Comments on: Security Flaws in Free Software

By: etbe

etbe — Fri, 23 May 2008 10:32:11 +0000

James: If upstream sees an email of the form user@debian.org then they could probably make the same assumption. The problem is that many DDs for a variety of reasons don’t want to use their @debian.org address. But even if an @debian.org address was used, it still wouldn’t necessarily solve all problems. It’s only really possible to know when a DD is just testing something and when they plan to include it in a release if they state it in their message.

By: James

James — Thu, 22 May 2008 16:46:11 +0000

I am not a DD and don’t really know what policies Debian already has in place. But from reading this blog maybe it is as simple as creating a “foo@dev.debian.org” address for DD’s that is unambiguously ONLY used in connection with official Debian work.

So when upstream sees an e-mail from joe@dev.debian.org they see an implicit signature line saying that this software will be used by millions of people and we need to get it right. (Or perhaps a not-so-implicit signature line.) An e-mail from joe@debian.org could be just trying to debug something and is playing around with non-production code.

See here — having a “dev.openssl.org” address might have prevented this confusion too:

“Ulf is actually not a “core” member, just a team member. I had used the term “core” in a slang manner based on the fact that Ulf has an official @openssl.org email address.”

By: etbe

etbe — Thu, 22 May 2008 05:56:59 +0000

Kurt: That’s interesting, thanks for the reference. In regard to hashing the PID to give different random numbers after a fork() (which seems pretty weak) it would also be possible to store the value of getpid() when the RNG is seeded and check it every time random numbers are produced, if it is discovered that the PID has changed between adding entropy and requesting a random number then it could add some new entropy from /dev/random or some other good source.

Kevin: There is a huge number of programs using random numbers, for a variety of purposes – some of which are important but many aren’t.

I don’t believe that it’s possible to have a Debian standard for mailing list communication with upstream. I can’t think of anything that could be added to the dev-ref or policy to help in this regard.

By: Kevin Mark

Kevin Mark — Wed, 21 May 2008 20:34:46 +0000

Are there any other program that use entropy or rely on RNG in Debian? Is there a best practice for using these? Should Debian include something in the dev-ref or Policy? There is talk of the difficulty of finding the correct ML. Debian prides itself with as much transparency in making such info available. Did openssl meet our standard in this regard? Do others? (mass bug filing?)

By: Kurt Roeckx

Kurt Roeckx — Wed, 21 May 2008 17:16:45 +0000

See also the thread starting at http://www.mail-archive.com/openssl-dev@openssl.org/msg23999.html