Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5984 > unrolled thread

replacing misleading debian.org/security claims

Back to article view | Back to linux.debian.security

Contents

  replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2021-12-30 10:10 +0100
    Re: replacing misleading debian.org/security claims Silas Cutler <Silas@BlackLab.io> - 2021-12-30 17:20 +0100
      Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
    Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
      Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-10 01:50 +0100
      Incorrect NVD severity ratings: (was: replacing misleading  debian.org/security claims) max  <maxwillb@mailfence.com> - 2022-01-10 02:00 +0100
      Re: replacing misleading debian.org/security claims Salvatore Bonaccorso <carnil@debian.org> - 2022-01-10 06:40 +0100
        Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-14 00:40 +0100
          Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-14 23:50 +0100
            Re: replacing misleading debian.org/security claims Robert Ricardo Ikaka <ikaka.robert.online@gmail.com> - 2022-01-15 04:30 +0100
            Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-18 05:50 +0100
              Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-18 23:40 +0100
                Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-20 23:00 +0100
                  Re: replacing misleading debian.org/security claims RP <reyadmin@gmail.com> - 2022-01-21 02:20 +0100
                  Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-21 12:00 +0100

#5984 — replacing misleading debian.org/security claims

Some statements on debian.org/security are inaccurate, and many people are misled by them.

I propose replacing

"""
Debian takes security very seriously. We handle all security problems brought to our attention and ensure that they are corrected within a reasonable timeframe.
"""

with something more factual, like

"""
Debian's security updates are created by volunteers working in their spare time. Some packages may receive more attention than others. To view the current list of known unfixed vulnerabilities see https://security-tracker.debian.org/tracker/status/release/stable
"""

(Side note: It seems that NVD tends to assign "medium" severity to vulnerabilities initially, but upgrades them to "high" or "critical" later. However, Debian keeps showing the initial severity rating)

-- 
Sent with https://mailfence.com  
Secure and private email

[toc] | [next] | [standalone]

#5985

[Multipart message — attachments visible in raw view] — view raw

Hi Max -

(First time poster (?Maybe) / long time lurker).

I think highlighting that Debian is supported by volunteers is important 
and providing up front a link to tracker is outstanding.  The "we take 
security seriously" text is dated consistent with standard boiler-plate 
text.

I'd also like to see information on both how to submit vulnerabilities 
as well as how to contribute to getting them fixed.

Thanks,
Silas




On 12/28/21 1:46 PM, max wrote:
> Some statements on debian.org/security are inaccurate, and many people are misled by them.
> 
> I propose replacing
> 
> """
> Debian takes security very seriously. We handle all security problems brought to our attention and ensure that they are corrected within a reasonable timeframe.
> """
> 
> with something more factual, like
> 
> """
> Debian's security updates are created by volunteers working in their spare time. Some packages may receive more attention than others. To view the current list of known unfixed vulnerabilities see https://security-tracker.debian.org/tracker/status/release/stable
> """
> 
> (Side note: It seems that NVD tends to assign "medium" severity to vulnerabilities initially, but upgrades them to "high" or "critical" later. However, Debian keeps showing the initial severity rating)
> 

-- 
Silas Cutler (Silas@BlackLab.io)
PGP Fingerprint (598A 812E FB8C BA19 69A5 D17A C14D A520 A02E 8CD6)

[toc] | [prev] | [next] | [standalone]

#5988

[Multipart message — attachments visible in raw view] — view raw

On Thu, 2021-12-30 at 11:04 -0500, Silas Cutler wrote:

> I'd also like to see information on both how to submit
> vulnerabilities as well as how to contribute to getting them fixed.

These are addressed in the FAQ:

https://www.debian.org/security/faq#discover
https://www.debian.org/security/faq#help
https://www.debian.org/security/faq#care

They refer to the developers reference and security tracker docs:

https://www.debian.org/doc/developers-reference/pkgs.html#bug-security
https://security-tracker.debian.org/tracker/data/report

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#5987

[Multipart message — attachments visible in raw view] — view raw

On Tue, 2021-12-28 at 19:46 +0100, max wrote:

> Debian's security updates are created by volunteers working in their
> spare time. Some packages may receive more attention than others. To
> view the current list of known unfixed vulnerabilities see
> https://security-tracker.debian.org/tracker/status/release/stable

This isn't entirely factual either. The LTS team is mostly composed of
people being paid to contribute, with some volunteers. Some of the
stable security team may also be paid, but there isn't any public
information about who is paid and who they work for.

https://wiki.debian.org/LTS/Team
https://wiki.debian.org/LTS/Funding

I suggest contacting the stable and LTS security teams to draft a
statement that best represents the current and future reality of Debian
security updates.

https://www.debian.org/security/faq#contact
https://wiki.debian.org/LTS#Get_in_contact
https://wiki.debian.org/LTS/Contact

> (Side note: It seems that NVD tends to assign "medium" severity to
> vulnerabilities initially, but upgrades them to "high" or "critical"
> later. However, Debian keeps showing the initial severity rating)

Please send a patch, issue or mail about that separately.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#5989

(Added: CC:  security@debian.org as requested. Please see the mailing list archive if you need context)

January 5, 2022 7:20:46 AM CET Paul Wise <pabs@debian.org> wrote:

> This isn't entirely factual either. 

How about this (added "largely"):

"""
Debian's security updates are largely created by volunteers working in their
spare time. Some packages may receive more attention than others. To
view the current list of known unfixed vulnerabilities see
https://security-tracker.debian.org/tracker/status/release/stable
"""

> Please send a patch, issue or mail about that separately.

OK

-- 
Sent with https://mailfence.com  
Secure and private email

[toc] | [prev] | [next] | [standalone]

#5990 — Incorrect NVD severity ratings: (was: replacing misleading debian.org/security claims)

January 5, 2022 7:20:46 AM CET Paul Wise <pabs@debian.org> wrote:

> Please send a patch, issue or mail about that separately.

Please see below:


The security tracker is listing incorrect NVD severity ratings. It looks like NVD tends to assign "medium" severity and later upgrades them, while Debian doesn't.

For example, see

https://security-tracker.debian.org/tracker/CVE-2021-30579
https://security-tracker.debian.org/tracker/CVE-2021-37973

that show "medium" severity, but are actually rated "critical" and "high" by NVD.

-- 
Sent with https://mailfence.com  
Secure and private email

[toc] | [prev] | [next] | [standalone]

#5991

Hi,

On Wed, Jan 05, 2022 at 02:20:46PM +0800, Paul Wise wrote:
> > (Side note: It seems that NVD tends to assign "medium" severity to
> > vulnerabilities initially, but upgrades them to "high" or "critical"
> > later. However, Debian keeps showing the initial severity rating)
> 
> Please send a patch, issue or mail about that separately.

We are going to stop anyway at some point displaying the NVD severity,
for context see #992115.

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#5992

January 10, 2022 6:31:37 AM CET Salvatore Bonaccorso <carnil@debian.org> wrote:

> We are going to stop anyway at some point displaying the NVD severity, for context see #992115.

As I see it, Debian should be free to display or not display NVD ratings, but it shouldn't display the incorrect "medium" NVD ratings, when they are actually much worse, as it's been doing. In fact, I think it should issue a public retraction.

Any progress on my original proposal? Are the wheels in motion?

https://lists.debian.org/debian-security/2021/12/msg00002.html
https://lists.debian.org/debian-security/2022/01/msg00002.html

I can't help but feel that it's a 15 second job for anyone with write access to the site, and the reprehensibility of the current claims should be obvious to those with a working moral compass.

-- 
Sent with https://mailfence.com  
Secure and private email

[toc] | [prev] | [next] | [standalone]

#5993

max  <maxwillb@mailfence.com> wrote on 14/01/2022 at 00:38:44+0100:

> January 10, 2022 6:31:37 AM CET Salvatore Bonaccorso <carnil@debian.org> wrote:
>
>> We are going to stop anyway at some point displaying the NVD severity, for context see #992115.
>
> As I see it, Debian should be free to display or not display NVD
> ratings, but it shouldn't display the incorrect "medium" NVD ratings,
> when they are actually much worse, as it's been doing. In fact, I
> think it should issue a public retraction.
>
> Any progress on my original proposal? Are the wheels in motion?
>
> https://lists.debian.org/debian-security/2021/12/msg00002.html
> https://lists.debian.org/debian-security/2022/01/msg00002.html
>
> I can't help but feel that it's a 15 second job for anyone with write
> access to the site, and the reprehensibility of the current claims
> should be obvious to those with a working moral compass.

Maybe at some time you could just stop keeping on insisting on that
matter?

Regards,
-- 
PEB

[toc] | [prev] | [next] | [standalone]

#5994

[Multipart message — attachments visible in raw view] — view raw

https://chng.it/jJvMChbdsJ

сб, 15 янв. 2022 г., 01:45 Pierre-Elliott Bécue <peb@debian.org>:

>
> max  <maxwillb@mailfence.com> wrote on 14/01/2022 at 00:38:44+0100:
>
> > January 10, 2022 6:31:37 AM CET Salvatore Bonaccorso <carnil@debian.org>
> wrote:
> >
> >> We are going to stop anyway at some point displaying the NVD severity,
> for context see #992115.
> >
> > As I see it, Debian should be free to display or not display NVD
> > ratings, but it shouldn't display the incorrect "medium" NVD ratings,
> > when they are actually much worse, as it's been doing. In fact, I
> > think it should issue a public retraction.
> >
> > Any progress on my original proposal? Are the wheels in motion?
> >
> > https://lists.debian.org/debian-security/2021/12/msg00002.html
> > https://lists.debian.org/debian-security/2022/01/msg00002.html
> >
> > I can't help but feel that it's a 15 second job for anyone with write
> > access to the site, and the reprehensibility of the current claims
> > should be obvious to those with a working moral compass.
>
> Maybe at some time you could just stop keeping on insisting on that
> matter?
>
> Regards,
> --
> PEB
>
>

[toc] | [prev] | [next] | [standalone]

#5999

January 14, 2022 11:44:39 PM CET "Pierre-Elliott Bécue" <peb@debian.org> wrote:

> Maybe at some time you could just stop keeping on insisting on that
matter?

I thought this was just an oversight, but since this is intentional, it isn't. How can you possibly justify and continue such a flagrant misrepresentation?


"""
We handle all security problems brought to our attention and ensure that
they are corrected within a reasonable timeframe. Many advisories are 
coordinated with other free software vendors and are published the same day 
a vulnerability is made public and we also have a Security Audit team that 
reviews the archive looking for new or unfixed security bugs.
"""


Half a year is not "within a day", or "a reasonable timeframe".

Mislabeling "critical" NVD ratings as "medium" fits the same pattern.

-- 
Sent with https://mailfence.com  
Secure and private email

[toc] | [prev] | [next] | [standalone]

#6000

[Multipart message — attachments visible in raw view] — view raw

max  <maxwillb@mailfence.com> wrote on 18/01/2022 at 05:46:10+0100:

> January 14, 2022 11:44:39 PM CET "Pierre-Elliott Bécue" <peb@debian.org> wrote:
>
>> Maybe at some time you could just stop keeping on insisting on that
>> matter?
>
> I thought this was just an oversight, but since this is intentional,
> it isn't. How can you possibly justify and continue such a flagrant
> misrepresentation?
>
>
> """
> We handle all security problems brought to our attention and ensure that
> they are corrected within a reasonable timeframe. Many advisories are 
> coordinated with other free software vendors and are published the same day 
> a vulnerability is made public and we also have a Security Audit team that 
> reviews the archive looking for new or unfixed security bugs.
> """
>
>
> Half a year is not "within a day", or "a reasonable timeframe".
>
> Mislabeling "critical" NVD ratings as "medium" fits the same pattern.

Your behaviour could be seen as aggressive.

If you keep going on, there is a high chance that everybody will start
ignoring you, or, if you keep being pushy, ask that you are temporarily
prevented to mail debian lists.

You'll therefore not obtain the expected result, and people will start
ignoring you.

You got a reply from Salvatore and this is quite enough for now.

-- 
PEB

[toc] | [prev] | [next] | [standalone]

#6001

January 18, 2022 11:28:48 PM CET "Pierre-Elliott Bécue" <peb@debian.org> wrote:

> if you keep being pushy, ask that you are temporarily prevented to mail debian lists

You didn't actually reply to my question addressed to you. All you did was publicly threaten me (and thus anyone else who might be interested in discussing this issue) with a ban. That's some shameful stuff.

And yes, if it looks like I stopped posting, it means that I was banned.

-- 
Sent with https://mailfence.com  
Secure and private email

[toc] | [prev] | [next] | [standalone]

#6002

I

On 1/20/22 13:51, max wrote:
> January 18, 2022 11:28:48 PM CET "Pierre-Elliott Bécue" <peb@debian.org> wrote:
>
>> if you keep being pushy, ask that you are temporarily prevented to mail debian lists
> You didn't actually reply to my question addressed to you. All you did was publicly threaten me (and thus anyone else who might be interested in discussing this issue) with a ban. That's some shameful stuff.
>
> And yes, if it looks like I stopped posting, it means that I was banned.
If you want things changed, you gotta do the work.  Be a developer, join 
the group and then vote.  Anything else is just annoying.

[toc] | [prev] | [next] | [standalone]

#6003

[Multipart message — attachments visible in raw view] — view raw

max  <maxwillb@mailfence.com> wrote on 20/01/2022 at 22:51:24+0100:

> January 18, 2022 11:28:48 PM CET "Pierre-Elliott Bécue" <peb@debian.org> wrote:
>
>> if you keep being pushy, ask that you are temporarily prevented to
>> mail debian lists
>
> You didn't actually reply to my question addressed to you.

That's true. The reason is that I have no intent to reply to your
question addressed to me.

Essentially because of your behaviour, but also because I am not part of
the Security Team.

> All you did was publicly threaten me […] with a ban.

I also told you that your actions could be perceived as aggressive (and
the more things go on, the more I'm convinced that it could be more than
a subjective feeling), but it seems you decided to ignore that point.

> (and thus anyone else who might be interested in discussing this
> issue)

Where I live, we usually call this kind of reasoning a sophism. I don't
think that I need to elaborate on this.

> That's some shameful stuff.

Thanks for sharing your opinion on this. In order to spare both of us
some time, let's agree to disagree.

> And yes, if it looks like I stopped posting, it means that I was banned.

If that were to happen, then it would mean a listmaster read what you
said and considered your behaviour was against the Debian Lists
Policy/Code of Conduct/Standard (call it whatever you like), and
therefore it would be quite normal.

Instead of grinding some axe for an unknown reason, and being semi
spamming about that topic (which is quite unimportant, to be fair) for
the last month, feel free to contribute, or, if you don't want to, then
go do something else.

Apart from being annoying, you are achieving nothing here, and we all
have better things to do.

Regards,

-- 
Pierre-Elliott Bécue

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web