Date: Thu, 25 Feb 2021 16:56:18 -0500 From: Karl Denninger <karl@denninger.net> To: Warner Losh <imp@bsdimp.com> Cc: FreeBSD-STABLE Mailing List <freebsd-stable@freebsd.org> Subject: Re: How do I know if my 13-stable has security patches? Message-ID: <7d4e7a1f-da3e-2860-62b1-7be88123bee9@denninger.net> In-Reply-To: <CANCZdfo2zq1fR5q7X47QFAFt00WrfvSzyqg4vDVbRwdGGXgfMQ@mail.gmail.com> References: <CAN6yY1tTt%2BEn6hzMYrjm2fRkUPBAuN9t8%2BR27Z3To_sJRbfUVA@mail.gmail.com> <1748076.jFELhIj8lM@ravel> <CAN6yY1sehRjej7vf3B_TPsg%2BecpDLG=naQ2oiMZ=DATs3PUGzQ@mail.gmail.com> <3308997.ajJYar8FF2@ravel> <001a5401-c334-5937-4ce3-315ff89e34be@denninger.net> <CANCZdfo2zq1fR5q7X47QFAFt00WrfvSzyqg4vDVbRwdGGXgfMQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a cryptographically signed message in MIME format. --------------ms020408010007060203020801 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable On 2/25/2021 15:56, Warner Losh wrote: > > On Thu, Feb 25, 2021 at 6:37 AM Karl Denninger <karl@denninger.net=20 > <mailto:karl@denninger.net>> wrote: > > On 2/25/2021 04:30, Olivier Certner wrote: > >> Neither command is what I'd call 'intuitive', so it would have > taken me a > >> long time to find either of them. I cut and pasted the 'git > branch' command > >> and it took me a moment to realize what that meant. Never ran > "grep -l" on > >> a pipe, I guess. > > You made me laugh! Apart from relatively simple commands, git's > interface is > > far from intuitive. That's the reason why I regret that it > became the hugely > > dominant DVCS. > > Regression doesn't have to come to a project, but if the tools you > choose do things like this then you have to work around them as a > project to avoid the issue, and that might wind up being somewhat > of a PITA. > > This specific issue is IMHO quite severe in terms of operational > impact.=C2=A0 I track -STABLE but don't load "new things" all the > time.=C2=A0 For > security-related things it's more important to know if I've got > something out there in a specific instance where it may apply (and > not > care in others where it doesn't; aka the recent Xen thing if > you're not > using Xen.)=C2=A0 Otherwise if everything is running as it should d= o I > wish > to risk introducing bugs along with improvements?=C2=A0 If not in a= > security-related context, frequently not. > > Well, this used to be easy.=C2=A0 Is your "uname" r-number HIGHER t= han the > "when fixed" revision?=C2=A0 You're good.=C2=A0 Now, nope.=C2=A0 No= w I have to go > dig > source to know because there is no longer a "revision number" that > monotonically increments with each commit so there is no longer a > way to > have a "point in time" view of the source, as-committed, for a give= n > checked-out version. > > IMHO that's a fairly serious regression for the person responsible > for > keeping security-related things up to date and something the projec= t > should find a way to fix before rolling the next -RELEASE. (Yeah, > I know > that's almost-certain to not happen but it's not like this issue > wasn't > known since moving things over to git.) > > > We should likely just publish the 'v' number in the advisories. It's=20 > basically a count back to the start of the project. We put that number = > in uname already. > > You can also=C2=A0 find out the 'v' number in the latest advisories by = > cloning the repo and doing the same thing we do in newvers.sh: > % git rev-list --first-parent --count $HASH > and that will tell you. This needn't be on the target machine since=20 > the hashes are stable across the world. (list of further "stuff") But that's my entire point Warner. The time (and present items) on a given machine to know whether it is=20 covered by a given advisory under the "svn view of the world" is one=20 command, and no sources.=C2=A0 That is, if the advisory says "r123456" ha= s=20 the fix, then if I do a "uname -v" and get something larger, it's safe. If I get something smaller it's not. I don't need the source on the machine, I don't need svn on the target=20 or, for that matter, do I need to know if the source tree I have on a=20 build machine is coherent with whatever is on the running machine.=C2=A0 = I=20 simply need to know if the source that built the code that is running=20 was updated *after* the commit that fixes the problem.=C2=A0 What if the = source /isn't on that machine /because you build on some system and then = distribute?=C2=A0 Does every machine now have to be coherent with your so= urce=20 repository in order to be able to figure out where you are or worse, it=20 must keep the source from which that specific installation,=20 individually, was built? /What if the source isn't there at all /because = you run binary code and update with freebsd-update? Unless I've missed something that's what was lost and IMHO needs to be=20 restored; a way to know that in seconds with nothing other than the=20 operating OS on the box (e.g. via uname) and the advisory with its=20 "greater than X is safe" from the mailing list.=C2=A0 Am I misunderstandi= ng=20 the current state of things in this regard? --=20 Karl Denninger karl@denninger.net <mailto:karl@denninger.net> /The Market Ticker/ /[S/MIME encrypted email preferred]/ --------------ms020408010007060203020801 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgMFADCABgkqhkiG9w0BBwEAAKCC DdgwggagMIIEiKADAgECAhMA5EiKghDOXrvfxYxjITXYDdhIMA0GCSqGSIb3DQEBCwUAMIGL MQswCQYDVQQGEwJVUzEQMA4GA1UECAwHRmxvcmlkYTESMBAGA1UEBwwJTmljZXZpbGxlMRkw FwYDVQQKDBBDdWRhIFN5c3RlbXMgTExDMRgwFgYDVQQLDA9DdWRhIFN5c3RlbXMgQ0ExITAf BgNVBAMMGEN1ZGEgU3lzdGVtcyBMTEMgMjAxNyBDQTAeFw0xNzA4MTcxNjQyMTdaFw0yNzA4 MTUxNjQyMTdaMHsxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdGbG9yaWRhMRkwFwYDVQQKDBBD dWRhIFN5c3RlbXMgTExDMRgwFgYDVQQLDA9DdWRhIFN5c3RlbXMgQ0ExJTAjBgNVBAMMHEN1 ZGEgU3lzdGVtcyBMTEMgMjAxNyBJbnQgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK AoICAQC1aJotNUI+W4jP7xQDO8L/b4XiF4Rss9O0B+3vMH7Njk85fZ052QhZpMVlpaaO+sCI KqG3oNEbuOHzJB/NDJFnqh7ijBwhdWutdsq23Ux6TvxgakyMPpT6TRNEJzcBVQA0kpby1DVD 0EKSK/FrWWBiFmSxg7qUfmIq/mMzgE6epHktyRM3OGq3dbRdOUgfumWrqHXOrdJz06xE9NzY vc9toqZnd79FUtE/nSZVm1VS3Grq7RKV65onvX3QOW4W1ldEHwggaZxgWGNiR/D4eosAGFxn uYeWlKEC70c99Mp1giWux+7ur6hc2E+AaTGh+fGeijO5q40OGd+dNMgK8Es0nDRw81lRcl24 SWUEky9y8DArgIFlRd6d3ZYwgc1DMTWkTavx3ZpASp5TWih6yI8ACwboTvlUYeooMsPtNa9E 6UQ1nt7VEi5syjxnDltbEFoLYcXBcqhRhFETJe9CdenItAHAtOya3w5+fmC2j/xJz29og1KH YqWHlo3Kswi9G77an+zh6nWkMuHs+03DU8DaOEWzZEav3lVD4u76bKRDTbhh0bMAk4eXriGL h4MUoX3Imfcr6JoyheVrAdHDL/BixbMH1UUspeRuqQMQ5b2T6pabXP0oOB4FqldWiDgJBGRd zWLgCYG8wPGJGYgHibl5rFiI5Ix3FQncipc6SdUzOQIDAQABo4IBCjCCAQYwHQYDVR0OBBYE FF3AXsKnjdPND5+bxVECGKtc047PMIHABgNVHSMEgbgwgbWAFBu1oRhUMNEzjODolDka5k4Q EDBioYGRpIGOMIGLMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHRmxvcmlkYTESMBAGA1UEBwwJ TmljZXZpbGxlMRkwFwYDVQQKDBBDdWRhIFN5c3RlbXMgTExDMRgwFgYDVQQLDA9DdWRhIFN5 c3RlbXMgQ0ExITAfBgNVBAMMGEN1ZGEgU3lzdGVtcyBMTEMgMjAxNyBDQYIJAKxAy1WBo2kY MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IC AQCB5686UCBVIT52jO3sz9pKuhxuC2npi8ZvoBwt/IH9piPA15/CGF1XeXUdu2qmhOjHkVLN gO7XB1G8CuluxofOIUce0aZGyB+vZ1ylHXlMeB0R82f5dz3/T7RQso55Y2Vog2Zb7PYTC5B9 oNy3ylsnNLzanYlcW3AAfzZcbxYuAdnuq0Im3EpGm8DoItUcf1pDezugKm/yKtNtY6sDyENj tExZ377cYA3IdIwqn1Mh4OAT/Rmh8au2rZAo0+bMYBy9C11Ex0hQ8zWcvPZBDn4v4RtO8g+K uQZQcJnO09LJNtw94W3d2mj4a7XrsKMnZKvm6W9BJIQ4Nmht4wXAtPQ1xA+QpxPTmsGAU0Cv HmqVC7XC3qxFhaOrD2dsvOAK6Sn3MEpH/YrfYCX7a7cz5zW3DsJQ6o3pYfnnQz+hnwLlz4MK 17NIA0WOdAF9IbtQqarf44+PEyUbKtz1r0KGeGLs+VGdd2FLA0e7yuzxJDYcaBTVwqaHhU2/ Fna/jGU7BhrKHtJbb/XlLeFJ24yvuiYKpYWQSSyZu1R/gvZjHeGb344jGBsZdCDrdxtQQcVA 6OxsMAPSUPMrlg9LWELEEYnVulQJerWxpUecGH92O06wwmPgykkz//UmmgjVSh7ErNvL0lUY UMfunYVO/O5hwhW+P4gviCXzBFeTtDZH259O7TCCBzAwggUYoAMCAQICEwCg0WvVwekjGFiO 62SckFwepz0wDQYJKoZIhvcNAQELBQAwezELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0Zsb3Jp ZGExGTAXBgNVBAoMEEN1ZGEgU3lzdGVtcyBMTEMxGDAWBgNVBAsMD0N1ZGEgU3lzdGVtcyBD QTElMCMGA1UEAwwcQ3VkYSBTeXN0ZW1zIExMQyAyMDE3IEludCBDQTAeFw0xNzA4MTcyMTIx MjBaFw0yMjA4MTYyMTIxMjBaMFcxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdGbG9yaWRhMRkw FwYDVQQKDBBDdWRhIFN5c3RlbXMgTExDMRswGQYDVQQDDBJrYXJsQGRlbm5pbmdlci5uZXQw ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC+HVSyxVtJhy3Ohs+PAGRuO//Dha9A 16l5FPATr6wude9zjX5f2lrkRyU8vhCXTZW7WbvWZKpcZ8r0dtZmiK9uF58Ec6hhvfkxJzbg 96WHBw5Fumd5ahZzuCJDtCAWW8R7/KN+zwzQf1+B3MVLmbaXAFBuKzySKhKMcHbK3/wjUYTg y+3UK6v2SBrowvkUBC+jxNg3Wy12GsTXcUS/8FYIXgVVPgfZZrbJJb5HWOQpvvhILpPCD3xs YJFNKEPltXKWHT7Qtc2HNqikgNwj8oqOb+PeZGMiWapsatKm8mxuOOGOEBhAoTVTwUHlMNTg 6QUCJtuWFCK38qOCyk9Haj+86lUU8RG6FkRXWgMbNQm1mWREQhw3axgGLSntjjnznJr5vsvX SYR6c+XKLd5KQZcS6LL8FHYNjqVKHBYM+hDnrTZMqa20JLAF1YagutDiMRURU23iWS7bA9tM cXcqkclTSDtFtxahRifXRI7Epq2GSKuEXe/1Tfb5CE8QsbCpGsfSwv2tZ/SpqVG08MdRiXxN 5tmZiQWo15IyWoeKOXl/hKxA9KPuDHngXX022b1ly+5ZOZbxBAZZMod4y4b4FiRUhRI97r9l CxsP/EPHuuTIZ82BYhrhbtab8HuRo2ofne2TfAWY2BlA7ExM8XShMd9bRPZrNTokPQPUCWCg CdIATQIDAQABo4IBzzCCAcswPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzABhiBodHRwOi8v b2NzcC5jdWRhc3lzdGVtcy5uZXQ6ODg4ODAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF oDAOBgNVHQ8BAf8EBAMCBeAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMDMGCWCG SAGG+EIBDQQmFiRPcGVuU1NMIEdlbmVyYXRlZCBDbGllbnQgQ2VydGlmaWNhdGUwHQYDVR0O BBYEFLElmNWeVgsBPe7O8NiBzjvjYnpRMIHKBgNVHSMEgcIwgb+AFF3AXsKnjdPND5+bxVEC GKtc047PoYGRpIGOMIGLMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHRmxvcmlkYTESMBAGA1UE BwwJTmljZXZpbGxlMRkwFwYDVQQKDBBDdWRhIFN5c3RlbXMgTExDMRgwFgYDVQQLDA9DdWRh IFN5c3RlbXMgQ0ExITAfBgNVBAMMGEN1ZGEgU3lzdGVtcyBMTEMgMjAxNyBDQYITAORIioIQ zl6738WMYyE12A3YSDAdBgNVHREEFjAUgRJrYXJsQGRlbm5pbmdlci5uZXQwDQYJKoZIhvcN AQELBQADggIBAJXboPFBMLMtaiUt4KEtJCXlHO/3ZzIUIw/eobWFMdhe7M4+0u3te0sr77QR dcPKR0UeHffvpth2Mb3h28WfN0FmJmLwJk+pOx4u6uO3O0E1jNXoKh8fVcL4KU79oEQyYkbu 2HwbXBU9HbldPOOZDnPLi0whi/sbFHdyd4/w/NmnPgzAsQNZ2BYT9uBNr+jZw4SsluQzXG1X lFL/qCBoi1N2mqKPIepfGYF6drbr1RnXEJJsuD+NILLooTNf7PMgHPZ4VSWQXLNeFfygoOOK FiO0qfxPKpDMA+FHa8yNjAJZAgdJX5Mm1kbqipvb+r/H1UAmrzGMbhmf1gConsT5f8KU4n3Q IM2sOpTQe7BoVKlQM/fpQi6aBzu67M1iF1WtODpa5QUPvj1etaK+R3eYBzi4DIbCIWst8MdA 1+fEeKJFvMEZQONpkCwrJ+tJEuGQmjoQZgK1HeloepF0WDcviiho5FlgtAij+iBPtwMuuLiL shAXA5afMX1hYM4l11JXntle12EQFP1r6wOUkpOdxceCcMVDEJBBCHW2ZmdEaXgAm1VU+fnQ qS/wNw/S0X3RJT1qjr5uVlp2Y0auG/eG0jy6TT0KzTJeR9tLSDXprYkN2l/Qf7/nT6Q03qyE QnnKiBXWAZXveafyU/zYa7t3PTWFQGgWoC4w6XqgPo4KV44OMYIFBzCCBQMCAQEwgZIwezEL MAkGA1UEBhMCVVMxEDAOBgNVBAgMB0Zsb3JpZGExGTAXBgNVBAoMEEN1ZGEgU3lzdGVtcyBM TEMxGDAWBgNVBAsMD0N1ZGEgU3lzdGVtcyBDQTElMCMGA1UEAwwcQ3VkYSBTeXN0ZW1zIExM QyAyMDE3IEludCBDQQITAKDRa9XB6SMYWI7rZJyQXB6nPTANBglghkgBZQMEAgMFAKCCAkUw GAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjEwMjI1MjE1NjE4 WjBPBgkqhkiG9w0BCQQxQgRArTNg1H4WFDuHma8lOPZ0lKH3XBNJdbEZ28ORxqe/kgU7lueP pDVqbB8pjlk64EuIIPinOZ1MPNsA8ziAu54ehTBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFl AwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3 DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIGjBgkrBgEEAYI3EAQxgZUwgZIwezEL MAkGA1UEBhMCVVMxEDAOBgNVBAgMB0Zsb3JpZGExGTAXBgNVBAoMEEN1ZGEgU3lzdGVtcyBM TEMxGDAWBgNVBAsMD0N1ZGEgU3lzdGVtcyBDQTElMCMGA1UEAwwcQ3VkYSBTeXN0ZW1zIExM QyAyMDE3IEludCBDQQITAKDRa9XB6SMYWI7rZJyQXB6nPTCBpQYLKoZIhvcNAQkQAgsxgZWg gZIwezELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0Zsb3JpZGExGTAXBgNVBAoMEEN1ZGEgU3lz dGVtcyBMTEMxGDAWBgNVBAsMD0N1ZGEgU3lzdGVtcyBDQTElMCMGA1UEAwwcQ3VkYSBTeXN0 ZW1zIExMQyAyMDE3IEludCBDQQITAKDRa9XB6SMYWI7rZJyQXB6nPTANBgkqhkiG9w0BAQEF AASCAgAHzy5mpzLYr9stsW/DoRcNzreTzQI2y2YqT9xEW67ZhKE6AFKeAKLwjI6QvUI/L7dN DLoxroVlPtjh8Xe0QhL1AQaKfXalFiAT7bKK/POZhc5/rwIzjG0hM1UNcVOupvP87C26PGcQ PrPEcjr9KGXOnbJV8k9sDpZiJGqq75Q0+95nmEtby+9czPtFiOpLX/O86ZPpbVG9D0ynMrMf lnuyJiqEvDWkxSbVlhsgWm3B0gjGX2FmQGWaUVDDRSvbtRNKUhLDOSoPFhm7pyminlD36fhQ j5DtCfpiHX4vbbhejIcGXHZe4lrcI7nbe5fPNTIeQdzxwKx455IhU5Eik2TVwV39s+rtL2ie AH+zaKq+TVUqopAa/OphebTMJfRYY5CZefbUALqdQg1gCnYzopcWU1/slt1tD5mBl5Wqpxf3 oAUy5LSJGE64XuRPhRMw0lzfp2U+FHNGCX7o7TybDt3DZojV7S/2bfWwiG+aWcVCLvzbpsov V4FE/my0cHBLEAVEWKj86k3WV8ZmFBEm0Gc45rrTXDBZ0Fv/7hZr+iYdwM0NisJTJMqYL8fe 58mLlZc84q27bG6ns800WBEmMN79i5SmHQez+5Fe2yN3V6DGNGYQD/bDCEA/lbriRfinyZb4 GnGTnLBVUSTp7HzADIcOFskce3v0JmIwJaRp5ZO6gQAAAAAAAA== --------------ms020408010007060203020801--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?7d4e7a1f-da3e-2860-62b1-7be88123bee9>