[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20201007191856.2v7cpinvpzsmzuiw@yuggoth.org>
Date: Wed, 7 Oct 2020 19:18:56 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: Re: Debian FEATURE: /home/loser is with permissions
755, default umask 0022
On 2020-10-07 21:00:35 +0300 (+0300), Georgi Guninski wrote:
> https://lists.debian.org/debian-security/2020/10/msg00000.html
>
> ===
> /home/loser is with permissions 755, default umask 0022
>
> on multiuser machines this sucks much.
>
> on a multiuser debian mirror we found a lot of data,
> including the wordpress password of the admin.
> ===
It's tradition that on multi-user systems, users would want to share
data with one another and also serve content from their home
directories in Web sites. Further, it's not at all uncommon for
sysadmins to not understand or consider the system defaults when
making deployment decisions and failing to secure sensitive files.
As a long-time Debian user myself, I agree that this default is
showing its age, and can represent a risk for operators who overlook
it.
> Then in the thread someone with @debian.org email explains
> to me it is a feature, not a bug.
Nowhere in that response do they call it a feature, and it's
disingenuous of you to imply that they did. It's a default, which is
almost always going to be a balance between two (or more) competing
needs. Also, I encourage you to take a guess at how many people
there are "with @debian.org email" (hint, it's not a small number).
A more informative response would probably have been to point you to
https://wiki.debian.org/Debate/umask which provides pointers to
where and how this would need to be solved in the long run.
> In a addition, they suggest to tell them the mirror, lol.
Yes, do you fault them for wanting to remove a likely compromised
server from the network of volunteer-run package mirrors?
> Are debian detached from reality?
Your brusque and insulting attitude (saying their choices suck,
calling them detached from reality, laughing at their explanations)
is likely to trigger glib responses and cause people to be less
inclined to pay attention to what you have to say.
--
Jeremy Stanley
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
