From owner-freebsd-security@freebsd.org Thu May 5 15:13:26 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id BCC71B2D6A8 for ; Thu, 5 May 2016 15:13:26 +0000 (UTC) (envelope-from kaduk@mit.edu) Received: from dmz-mailsec-scanner-8.mit.edu (dmz-mailsec-scanner-8.mit.edu [18.7.68.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 64AB41897 for ; Thu, 5 May 2016 15:13:26 +0000 (UTC) (envelope-from kaduk@mit.edu) X-AuditID: 12074425-c6bff70000005f72-41-572b61d12601 Received: from mailhub-auth-2.mit.edu ( [18.7.62.36]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id E0.19.24434.1D16B275; Thu, 5 May 2016 11:08:02 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-2.mit.edu (8.13.8/8.9.2) with ESMTP id u45F81mu029099; Thu, 5 May 2016 11:08:01 -0400 Received: from multics.mit.edu (system-low-sipb.mit.edu [18.187.2.37]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id u45F7uFW031555 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Thu, 5 May 2016 11:07:59 -0400 Received: (from kaduk@localhost) by multics.mit.edu (8.12.9.20060308) id u45F7uX4026936; Thu, 5 May 2016 11:07:56 -0400 (EDT) Date: Thu, 5 May 2016 11:07:56 -0400 (EDT) From: Benjamin Kaduk To: "Julian H. Stacey" cc: freebsd-security@freebsd.org Subject: Re: Batching errata & advisories in heaps degrades security. In-Reply-To: <201605051500.u45Exqdt084086@fire.js.berklix.net> Message-ID: References: <201605051500.u45Exqdt084086@fire.js.berklix.net> User-Agent: Alpine 1.10 (GSO 962 2008-03-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrPIsWRmVeSWpSXmKPExsUixG6nonspUTvcYOU6RoueTU/YLPasfcPu wOTx78YxNo8Zn+azBDBFcdmkpOZklqUW6dslcGUsO9vBUnCJr6Jh2S2mBsZj3F2MnBwSAiYS OxceZepi5OIQEmhjkvh3/g4jhLOBUWLy3assEM5BJokTDxeygrQICdRLbP47h7mLkYODRUBL Yt+FapAwm4CKxMw3G9lAbBEBDYlXhx6B2cwCChLvH59kArGFBVwlbp9pYgaxOQXsJOadbmUH sXkFHCXu3FzAAjJSSMBW4sYfI5CwqICOxOr9U1ggSgQlTs58wgIxUkti+fRtLBMYBWYhSc1C klrAyLSKUTYlt0o3NzEzpzg1Wbc4OTEvL7VI10IvN7NELzWldBMjOBxdVHcwzvnrdYhRgINR iYf3wHytcCHWxLLiytxDjJIcTEqivNuVtMOF+JLyUyozEosz4otKc1KLDzFKcDArifBWxwLl eFMSK6tSi/JhUtIcLErivIwMDAxCAumJJanZqakFqUUwWRkODiUJ3snAuBMSLEpNT61Iy8wp QUgzcXCCDOcBGj4RpIa3uCAxtzgzHSJ/ilFRSpw3Jx4oIQCSyCjNg+sFp4vdTKqvGMWBXhHm 3ZYAVMUDTDVw3a+ABjMBDX4/VxNkcEkiQkqqgVFIVrCwYX9WX0Ki+vt9D2oE5HmYFU82iG+Y Mf/in1t3Nt1gP7jghbzfvtbJDcmXd2xWL+o7vOO/6otrPX/jzDJ7T/e45bsfs+wrcV8UxF1Q tkSTQbP9YdVsPcsjT6X2f319SWVJ3SquvdnPfVir5c+tm3XT4f/2j9Fmjx+c2dA48+DXDoP9 hXZKLMUZiYZazEXFiQCT2s6h8gIAAA== X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 May 2016 15:13:26 -0000 On Thu, 5 May 2016, Julian H. Stacey wrote: > Another bunch of Security alerts, degrades FreeBSD by being clumped together: > > I guess many recipients get tired of recent indigestable batches of > multiple FreeBSD Errata & think approx: I cannot recall whether you were participating in the discussion the last time this topic came up. Regardless, it feels like it was somewhat recent (a year or so). > _Why_ have they been artificially batching in last years ? > I could spare time to interrupt work for one priority alert, > Not for a heap batched seconds apart ! _Why_ ?! > I have no time now to action all this heap ! Maybe later ... > ( & meanwhile security @ FreeBSD could complacently think: > "We published all 4, if you don't immediately find time to > secure all 4 & someone abuses you, don't blame us !" ) > Are they batched in delusion it will help FreeBSD public relations, > to not scare people with too many days with FreeBSD alerts ? > Batching _Degrades_ security. It is bad over-management, > FreeBSD was better previously without batching, publishing each > problem when analysed, Not held back for batching. As a member of the security team for two projects (not FreeBSD's, though), I can say that it is a lot of behind-the-scenes work to put out advisories, and batching them reduces the unit cost of any given one. I further note that this recent batch that you are complaining about, contained only one security advisory and three errata notices; the contents of the errata notices have been public for quite some time, and affected parties welcome to upgrade at their leisure [manually, without freebsd-update, of course]. We can perhaps agree to disagree about whether the batching is good, but I do not see much value in rehashing the same arguments periodically. -Ben