From owner-freebsd-security@FreeBSD.ORG Wed Apr 9 16:28:47 2014 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id A9494C9 for ; Wed, 9 Apr 2014 16:28:47 +0000 (UTC) Received: from mail-oa0-x22e.google.com (mail-oa0-x22e.google.com [IPv6:2607:f8b0:4003:c02::22e]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 70F411E3D for ; Wed, 9 Apr 2014 16:28:47 +0000 (UTC) Received: by mail-oa0-f46.google.com with SMTP id i7so2982046oag.5 for ; Wed, 09 Apr 2014 09:28:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=wjnqBWoth3APevka3FLXsGYF2YGemsKa+nXkojvLITY=; b=pXuJNhH/Kl2/87wFdlAd9XHufgdHcSjfVphAAAfZke2hPuVfmeBA9w5pVShW+/PmQd tu4Xob3n5RMdjPDAmDoeM+PiPgW13YuZYx0CuO3sJqN6lHoRDZXUClV27ScLNmt89bxS ZaXh+B+dcIx4TfZSSA5/PMm9qw8HZOXRtf0rEXtdKI/GEdkrDBdPhjGZvDATDyZnhBRq 6MjFWzGPHiJ0RKgJpeFeCH7C9WJ+0ZRf39BF3rbQ4fsMdZtH74aZjRPLm/GXDirkSSBA 0TvQnBv+kGCPQpIpbO7JPnDqJL25kI/eCdauzoRP7RlfzTMboZ9SnPRcCW1S4NUx+9df Uepg== MIME-Version: 1.0 X-Received: by 10.182.85.193 with SMTP id j1mr2836326obz.52.1397060926768; Wed, 09 Apr 2014 09:28:46 -0700 (PDT) Received: by 10.182.123.17 with HTTP; Wed, 9 Apr 2014 09:28:46 -0700 (PDT) In-Reply-To: <8D81F198-36A7-47F4-B486-DA059910A6B4@spam.lifeforms.nl> References: <9eeba1ab-2ab0-4188-82aa-686c5573a5db@me.com> <8D81F198-36A7-47F4-B486-DA059910A6B4@spam.lifeforms.nl> Date: Wed, 9 Apr 2014 09:28:46 -0700 Message-ID: Subject: Re: Proposal From: jungleboogie0 To: Walter Hop Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: freebsd-security@freebsd.org, Pawel Biernacki , Kimmo Paasiala , =?UTF-8?Q?Dag=2DErling_Sm=C3=B8rgrav?= X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Apr 2014 16:28:47 -0000 Hi Walter, On 9 April 2014 08:17, Walter Hop wrote: >> In my opinion this issue couldn't have been handled any better consideri= ng what it takes to do the job properly, congrats to the security team from= me. >> >> -Kimmo > > Please don=E2=80=99t frame this as criticism of the security people, that= =E2=80=99s not fair. Of course we all congratulate them :) > > I think we=E2=80=99re just interested in discussing what could be improve= d to improve response time and also make their lives better. > > Do we need moar Jenkins? Extra build boxes? More cash to keep people on r= etainer? Resources for training new people? Liaisons with other projects to= improve prior notification channels? Etc. > > FreeBSD ports had a fix after ~4 hours I think, Ubuntu patched their base= about an hour later, FreeBSD base took around 24 hours. Not super bad, but= I think it=E2=80=99s safe to expect much more scrutiny of security-critica= l code in the coming years, so it looks like a good time to try to streamli= ne if possible at all. > Please let us not forget that kernel.org was hacked and not detected for 17 days: http://www.theregister.co.uk/2011/08/31/linux_kernel_security_= breach/ I would rather was 24 hours for a fix that's been verified and reviewed over having to re-update the system. It looks like many linux distros had this updated before freeBSD but its a matter of hours we're talking about. > The public attention for this and similar events may also provide a uniqu= e window of opportunity for soliciting extra resources from professional us= ers (e.g. via a Foundation campaign). > > -- > Walter Hop | PGP key: https://lifeforms.nl/pgp > --=20 ------- inum: 883510009902611 sip: jungleboogie@sip2sip.info xmpp: jungle-boogie@jit.si