On Thu, Aug 10, 2000 at 12:29:02PM -0400, Noel L Yap wrote:
> Exactly what you've been saying you're going to do about it -- recover.
> Only now, you really do know their email address -- it's not just someone
> pretending to be them.
OK, sure that's true. With SSH I am really positive that the person behind
the email address should no longer be trusted at all. With pserver I am
only pretty suspicious of them. This is basically the only reason to
move to SSH when it becomes a viable solution, but it is a good reason.
In either case, with chrooted SSH or chrooted pserver I recover just
the same, and limit the damage just the same.
> > a) immediately remove pserver from CVS
> > b) immediately apply the patch
>
> c) prove that the patch either makes CVS worse, or does nothing to CVS. If
> either is true, CVS should stay as is.
I agree.
Greg will claim it does "nothing" because it does nothing to improve
authentication, even though it does a lot to improve your ability to
recover, and a lot to limit the damage an attack can do.
Also I want to add that my patch does nothing to CVS unless you actually
specify the --chroot flag, and even then, it does nothing unless you are
also using pserver (it's an error to use --chroot other than with pserver).
Justin
