Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.project > #12540

Concerns about how the Security information is presented on Debian.org

Show all headers | View raw

Hello

Let me first say that while my message is critical, Debian is my favorite Linux distro, and I've used many over many years. The goal of this post is to improve the way the security information is communicated on debian.org, which I believe is misleading.

security.debian.org starts off with "Debian takes security very seriously. " and goes on about how great Debian's security is. It stops short of explicitly claiming that Debian provides all security updates for all packages included in the distribution, but it implies these things. A casual user, with no particular background in security, will come away not realizing the limitations, of which I'd like to point out two:

1. The vast majority of security vulnerabilities discovered in upstream code are quietly fixed and never get written up as CVEs, so they don't even come up on the radar (1)

2. Debian is too understaffed to backport even the CVEs in widely used and security-critical packages like Chromium -- security-tracker.debian.org is showing it to be several months behind on the fixes.

This is something the users deserve to know. Hiding this information from the users is in direct violation of the DSC (I know the security tracker exists, but who's going to look at it after reading what amounts to "we  got your back, buddy! nothing to worry about".

Morality aside, I think that if more Debian users were aware of the truth, they'd lobby for a rolling Debian release (Debian Unstable is kind of like that, but not really)

(1) See for example https://arxiv.org/abs/2105.14565


-- 
Sent with https://mailfence.com  
Secure and private email

Back to linux.debian.project | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Concerns about how the Security information is presented on Debian.org Max WillB <maxwillb@mailfence.com> - 2021-12-17 08:00 +0100
  Re: Concerns about how the Security information is presented on Debian.org Max WillB <maxwillb@mailfence.com> - 2021-12-17 22:20 +0100
  Re: Concerns about how the Security information is presented on Debian.org Davide Prina <davide.prina@gmail.com> - 2021-12-18 12:10 +0100
    Re: Concerns about how the Security information is presented on Debian.org Max WillB <maxwillb@mailfence.com> - 2021-12-19 17:50 +0100
      Re: Concerns about how the Security information is presented on Debian.org Agata Erminia Pennisi <agataerminiapennisi@gmail.com> - 2021-12-19 20:20 +0100
      Re: Concerns about how the Security information is presented on Debian.org "Andrew M.A. Cater" <amacater@einval.com> - 2021-12-19 20:20 +0100
        Re: Concerns about how the Security information is presented on Debian.org Max WillB <maxwillb@mailfence.com> - 2021-12-20 00:50 +0100
          Re: Concerns about how the Security information is presented on Debian.org Diederik de Haas <didi.debian@cknow.org> - 2021-12-20 16:50 +0100
            Re: Concerns about how the Security information is presented on Debian.org Max WillB <maxwillb@mailfence.com> - 2021-12-21 20:10 +0100
          Re: Concerns about how the Security information is presented on Debian.org Max WillB <maxwillb@mailfence.com> - 2021-12-21 22:50 +0100
            Re: Concerns about how the Security information is presented on Debian.org Agata Erminia Pennisi <agataerminiapennisi@gmail.com> - 2021-12-22 03:40 +0100
              Re: Concerns about how the Security information is presented on Debian.org Andrey Rahmatullin <wrar@debian.org> - 2021-12-22 09:00 +0100
                Re: Concerns about how the Security information is presented on Debian.org Agata Erminia Pennisi <agataerminiapennisi@gmail.com> - 2021-12-22 10:30 +0100
                Re: Concerns about how the Security information is presented on Debian.org Andrey Rahmatullin <wrar@debian.org> - 2021-12-22 11:30 +0100

csiph-web