Bug#727708: systemd (security) bugs

2013-12-03 Thread Tollef Fog Heen
]] Russ Allbery Don Armstrong d...@debian.org writes: Projects which have multiple components, each of which has different security/interface surfaces without stable defined interfaces, can lead to problems when one set of developers doesn't understand the security implications of the

Bug#727708: systemd code documentation

2013-12-03 Thread Tollef Fog Heen
]] Russ Allbery My question here is: am I missing something in systemd? Did I just look at the wrong files, or not look deeply enough, or is there orientation documentation somewhere else where I didn't see it? Is there something about this comparison that's unfair? Did you see the

Bug#727708: systemd code documentation

2013-12-03 Thread Russ Allbery
Tollef Fog Heen tfh...@err.no writes: Did you see the «Documentation for Developers» section on http://www.freedesktop.org/wiki/Software/systemd/ ? It's more of an overview/design doc than function documentation, but it might be some of what you're looking for. I've also forwarded your

Bug#727708: systemd (security) bugs (was: init system question)

2013-12-03 Thread Sergey B Kirpichev
On Sun, Dec 01, 2013 at 09:50:49PM +, Ian Jackson wrote: If we were to adopt systemd as pid 1, which sections of the systemd source code would we probably want to adopt as well ? Or to put it another way, which other existing programs would be obsoleted ? Again, very good question. And

Bug#727708: systemd code documentation

2013-12-03 Thread Eugene Zhukov
Russ Allbery r...@debian.org writes: This documentation is really, really nice, but it's a bit different than what I was talking about. I should be clear, though (and please also do mention this to Lennart): the user-facing and the integration documentation for systemd seems quite good. This

Bug#727708: systemd code documentation

2013-12-03 Thread Ian Jackson
Eugene Zhukov writes (Bug#727708: systemd code documentation): The frequency of comments sometimes reflects poor quality of code. When you feel compelled to add a comment, consider rewriting the code to make it clearer. Please can we avoid arguing about this particular bikeshed here. Thanks

Bug#727708: systemd code documentation

2013-12-03 Thread Russ Allbery
Eugene Zhukov jevgeni...@gmail.com writes: The frequency of comments sometimes reflects poor quality of code. When you feel compelled to add a comment, consider rewriting the code to make it clearer. That would indeed be a succinct statement of the other perspective on code comments, which

Bug#727708: upstart (security) bugs

2013-12-03 Thread Bdale Garbee
Josselin Mouette j...@debian.org writes: a friend of mine mentioned (not in a pub, but in a serious discussion about systemd upstart) that he looked into upstart bugs more closely Thanks to Jef for this work, the results and his comparison of some bugs to systemd CVEs is quite interesting.

Bug#727708: systemd (security) bugs (was: init system question)

2013-12-03 Thread Moritz Muehlenhoff
On Sun, Dec 01, 2013 at 12:11:11PM -0600, Steve Langasek wrote: More review and more usage will lead to more bugs being found, we should rather applaud Red Hat for investing resources and be diligent. After all Red Hat is the only distro staffing a proactive product security team (from

Re: Bug#727708: systemd (security) bugs

2013-12-03 Thread Tollef Fog Heen
]] Don Armstrong Right; I think we definitely should integrate many of the components that are being developed. I'm just concerned that the component-systemd interface is still changing, and because the codebase is integrated, there's less of a requirement to communicate and document what

Bug#727708: upstart (security) bugs

2013-12-03 Thread Steve Langasek
On Tue, Dec 03, 2013 at 07:42:39PM +0100, Josselin Mouette wrote: Message transféré De: Jef Spaleta jspal...@gmail.com À: Josselin Mouette j...@debian.org Sujet: Re: FYI: for the systemd security debate. Date: Mon, 2 Dec 2013 23:39:59