Re: [gentoo-dev] Re: Current Gentoo Git setup / man-in-the-middle attacks
On 30/03/15 10:57, Andrew Savchenko wrote: And using https for that will create a tremendous stress on mirror's CPUs, so this is a bad approach. Not to mention that https itself is very hapless protocol with tons of vulnerabilities (all SSL versions are affected and most TLS implementations). This is spreading FUD. -- Thomas Kahle http://dev.gentoo.org/~tomka/ signature.asc Description: OpenPGP digital signature
Re: [gentoo-dev] Re: Current Gentoo Git setup / man-in-the-middle attacks
Thomas Kahle schrieb: On 30/03/15 10:57, Andrew Savchenko wrote: And using https for that will create a tremendous stress on mirror's CPUs, so this is a bad approach. Not to mention that https itself is very hapless protocol with tons of vulnerabilities (all SSL versions are affected and most TLS implementations). This is spreading FUD. As far as I know this is correct. All SSL protocol versions including v3 have known vulnerabilities. In addition, a number implementations of TLS 1.0 and 1.1 have been found susceptible to the Poodle and/or FREAK attacks. That the https protocol is hapless is maybe a pessimistic view on the situation. But if all were fine, why some organizations think they need certificate pinning again? Best regards, Chí-Thanh Christopher Nguyễn
Re: [gentoo-dev] Re: Current Gentoo Git setup / man-in-the-middle attacks
On Wed, 01 Apr 2015 14:59:01 +0200 Chí-Thanh Christopher Nguyễn chith...@gentoo.org wrote: As far as I know this is correct. All SSL protocol versions including v3 have known vulnerabilities. Yeah, but this is a pointless statement in the discussion. Nobody says we should deploy https via sslv3. Of course if people want https they mean https as in 2015 https, not https as in 199x https. In addition, a number implementations of TLS 1.0 and 1.1 have been found susceptible to the Poodle and/or FREAK attacks. Implementation bugs that can be fixed (and are fixed). FREAK is only an issue if you have crazy configured servers (again, https as in 199x), POODLE TLS is only affecting some crappy proprietary load balancers (and erlang, but nobody has proposed to use an erlang https server). People want to deploy pgp sigs (which is - to be clear - a good idea I fully support). I personally found countless minor security issues in gpg lately. Should that stop us from using pgp sigs? of course not. And the claims about https being a performance / cpu stress horror is also completely exaggerated. https performance is mostly a non-issue and based on urban legends rather than benchmarks. -- Hanno Böck http://hboeck.de/ mail/jabber: ha...@hboeck.de GPG: BBB51E42
Re: [gentoo-dev] Re: Current Gentoo Git setup / man-in-the-middle attacks
Yes, we should add possibilities, but not revoke them from user. That is a Gentoo Philosophy. We shouldn't enforce users to anything that, as we think, is better for them. Even about security. And yes, we even shouldn't forbid them to install heartbleaded openssl (thankfully, users is free to do that themselves from local overlays). -- Best regards, mva signature.asc Description: This is a digitally signed message part.
Re: [gentoo-dev] Re: Current Gentoo Git setup / man-in-the-middle attacks
On Mon, 30 Mar 2015 05:37:01 + (UTC) Duncan wrote: Andrew Savchenko posted on Sun, 29 Mar 2015 21:04:52 +0300 as excerpted: On Sun, 29 Mar 2015 19:52:38 +0200 Sebastian Pipping wrote: On 29.03.2015 19:39, Andrew Savchenko wrote: On Sun, 29 Mar 2015 18:41:33 +0200 Sebastian Pipping wrote: So I would like to propose that * support for Git access through https:// is activated, * Git access through http:// and git:// is deactivated, and Some people have https blocked. http:// and git:// must be available read-only. They would not do online banking over http, right? Why would they run code with root privileges from http? Gentoo tree access is not even near on the same security scale as online banking. The point is, if the gentoo tree is compromised and you install from it, everything you run including that online banking is now effectively compromised, so it most certainly *IS* at the same security scale as that online banking. Weakest link in the chain and all that... The Gentoo tree is not verified anyway: mirrors distribute it via http, rsync and ftp. And using https for that will create a tremendous stress on mirror's CPUs, so this is a bad approach. Not to mention that https itself is very hapless protocol with tons of vulnerabilities (all SSL versions are affected and most TLS implementations). A proper solution will be to use cryptographic verification of downloaded files. Right now we have signed manifests and manifests can be used to verify all other data (ebuilds, distfiles, patches and so on). This is much more reliable solution, since it allows to verify data integrity even for compromised data channels or any infrastructure part not related to keys distribution or signing. What we really need is a tool to do such verification. This is work in progress now afaik. Best regards, Andrew Savchenko pgp2NewmxTXpU.pgp Description: PGP signature
Re: [gentoo-dev] Re: Current Gentoo Git setup / man-in-the-middle attacks
On Mon, 30 Mar 2015 11:57:45 +0300 Andrew Savchenko birc...@gentoo.org wrote: The Gentoo tree is not verified anyway: mirrors distribute it via http, rsync and ftp. And using https for that will create a tremendous stress on mirror's CPUs, so this is a bad approach. Not to mention that https itself is very hapless protocol with tons of vulnerabilities (all SSL versions are affected and most TLS implementations). A proper solution will be to use cryptographic verification of downloaded files. We should probably distinguish security of reading from Gentoo mirror and writing to it. But for paranoid ones we probably should add the option to read from https:// or other secured protocols too.
[gentoo-dev] Re: Current Gentoo Git setup / man-in-the-middle attacks
Andrew Savchenko posted on Sun, 29 Mar 2015 21:04:52 +0300 as excerpted: On Sun, 29 Mar 2015 19:52:38 +0200 Sebastian Pipping wrote: On 29.03.2015 19:39, Andrew Savchenko wrote: On Sun, 29 Mar 2015 18:41:33 +0200 Sebastian Pipping wrote: So I would like to propose that * support for Git access through https:// is activated, * Git access through http:// and git:// is deactivated, and Some people have https blocked. http:// and git:// must be available read-only. They would not do online banking over http, right? Why would they run code with root privileges from http? Gentoo tree access is not even near on the same security scale as online banking. The point is, if the gentoo tree is compromised and you install from it, everything you run including that online banking is now effectively compromised, so it most certainly *IS* at the same security scale as that online banking. Weakest link in the chain and all that... Unless of course you use something non-gentoo for that banking, or, I suppose, only do updates over trusted wireline connections (you trust your ISP, your gentoo mirror and its ISP, and all backbone connections in between), but do online banking over public wifi with unverified and untrusted hotspots... -- Duncan - List replies preferred. No HTML msgs. Every nonfree program has a lord, a master -- and if you use the program, he is your master. Richard Stallman
