Libre RISC-V Mailing list Archives (accessible via public-inbox)
 help / color / Atom feed
From: Jacob Lifshay <programmerjake@gmail.com>
To: Libre-RISCV General Development <libre-riscv-dev@lists.libre-riscv.org>
Subject: [libre-riscv-dev] Rustup security
Date: Fri, 13 Mar 2020 11:10:50 -0700
Message-ID: <CAC2bXD442JC0wwNneTFwZuohSZn9-gWN=ueqzWZ_bC=oa5u3TQ@mail.gmail.com> (raw)
In-Reply-To: <CAPweEDzzojEUrOU3vYcza0qB9rM7asNMnaSCCSfG9rE9Nz4i7A@mail.gmail.com>

On Fri, Mar 13, 2020, 03:13 Luke Kenneth Casson Leighton <lkcl@lkcl.net>
wrote:

> On Fri, Mar 13, 2020 at 8:25 AM Jacob Lifshay <programmerjake@gmail.com>
> wrote:
>
> > it's similar to installing firefox on windows, where you download and run
> > the executable.
>
> which says it all.
>
> as an aside: when i analysed and derived the security requirements
> that went into debian's package distribution design, it was
> *SEVENTEEN* separate and distinct very specific requirements, any one
> of which, if not complied with, completely and utterly destroyed the
> security chain of package integrity.
>
> https://github.com/rust-lang/rustup#security
>
> "rustup is secure enough for the non-paranoid, but it still needs
> work. rustup performs all downloads over HTTPS, but does not yet
> validate signatures of downloads."
>
> here's the good and the bad:
>
> 1). bad: it is seriously demeaning to use the phrase "non-paranoid" -
> to ACCUSE potential users of rust of "being paranoid".  can i suggest,
> jacob, raising that as a severe and high-priority issue with the rust
> community to get that removed effective immediate?
>

https://github.com/rust-lang/rustup/issues/2262

I don't have permissions to set severity or priority, though I did make a
comment.

>
> 2). bad: relying on HTTPS simply makes the website itself a
> high-priority hacking target.  HTTPS verifies the *channel*, *not* the
> contents.
>

yeah.


> 3). good: at least they recognise that signature validation is critical.
>
> 4). bad: unfortunately they don't describe - at all - how they intend
> to tackle this, and i can pretty much guarantee that if they haven't
> thought about it fully, they *will* get it wrong.  even copying
> something like Redhat package distribution or archlinux distribution,
> they'll get it wrong.
>

They actually do in the list of github issues linked from the above linked
security section:
https://github.com/rust-lang/rustup/issues?q=is%3Aopen+is%3Aissue+label%3Asecurity

Jacob
_______________________________________________
libre-riscv-dev mailing list
libre-riscv-dev@lists.libre-riscv.org
http://lists.libre-riscv.org/mailman/listinfo/libre-riscv-dev

  reply index

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <CAPweEDyGztErPRa=9KLM9J02R1fLQ9Y23VY7UNAkfJ5yt-03PQ@mail.gmail.com>
     [not found] ` <20200220093921.635c47f72ea2faf85dd352b7@gmx.com>
2020-03-12 14:32   ` [libre-riscv-dev] next tasks Hendrik Boom
2020-03-12 14:43     ` Luke Kenneth Casson Leighton
2020-03-12 17:40       ` Jacob Lifshay
2020-03-13  6:44         ` Lauri Kasanen
2020-03-13  7:38           ` Jacob Lifshay
2020-03-13  8:04             ` Lauri Kasanen
2020-03-13  8:25               ` Jacob Lifshay
2020-03-13 10:13                 ` Luke Kenneth Casson Leighton
2020-03-13 18:10                   ` Jacob Lifshay [this message]
2020-03-14 18:13                   ` Hendrik Boom
2020-03-14 18:23                     ` whygee
2020-03-14 18:28                       ` Luke Kenneth Casson Leighton
2020-03-14 18:49                         ` whygee
2020-03-15  2:47                     ` [libre-riscv-dev] benefits of rust Jacob Lifshay
2020-03-15  5:18                       ` Hendrik Boom
2020-03-15  5:42                         ` Jacob Lifshay
2020-03-15  5:47                           ` [libre-riscv-dev] [OT] Minecraft garbage collection Hendrik Boom
2020-03-15  6:41                             ` Jacob Lifshay
2020-03-15 12:11                               ` Luke Kenneth Casson Leighton
2020-03-16 13:22                                 ` Luke Kenneth Casson Leighton
2020-03-16 16:22                                   ` Jacob Lifshay
2020-03-16 16:24                                     ` Luke Kenneth Casson Leighton
2020-03-17 18:23                   ` [libre-riscv-dev] next tasks Jacob Lifshay
2020-03-17 18:56                     ` Luke Kenneth Casson Leighton
2020-03-16 18:30         ` Immanuel, Yehowshua U
2020-03-16 18:51           ` Jacob Lifshay
2020-03-16 22:53             ` Luke Kenneth Casson Leighton
2020-03-16 22:53           ` Luke Kenneth Casson Leighton
2020-03-16 23:12             ` Immanuel, Yehowshua U
2020-03-16 23:16               ` Immanuel, Yehowshua U
2020-03-16 23:42               ` Luke Kenneth Casson Leighton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAC2bXD442JC0wwNneTFwZuohSZn9-gWN=ueqzWZ_bC=oa5u3TQ@mail.gmail.com' \
    --to=programmerjake@gmail.com \
    --cc=libre-riscv-dev@lists.libre-riscv.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Libre RISC-V Mailing list Archives (accessible via public-inbox)

Archives are clonable: git clone --mirror https://inbox.libre-soc.org/libre-riscv-dev

Example config snippet for mirrors


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git