From owner-freebsd-arch@freebsd.org Tue Jun 20 18:17:46 2017 Return-Path: Delivered-To: freebsd-arch@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A8352D9E990 for ; Tue, 20 Jun 2017 18:17:46 +0000 (UTC) (envelope-from rb@gid.co.uk) Received: from mx0.gid.co.uk (mx0.gid.co.uk [194.32.164.250]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 036F66A479; Tue, 20 Jun 2017 18:17:45 +0000 (UTC) (envelope-from rb@gid.co.uk) Received: from [194.32.164.15] ([194.32.164.15]) by mx0.gid.co.uk (8.14.2/8.14.2) with ESMTP id v5KI5XAc072078; Tue, 20 Jun 2017 19:05:33 +0100 (BST) (envelope-from rb@gid.co.uk) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Subject: Re: rtools were deemed almost unused 15 years ago... From: Bob Bishop In-Reply-To: <20170620171744.GA72667@ymer.vnode.se> Date: Tue, 20 Jun 2017 19:05:33 +0100 Cc: Joel Dahl , Michael Gmelin , Jeremie Le Hen , Baptiste Daroussin Content-Transfer-Encoding: quoted-printable Message-Id: References: <20170620111136.fz5ovfa4imm3p4hj@ivaldir.net> <20170620155954.150dedc5@bsd64.grem.de> <20170620171744.GA72667@ymer.vnode.se> To: freebsd-arch X-Mailer: Apple Mail (2.3124) X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Jun 2017 18:17:46 -0000 > On 20 Jun 2017, at 18:17, Joel Dahl wrote: >=20 > On Tue, Jun 20, 2017 at 03:59:54PM +0200, Michael Gmelin wrote: >>=20 >>=20 >> On Tue, 20 Jun 2017 13:11:37 +0200 >> Baptiste Daroussin wrote: >>=20 >>> On Tue, Jun 20, 2017 at 12:25:46PM +0200, Jeremie Le Hen wrote: >>>> Hey folks, >>>>=20 >>>> I remember when I was still barely out of my teenagehood, people >>>> were mostly using ssh/scp while rtools (rsh, rlogin, ... for the >>>> youngsters) were left in place as a courtesy for legacy production >>>> systems still relying it on them. >>>>=20 >>>> Fast forward to 2017 (so yes, 15 years later), stack-clash [1] >>>> sorely reminds us that suid binaries are an attack surface. I don't >>>> even need to mention that it's a healthy engineering practice to >>>> remove unused code, both from a maintenance and security >>>> perspective. >>>>=20 >>>> Therefore, I hereby propose to remove rtools from the base system. >>>> I acknowledge this will likely cause troubles for a handful of >>>> people who are still relying on it for good or bad reasons. But the >>>> flipside is that the attack surface of millions of FreeBSD >>>> installed out there will be reduced. >>>>=20 >>>> The proposed roadmap is: >>>> - disable from the build on head and let it soak for one month >>>> - remove rtools from the base. >>>>=20 >>>> What do you guys think? Any preferred color for the bikeshed? :) >>>>=20 >>>>=20 >>>>=20 >>>> [1] https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt =20= >>>=20 >>> Yeah! >>>=20 >>> Is telnetd part of your list? >>=20 >> As long as the telnet(1) client stays in I'm all for it. >=20 > +1. Please keep the telnet client. It's something I expect be part of = the base > system utilities. I use it all the time. +1 What he said. > --=20 > Joel -- Bob Bishop rb@gid.co.uk