Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.project > #11642

Re: Salsa as authentication provider for Debian

From Enrico Zini <enrico@enricozini.org>
Newsgroups linux.debian.project
Subject Re: Salsa as authentication provider for Debian
Date 2020-04-10 09:50 +0200
Message-ID <zTWAi-4vF-3@gated-at.bofh.it> (permalink)
References <zSCkj-4An-3@gated-at.bofh.it> <zSCDD-4Wm-7@gated-at.bofh.it> <zSEYN-6gx-5@gated-at.bofh.it> <zSFUR-6Qk-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Mon, Apr 06, 2020 at 02:34:03PM -0500, Michael Lustfield wrote:

> I was previously involved with a company that audited various git-hosting
> services. I'm stuck behind a very strict (saw it brutally enforced) NDA, so
> please forgive the lack of specifics. Gitlab is a tool that gets many things
> right, and many things wrong. Access control is an area where I have seen some
> critical bugs. Some of those bugs lead me to not trust it as a non-internal
> authentication source.

I normally assume anything with a huge codebase to be full of holes, so
I'd say you haven't told me anything surprising.

The current sso.debian.org codebase has been written by one person (me),
deployed by one person (me), audited by nobody, and as far as I'm aware,
nobody besides me has ever read the code. I think that's a scarier
picture than Gitlab: at least Gitlab is somehow widely deployed, has
regular updates, and has people maintaining it in production and sending
patches, which gives it a limited amount of scrutiny.

I still claim introducing gitlab as OIDC provider is not going to make
matters /worse/, and, I repeat, that's the only claim I've been trying
to get validated here.

If you are concerned that Debian critical operations could be depending
on a single signon platform which does not have the track record of
security that we would like, then we're already dealing with that: the
whole world controlled by sso.debian.org is designed under the
assumption of not being secure enough.

You can't get sso.debian.org access with your Debian master password:
you need a web password instead, which does not give you access to the
rest of db.debian.org.

With a sso certificate, for example, you can't change your status in
Debian, you can't advocate a person, you can't AM approve, you can't DAM
approve, you can't upload packages, you can't vote, you can't read
debian-private, you can't gain shell access to debian.org machines: we
require a GPG signature from a key in the Debian keyring for all those
operations. That is not going to change.

If you or someone else eventually will manage to introduce a Single Sign
On system that would take us to a next step of being able to advocate
developers, take packaging actions, update the ssh key you use to access
debian.org machines, all via a web interface, I really look forward to
that!

That's not what we're trying to do here. We're not there now, and it's
not going to change with introducing Salsa as an OIDC provider.


Enrico

-- 
GPG key: 4096R/634F4BD1E7AD5568 2009-05-08 Enrico Zini <enrico@enricozini.org>

Back to linux.debian.project | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Salsa as authentication provider for Debian Bastian Blank <waldi@debian.org> - 2020-04-06 18:00 +0200
  Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-06 18:20 +0200
    Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-06 20:50 +0200
      Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-06 21:20 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 10:40 +0200
          Re: Salsa as authentication provider for Debian Geert Stappers <stappers@debian.org> - 2020-04-07 11:30 +0200
          Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 17:10 +0200
            Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 17:40 +0200
              Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 18:00 +0200
                Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-09 09:50 +0200
                Re: Salsa as authentication provider for Debian Michael Lustfield <michael@lustfield.net> - 2020-04-09 12:20 +0200
                Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-10 09:30 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-10 14:50 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-10 18:00 +0200
                Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-10 18:30 +0200
                Re: Salsa as authentication provider for Debian Russ Allbery <rra@debian.org> - 2020-04-10 19:30 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-10 20:20 +0200
                Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-10 22:10 +0200
                Re: Salsa as authentication provider for Debian Russ Allbery <rra@debian.org> - 2020-04-10 22:30 +0200
      Re: Salsa as authentication provider for Debian Michael Lustfield <michael@lustfield.net> - 2020-04-06 21:50 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-10 09:50 +0200
          Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-10 10:30 +0200
          Re: Salsa as authentication provider for Debian Felix Lechner <felix.lechner@lease-up.com> - 2020-04-10 21:50 +0200
            Re: Salsa as authentication provider for Debian kuLa <kula@kulisz.net> - 2020-04-11 08:30 +0200
            Re: Salsa as authentication provider for Debian Jonathan Carter <jcc@debian.org> - 2020-04-11 12:10 +0200
              Re: Salsa as authentication provider for Debian Michael Lustfield <michael@lustfield.net> - 2020-04-11 19:30 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <leader@debian.org> - 2020-04-11 20:20 +0200
    Re: Salsa as authentication provider for Debian Bastian Blank <waldi@debian.org> - 2020-04-07 10:40 +0200
      Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 17:30 +0200
        Re: Salsa as authentication provider for Debian Bastian Blank <waldi@debian.org> - 2020-04-10 12:20 +0200
          Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-10 19:10 +0200
  Re: Salsa as authentication provider for Debian Holger Levsen <holger@layer-acht.org> - 2020-04-06 21:00 +0200
  Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-07 12:40 +0200
    Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 14:10 +0200
      Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-07 14:40 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 15:30 +0200
          Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-07 15:40 +0200
            Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 16:10 +0200
              Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-07 16:30 +0200
                Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 17:50 +0200
      Re: Salsa as authentication provider for Debian Michael Lustfield <michael@lustfield.net> - 2020-04-07 16:30 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 17:00 +0200
    Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 17:40 +0200
      Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-08 22:30 +0200
  Re: Salsa as authentication provider for Debian Paul Wise <pabs@debian.org> - 2020-04-07 17:30 +0200
    Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-07 17:40 +0200
      Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-07 19:00 +0200
        Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-10 21:50 +0200
    Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 19:00 +0200
    Re: Salsa as authentication provider for Debian Bastian Blank <waldi@debian.org> - 2020-04-07 20:30 +0200
      Re: Salsa as authentication provider for Debian Paul Wise <pabs@debian.org> - 2020-04-08 08:00 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 11:40 +0200
  Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-08 12:30 +0200
    Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 18:00 +0200
    Re: Salsa as authentication provider for Debian Tollef Fog Heen <tfheen@err.no> - 2020-04-08 21:20 +0200
      Re: Salsa as authentication provider for Debian Steve McIntyre <93sam@debian.org> - 2020-04-08 21:40 +0200
      Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-09 09:30 +0200
        Re: Salsa as authentication provider for Debian Tollef Fog Heen <tfheen@err.no> - 2020-04-09 20:10 +0200
          Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-09 20:30 +0200
          Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-09 23:30 +0200
            Re: Salsa as authentication provider for Debian Tollef Fog Heen <tfheen@err.no> - 2020-04-12 10:40 +0200
              Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-12 18:50 +0200
                Re: Salsa as authentication provider for Debian Tollef Fog Heen <tfheen@err.no> - 2020-04-13 18:50 +0200
                Re: Salsa as authentication provider for Debian Pirate Praveen <praveen@onenetbeyond.org> - 2020-04-13 19:50 +0200
  Re: Salsa as authentication provider for Debian Shengjing Zhu <zhsj@debian.org> - 2020-04-08 14:00 +0200
    Re: Salsa as authentication provider for Debian Shengjing Zhu <zhsj@debian.org> - 2020-04-08 14:20 +0200
      Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 15:00 +0200
    Re: Salsa as authentication provider for Debian Ulrike Uhlig <ulrike@debian.org> - 2020-04-08 14:20 +0200
      Re: Salsa as authentication provider for Debian Shengjing Zhu <zhsj@debian.org> - 2020-04-08 14:30 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 15:30 +0200
          Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-08 16:10 +0200
            Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 16:30 +0200
          Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 18:10 +0200
            Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-09 10:10 +0200
      Re: Salsa as authentication provider for Debian Ole Streicher <olebole@debian.org> - 2020-04-08 14:40 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-10 21:50 +0200
    Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 14:20 +0200
    Re: Salsa as authentication provider for Debian Bastian Blank <waldi@debian.org> - 2020-04-08 14:40 +0200
      Re: Salsa as authentication provider for Debian Shengjing Zhu <zhsj@debian.org> - 2020-04-08 14:50 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 15:00 +0200
          Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-08 15:20 +0200
      Re: Salsa as authentication provider for Debian Julien Cristau <jcristau@debian.org> - 2020-04-10 21:50 +0200
        Re: Salsa as authentication provider for Debian Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-11 09:30 +0200
          Re: Salsa as authentication provider for Debian Julien Cristau <jcristau@debian.org> - 2020-04-11 19:30 +0200
            Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-11 20:10 +0200
            Re: Salsa as authentication provider for Debian Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 07:30 +0200
              Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-12 17:00 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-13 16:00 +0200
                Re: Salsa as authentication provider for Debian Peter Palfrader <weasel@debian.org> - 2020-04-13 21:00 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-13 21:30 +0200

csiph-web