Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #6157 > unrolled thread

Re:Re: Concerns about Security of packages in Debain OS and the Operating system itself.

Back to article view | Back to linux.debian.security

Contents

  Re:Re: Concerns about Security of packages in Debain OS and the  Operating system itself. Ravi Dwivedi <ravi@ravidwivedi.in> - 2022-06-29 15:10 +0200
    Re: Re: Concerns about Security of packages in Debain OS and the  Operating system itself. lkcl <luke.leighton@gmail.com> - 2022-06-29 16:20 +0200

#6157 — Re:Re: Concerns about Security of packages in Debain OS and the Operating system itself.

Since the below mentioned analysis of Debian's security, and that too 
compared to other distros, is not very well-known outside of Debian 
project(it didn't come up in any internet searches, the web of trust 
gets mentioned but there is not much explanation on it), I suggest 
writing in somewhere in Debian wiki or blog post.

I am willing to write that as well if the Debian project does not have 
any problems.

 > i believe the answer is in the question. debian is based on 
distributed trust.  i did the analysis (took 3 weeks): it is literally 
the only distro in the world with an inviolate chain of trust from a 
large keyring dating back 20 years that is itself GPG-signed as a 
package, with a package distribution chain from source where all 
components within the chain up to release are unbroken and inviolate.

 > take ubuntu for example: whilst it has the exact same technology the 
size of the developer pool, comprising the web of trust, is both much 
smaller and also controlled by one Corporation: Canonical. Canonical 
says "jump", the developers ask "how high".

 > take Suse, Fedora etc: their RPM packages break the chain of trust by 
failing to properly include a GPG Signature of the Release (i do not 
recall the exact details, i did the analysis 4 years ago)

 > take Archlinux: their community is vulnerable to unverified github 
repositories being abandoned, a hacker re-registering them, and a trojan 
uploaded and distributed automatically.

 > i won't even bother going into the absolute moronic practice of 
"trusting" HTTPS: node, pypi, etc should be blindingly obviously 
untrustworthy, with the website being a prime hacking target if nothing 
else.

 > even GNU packages are hopelessly inadequately secure as far as social 
engineering and hacking are concerned.

 > debian is not a single centralised repository, it is controlled by 
no-one. you have to compromise hundreds of independent developers before 
you make any headway, and as a result it was trusted by e.g. the 
Venezuelan Government as the basis for their own distro, many years ago.

 > there is not even a centralised dependency on a website: packages may 
be securely distributed by Carrier Pigeon or printed out on paper and 
OCR scanned if you really want to because there is a full GPG Chain and 
Checksums, right back to the source code.

 > and that (GPG Chains) basically, is the key.  anyone stupid enough to 
do something stupid is going to be throwing away their reputation, not 
just within the debian project as a maintainer, but for life.

 > you abuse your position as a maintainer by putting in trojan code, 
because that trojan package had to be GPG Signed, you have to make a 
*public and irreversible declaration* which will remain in historical 
archives for the rest of your life and beyond.

 > this would result in catastrophic consequences for not just their 
involvement in debian (which would be terminated with prejudice), but 
because their GPG Signature on the trojan package is public, inviolate 
and irrevocable, it would also have catastrophic consequences for their 
career in IT because nobody would ever trust them in a position of 
responsibility, ever again. they'd be flipping burgers for the rest of 
their life.

 > fundamentally, then, you are assuming that there is "one controller 
of debian", which is false.  there are literally hundreds of 
*independent* developers, all of whom know their responsibility, all of 
whom know that they have all other independent developers keeping an eye 
on them.

 > this makes debian pretty much the only distro that could be trusted 
to remain true to humanity and to its principles and its charter. even 
when some of them (you know who you are) are when it comes down to it 
not very nice people, they can at least be trusted to do the right thing.
-- 
Ravi Dwivedi,
https://ravidwivedi.in
GPG Key Fingerprint
AFCA 169F 18B6 8814 ABE6 102A 5E9F 47BE 14DD 8BE6

[toc] | [next] | [standalone]

#6158

On Wed, Jun 29, 2022 at 1:46 PM Ravi Dwivedi <ravi@ravidwivedi.in> wrote:

> Since the below mentioned analysis of Debian's security, and that too
> compared to other distros, is not very well-known outside of Debian
> project

honestly i don't believe it's even widely known *in* the debian project
[quite how damn good what they have is, compared to everything else]

> (it didn't come up in any internet searches, the web of trust
> gets mentioned but there is not much explanation on it), I suggest
> writing in somewhere in Debian wiki or blog post.

my replies on this topic keep getting filtered. annoyingly.

http://lkcl.net/reports/wot/
http://lkcl.net/reports/wot/Makefile
http://lkcl.net/reports/wot/wot.tex
http://lkcl.net/reports/wot/wot.pdf

> I am willing to write that as well if the Debian project does not have
> any problems.

patches welcomed to the above (or links to it).

yes, debian has a "perception" problem.  there are plenty of complaints
"But It's Rubbish Because It's So Long To Releases" and the complainers
basically have f***-all knowledge of precisely *why* debian's is both resilient
and stable, or quite how much work went into making that happen.

but to be honest with NixOS developers *genuinely* believing both that
their distro is "secure" as well as "The World's First Reproducible Build
Distro", given that they had absolutely no idea that debian and fedora
both started the work on reproducible builds over 8 years ago,
https://archive.fosdem.org/2014/schedule/event/reproducibledebian/
without which NixOS couldn't even begin to make its incorrect claims, and
that the NixOS developers had never even seen the wiki page nor the build
graph, https://wiki.debian.org/ReproducibleBuilds
this indicates that there's a much bigger perception problem for debian
that goes way beyond just security and the web-of-trust.

how to fix that? honestly i have no idea.  should debian developers
even care, and just get on with what they do best? (serious question!)

l.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web