributor experience Soren Stoutner <soren@debian.org> - 2025-05-30 22:30 +0200
            Re: New contributor experience gregor herrmann <gregoa@debian.org> - 2025-05-31 00:20 +0200
            Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-05-31 07:40 +0200
              Re: New contributor experience Fabio Fantoni <fantonifabio@tiscali.it> - 2025-05-31 11:10 +0200
          Re: New contributor experience Chris Hofstaedtler <zeha@debian.org> - 2025-06-02 10:20 +0200
    Pondering a Welcome Team (Was: New contributor experience) Daniel Gröber <dxld@darkboxed.org> - 2025-06-01 22:40 +0200
      Re: Pondering a Welcome Team (Was: New contributor experience) Joachim Zobel <jz-2017@heute-morgen.de> - 2025-06-02 11:30 +0200
  Re: New contributor experience Phil Wyett <philip.wyett@kathenas.org> - 2025-06-02 10:20 +0200
    Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-02 12:40 +0200
  Re: New contributor experience Otto Kekäläinen <otto@debian.org> - 2025-06-04 12:50 +0200
    Re: New contributor experience Joachim Zobel <jz-2017@heute-morgen.de> - 2025-06-04 13:10 +0200
      Re: New contributor experience Holger Levsen <holger@layer-acht.org> - 2025-06-04 13:30 +0200
        Re: New contributor experience Joachim Zobel <jzobel@heute-morgen.de> - 2025-06-04 14:00 +0200
      Re: New contributor experience Julien Plissonneau Duquène <sre4ever@free.fr> - 2025-06-04 13:50 +0200
    Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-04 13:30 +0200
      Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-04 13:40 +0200
        Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-04 13:50 +0200
        Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-04 14:00 +0200
          Re: New contributor experience Jonas Smedegaard <jonas@jones.dk> - 2025-06-04 14:30 +0200
            Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-04 15:00 +0200
              Re: New contributor experience Nilesh Patra <nilesh@debian.org> - 2025-06-04 16:40 +0200
                Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-04 17:20 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-04 17:30 +0200
                Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-04 17:50 +0200
                Re: New contributor experience Otto Kekäläinen <otto@debian.org> - 2025-06-04 17:40 +0200
                Re: New contributor experience Russ Allbery <rra@debian.org> - 2025-06-04 17:40 +0200
                Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-04 17:50 +0200
                Re: New contributor experience Russ Allbery <rra@debian.org> - 2025-06-04 18:20 +0200
                Re: New contributor experience Raphael Hertzog <hertzog@debian.org> - 2025-06-06 14:50 +0200
                Re: "People can't be bothered" (Was: New contributor experience) Daniel Gröber <dxld@darkboxed.org> - 2025-06-04 19:40 +0200
                Re: New contributor experience Nilesh Patra <nilesh@debian.org> - 2025-06-05 06:50 +0200
                Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-05 07:30 +0200
              Re: New contributor experience Nilesh Patra <nilesh@debian.org> - 2025-06-05 06:50 +0200
              Re: New contributor experience Richard Lewis <richard.lewis.debian@googlemail.com> - 2025-06-05 22:00 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-05 22:10 +0200
                Re: New contributor experience Richard Lewis <richard.lewis.debian@googlemail.com> - 2025-06-05 22:50 +0200
                Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-05 23:10 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-06 10:00 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-06 10:00 +0200
                Re: New contributor experience Richard Lewis <richard.lewis.debian@googlemail.com> - 2025-06-06 20:00 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-06 20:20 +0200
                Re: New contributor experience Joachim Zobel <jzobel@heute-morgen.de> - 2025-06-06 20:50 +0200
          Re: New contributor experience Julien Plissonneau Duquène <sre4ever@free.fr> - 2025-06-04 15:00 +0200
            Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-04 15:10 +0200
              Re: New contributor experience Jonas Smedegaard <jonas@jones.dk> - 2025-06-04 15:40 +0200
                Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-04 16:10 +0200
              Re: New contributor experience Soren Stoutner <soren@debian.org> - 2025-06-05 00:00 +0200
                Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-05 20:00 +0200
                Re: New contributor experience Soren Stoutner <soren@debian.org> - 2025-06-05 22:40 +0200
                Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-05 23:10 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-05 20:20 +0200
        Re: New contributor experience Charles Plessy <plessy@debian.org> - 2025-06-05 01:50 +0200
      Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-04 13:40 +0200
        Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-04 14:00 +0200
          Re: New contributor experience Jonas Smedegaard <jonas@jones.dk> - 2025-06-04 14:20 +0200
            Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-04 14:30 +0200
              Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-04 14:50 +0200
          Re: New contributor experience Russ Allbery <rra@debian.org> - 2025-06-04 17:40 +0200
            Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-04 17:50 +0200
              Re: New contributor experience Simon McVittie <smcv@debian.org> - 2025-06-04 18:00 +0200
              Re: New contributor experience Jonas Smedegaard <jonas@jones.dk> - 2025-06-04 18:30 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-04 18:40 +0200
                Re: New contributor experience Jonas Smedegaard <jonas@jones.dk> - 2025-06-04 19:20 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-04 20:20 +0200
                Re: New contributor experience Andreas Tille <andreas@an3as.eu> - 2025-06-08 11:00 +0200
                Re: Re: New contributor experience Alex <alex@puer-robustus.eu> - 2025-06-11 00:10 +0200
                Re: New contributor experience Pirate Praveen <praveen@onenetbeyond.org> - 2025-06-11 20:40 +0200
                Re: New contributor experience Otto Kekäläinen <otto@debian.org> - 2025-06-11 21:40 +0200
                Re: New contributor experience IOhannes m zmölnig <umlaeute@debian.org> - 2025-06-12 18:40 +0200
                Re: New contributor experience Joachim Zobel <jzobel@heute-morgen.de> - 2025-06-13 12:50 +0200
                Re: New contributor experience Otto Kekäläinen <otto@debian.org> - 2025-06-13 08:00 +0200
                Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-04 18:40 +0200
                Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-04 19:20 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-04 19:30 +0200
                Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-04 19:40 +0200
                Re: New contributor experience Tim Woodall <debiandevel@woodall.me.uk> - 2025-06-07 18:00 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-07 18:10 +0200
                apt-cacher-ng (Was Re: New contributor experience) Andy Smith <andy@strugglers.net> - 2025-06-07 23:00 +0200
                Re: apt-cacher-ng (Was Re: New contributor experience) "Andrea Pappacoda" <tachi@debian.org> - 2025-06-07 23:20 +0200
                Re: apt-cacher-ng (Was Re: New contributor experience) Alexandre Detiste <alexandre.detiste@gmail.com> - 2025-06-07 23:30 +0200
                Re: apt-cacher-ng (Was Re: New contributor experience) Peter Pentchev <roam@ringlet.net> - 2025-06-08 03:40 +0200
            Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-04 18:20 +0200
              Re: New contributor experience Russ Allbery <rra@debian.org> - 2025-06-04 18:30 +0200
                Re: New contributor experience Ahmad Khalifa <ahmad@khalifa.ws> - 2025-06-04 19:20 +0200
                Re: New contributor experience Russ Allbery <rra@debian.org> - 2025-06-04 19:50 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-04 21:00 +0200
                Re: New contributor experience Holger Levsen <holger@layer-acht.org> - 2025-06-05 13:30 +0200
                Re: New contributor experience Soren Stoutner <soren@debian.org> - 2025-06-05 17:50 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-05 18:00 +0200
                Re: New contributor experience James McCoy <jamessan@debian.org> - 2025-06-05 20:20 +0200
                Re: New contributor experience "Theodore Ts'o" <tytso@mit.edu> - 2025-06-14 16:20 +0200
                Re: New contributor experience IOhannes m zmölnig <umlaeute@debian.org> - 2025-06-14 19:30 +0200
                Re: New contributor experience IOhannes m zmölnig <umlaeute@debian.org> - 2025-06-14 20:40 +0200
                Re: New contributor experience "Theodore Ts'o" <tytso@mit.edu> - 2025-06-16 23:50 +0200
                Re: New contributor experience "Theodore Ts'o" <tytso@mit.edu> - 2025-06-17 00:10 +0200
                Re: New contributor experience Otto Kekäläinen <otto@debian.org> - 2025-06-17 08:00 +0200
                Re: New contributor experience "Theodore Ts'o" <tytso@mit.edu> - 2025-06-17 14:10 +0200
                Re: New contributor experience Otto Kekäläinen <otto@debian.org> - 2025-06-17 19:00 +0200
                Re: New contributor experience Russ Allbery <rra@debian.org> - 2025-06-17 19:20 +0200
                Re: New contributor experience Otto Kekäläinen <otto@debian.org> - 2025-06-17 19:40 +0200
                Re: New contributor experience Russ Allbery <rra@debian.org> - 2025-06-17 20:40 +0200
                Re: New contributor experience Otto Kekäläinen <otto@debian.org> - 2025-06-17 22:00 +0200
                Re: New contributor experience Phil Wyett <philip.wyett@kathenas.org> - 2025-06-18 12:40 +0200
                Re: New contributor experience Alex <alex@puer-robustus.eu> - 2025-06-20 16:20 +0200
                Re: New contributor experience Phil Wyett <philip.wyett@kathenas.org> - 2025-06-20 16:20 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-20 16:40 +0200
                Re: New contributor experience Phil Wyett <philip.wyett@kathenas.org> - 2025-06-20 19:10 +0200
                Re: New contributor experience Alex <alex@puer-robustus.eu> - 2025-06-21 21:00 +0200
                Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-21 22:40 +0200
                Re: New contributor experience Alex <alex@puer-robustus.eu> - 2025-06-21 23:40 +0200
                Re: New contributor experience Mechtilde Stehmann <mechtilde@debian.org> - 2025-06-22 08:30 +0200
                Re: New contributor experience Andreas Tille <andreas@an3as.eu> - 2025-06-24 22:20 +0200
                Re: New contributor experience Jeremy Stanley <fungi@yuggoth.org> - 2025-06-17 23:10 +0200
                Re: New contributor experience Otto Kekäläinen <otto@debian.org> - 2025-06-17 23:20 +0200
                Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-18 12:30 +0200
                Re: New contributor experience "Andrea Pappacoda" <tachi@debian.org> - 2025-06-18 11:40 +0200
                Re: New contributor experience "Theodore Ts'o" <tytso@mit.edu> - 2025-06-17 20:40 +0200
                Re: New contributor experience Otto Kekäläinen <otto@debian.org> - 2025-06-17 22:20 +0200
                Re: New contributor experience Soren Stoutner <soren@debian.org> - 2025-06-17 22:50 +0200
                Re: New contributor experience Jeremy Stanley <fungi@yuggoth.org> - 2025-06-17 23:20 +0200
                Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-18 12:40 +0200
                Re: New contributor experience IOhannes m zmölnig <umlaeute@debian.org> - 2025-06-18 14:50 +0200
                Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-18 15:00 +0200
                Re: New contributor experience Simon McVittie <smcv@debian.org> - 2025-06-18 15:40 +0200
                Re: New contributor experience "Theodore Ts'o" <tytso@mit.edu> - 2025-06-18 16:20 +0200
                Re: New contributor experience Colin Watson <cjwatson@debian.org> - 2025-06-18 16:30 +0200
                Re: New contributor experience Soren Stoutner <soren@debian.org> - 2025-06-23 19:10 +0200
                Re: New contributor experience "Theodore Ts'o" <tytso@mit.edu> - 2025-06-18 02:30 +0200
                Re: New contributor experience "Theodore Ts'o" <tytso@mit.edu> - 2025-06-18 05:50 +0200
                Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-18 12:40 +0200
                Let's make it visible when a package has no maintainer scripts (Re:  New contributor experience) Charles Plessy <plessy@debian.org> - 2025-06-18 02:40 +0200
              Re: New contributor experience Joachim Zobel <jzobel@heute-morgen.de> - 2025-06-04 18:40 +0200
                Re: New contributor experience Marc Haber <mh+debian-devel@zugschlus.de> - 2025-06-04 21:30 +0200
    Re: New contributor experience Julien Plissonneau Duquène <sre4ever@free.fr> - 2025-06-04 13:30 +0200
      Re: New contributor experience Andrey Rakhmatullin <wrar@debian.org> - 2025-06-04 13:50 +0200

csiph-web