Re: HEADS UP: enigmail to be EOL'd by the end of week

[Holger Levsen]

Hi Antoine,

sorry for my silence on this. I've been pondering what the best cause of
action would be, whether I should defer the final decision to Raphael,
or decide on my own.

On Tue, Jan 29, 2019 at 01:48:18PM -0500, Antoine Beaupré wrote:
> On 2019-01-22 15:21:19, Daniel Kahn Gillmor wrote:
> > If i was responsible for maintaining jessie, i'd prefer to go the route
> > of the backported fixes, but i don't have the capacity to spend a lot of
> > time on jessie itself, so i guess my preferences should be weighed
> > accordingly.
> 
> So I understand where you're coming from. As you suggested, however, I
> feel I should give more weight to my LTS and security team members in
> this specific case. If this was just enigmail and gpg, I would
> definitely defer to you as you are a core maintainer of those packages.

agreed (on both).

> The update touches much more than the gpg toolchain. I don't feel
> comfortable spending more time testing the repercussions of the change
> throughout the ever expending dependencies of gcrypt.
> 
> So I will look at sending a EOL announcement on the mailing list soon,
> and do the required debian-security-support changes as well, unless
> someone objects by the end of the week. It's too bad all this work will
> get lost, but I don't have the energy to push this one against the tide
> anymore. And if someone would or could have picked it up, they would
> have done so already.

I (now) think that's a sensible cause of action.

I also think enigmail should be marked as not security supported in jessie
(anymore) in src:debian-security-tracker.

> The best course, at this point, seems to let this die already.

yes, as sad as it is that you spend quite some time on this...

& thank you for all your work on this, even if mostly in vain!


-- 
tschüß,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: RFC / Call for testing: ghostscript

[Moritz Mühlenhoff]

On Wed, Jan 30, 2019 at 03:02:53PM +0100, Markus Koschany wrote:
> The truth is the -dSafer option gives a false sense of security even in
> the latest release and we will probably continue to see more of those
> issues.

Obviously, any deployment which processes documents should use additional
hardening, e.g. running ghostscript in firejail, but we still need to fix
these.

> The version in Jessie is more than seven years old already, so
> you have to carefully weigh the usefulness of backporting the latest
> stable release and the risk of breaking reverse-dependencies. The
> targeted approach worked well so far and all known vulnerabilities were
> addressed. The Jessie version is not any less secure than the version in
> Stretch and the codebase is very different.

No systematic triage has happened for older GS versions and given the rate
of findings by taviso there're bound to be issues which were fixed in
the past, but didn't get a CVE assigned. We need to look at the big picture
here.

> The point was you had to deal with regressions but the original version
> in Stretch was much more recent than the one in Jessie. You cannot rule
> out this will be the only functional change for Jessie users.

The API hasn't changed between jessie and the current 9.26 versions in
stretch, I don't expect any real issues. Ubuntu also rebased 14.04/trusty
to 9.26.

Cheers,
Moritz