From owner-freebsd-security@FreeBSD.ORG  Fri Dec 26 20:08:35 2014
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id ADF95A24
 for <freebsd-security@freebsd.org>; Fri, 26 Dec 2014 20:08:35 +0000 (UTC)
Received: from mx5.roble.com (mx5.roble.com [206.40.34.5])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "mx5.roble.com", Issuer "mx5.roble.com" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id 9D3B364B72
 for <freebsd-security@freebsd.org>; Fri, 26 Dec 2014 20:08:35 +0000 (UTC)
Date: Fri, 26 Dec 2014 12:08:29 -0800 (PST)
From: Roger Marquis <marquis@roble.com>
To: freebsd-security@freebsd.org
Subject: Re: FreeBSD Security Advisory FreeBSD-SA-14:31.ntp
In-Reply-To: <868uhx43i5.fsf@nine.des.no>
References: <20141223233310.098C54BB6@nine.des.no>
 <86h9wln9nw.fsf@nine.des.no> <549A5492.6000503@grosbein.net>
 <868uhx43i5.fsf@nine.des.no>
User-Agent: Alpine 2.00 (BSF 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 26 Dec 2014 20:08:35 -0000

Dag-Erling Sm?rgrav wrote:

> Eugene Grosbein wrote:
>> Why does it say "Recompile the operating system using buildworld and
>> installworld"?
>
> Because that's what the template says, and we rarely change it to
> something more specific (in large part because that requires careful
> testing of the exact instructions we publish).  "Rebuild, reinstall and
> reboot" may be overkill, but it's never wrong.

This is most unfortunate as it creates a high bar for base security
patches at many FreeBSD shops.  Sites with a significant number of
production hosts, jails and/or filesystem fingerprinting (integrit,
tripwire) or those with constrained resources are never going to be able
to make/build/installworld for something as simple as a single binary
update.

I assume the root cause is insufficient resources within the freebsd
security team.  If that's the case would there be a budget estimate
associated with addressing this security advicory situation?  Since quick
publication of advisories is critical this also raises the question of
what might be an effective way to subsequently publish more granular
update instructions.

Roger Marquis