From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 50C1E138334 for ; Tue, 4 Dec 2018 22:06:03 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 311B8E0D82; Tue, 4 Dec 2018 22:06:02 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id F0BC5E0D7F for ; Tue, 4 Dec 2018 22:06:01 +0000 (UTC) Received: from [192.168.1.100] (c-98-218-46-55.hsd1.md.comcast.net [98.218.46.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: mjo) by smtp.gentoo.org (Postfix) with ESMTPSA id 82D5B335CD9 for ; Tue, 4 Dec 2018 22:06:00 +0000 (UTC) Subject: Re: [gentoo-project] Re: [pre-glep] Security Project Structure To: gentoo-project@lists.gentoo.org References: <6137e99b-2995-0569-9d3d-250924fdf116@gentoo.org> <1d3c9d30-5570-de92-3da9-75bd33c02075@gentoo.org> From: Michael Orlitzky Message-ID: <21194272-4039-e473-8f57-426021fb24b7@gentoo.org> Date: Tue, 4 Dec 2018 17:05:55 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.3.0 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Project discussion list X-BeenThere: gentoo-project@lists.gentoo.org Reply-To: gentoo-project@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 In-Reply-To: <1d3c9d30-5570-de92-3da9-75bd33c02075@gentoo.org> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Archives-Salt: f6c301f6-ace8-49de-867d-5e02d2b9c1e9 X-Archives-Hash: 1ade2f388e15b6ae5f000571cd4d6905 On 12/4/18 4:05 PM, Kristian Fiskerstrand wrote: > > I personally don't agree with part of this section; security is > relative, and if it is stated to not be supported there are no security > assumptions. If anything the removal of these arches as security > supported demonstrates an active decisions not to support them, and > signals to users of these arches that they can't depend on security > information from Gentoo. Stable generally means a stable tree of > dependencies, without security assumptions, if this is e.g used in a > closed lab that likely doesn't impact much. > This is technically correct, but: how many users even know what a security-supported arch is? I would guess zero, to a decimal point or two. Where would I encounter that information in my daily life? If I pick up any software system that's run by professionals and that has a dedicated security team, my out-of-the-box assumption is that there aren't any known, glaring, and totally fixable security vulnerabilities being quietly handed to me. Having a stable arch that isn't security-supported is a meta-fail... we have a system that fails open by giving people something that looks like it should be safe and then (when it bites them) saying "but you didn't read the fine print!" It should be the other way around: they should have to read the fine print before they can use those arches.