Date: Wed, 22 May 2002 00:32:45 -0400 From: Pete Fritchman <petef@databits.net> To: "Andrey A. Chernov" <ache@nagual.pp.ru> Cc: Kris Kennaway <kris@obsecurity.org>, cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: ports/security/drweb Makefile distinfo ports/security/drweb/files patch-aa patch-ab Message-ID: <20020522003245.F579@databits.net> In-Reply-To: <20020522021445.GA92135@nagual.pp.ru>; from ache@nagual.pp.ru on Wed, May 22, 2002 at 06:14:45AM %2B0400 References: <200205211516.g4LFGeo82331@freefall.freebsd.org> <20020521151814.F31955@xor.obsecurity.org> <20020521235911.GA91185@nagual.pp.ru> <20020521173029.A36618@xor.obsecurity.org> <20020522021445.GA92135@nagual.pp.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
++ 22/05/02 06:14 +0400 - Andrey A. Chernov: | On Tue, May 21, 2002 at 17:30:29 -0700, Kris Kennaway wrote: | | > Yes; it's a rule we apply to all ports committers. Please see | > | > http://www.freebsd.org/doc/en_US.ISO8859-1/articles/committers-guide/ports.html#Q10.4.4. | | I disagree with that. It seems this rule mix porter and security officer | tasks. As porter what I do I port application. As porter, I already check | that "distfile has not been corrupted". But it is security officer, who | must find out, if distfile is "maliciously altered", comparing differences | at whole and analyzing code with debugger, especially for _binary_ port | like drweb! It is security officer who must educate developer to not | re-roll their distfiles like written: "otherwise the author or maintainer | should be contacted to find out why the distfile has changed." You think the security officers is going to look at *EVERY* change themselves? As a porter, you should *care* if your port is secure... | > It's not a very demanding requirement; just do a diff -ruN and inspect | > the changes visually. If the changes are significant then just note | > as such. The main thing you're looking for are changes which were | > inserted into the distfile maliciously. | | The changes are: | | drweb: | Binary daemon changed. | Config files changed. | | drweb-sendmail: | *.o *.a removed | Config files changed. | | It is what I find out during the porting. I have no time and energy to | detalize it more and I am not sure even that this list is complete! So, next time could you just say "the binary daemon changed [a minor change to <whatever>], the default configs were updated, *.{o,a} files were removed." Reading a diff really isn't that hard... --pete -- Pete Fritchman [petef@(databits.net|freebsd.org|csh.rit.edu)] finger petef@databits.net for PGP key To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020522003245.F579>