On Sat, Mar 30, 2024 at 10:49:33AM +0200, Jonathan Carter wrote: >... > On 2024/03/29 23:38, Russ Allbery wrote: > > I think the big open question we need to ask now is what exactly the > > backdoor (or, rather, backdoors; we know there were at least two versions > > over time) did. > > Another big question for me is whether I should really still > package/upload/etc from an unstable machine. It seems that it may be prudent > to consider it best practice to work from stable machines where any private > keys are involved. For me it's just been so convenient to use unstable > because it helps track changes that affect my users by the time it hits > stable and also find bugs early that I care about, but perhaps I just need > to make that adjustment and find more efficient ways to track unstable > (perhaps on additional machines / VMs / etc). Not sure how other DDs think > about this, but I'm also curious how they will deal with this, because > there's near to no filter between unstable and the outside world, and this > is probably not the last time someone will try something like this.
I don't think it is such a clear case that stable is more secure than unstable. The uncommon part might be that it was detected so early, and only due to a minor visible side effect on performance found by pure luck that a better implementation of the exploit might have been able to avoid. The timing of the 5.6.0 release might have been to make it into the upcoming Ubuntu LTS, it didn't miss it by much. And an intentional backdoor is not necessarily much different from one caused by a bug: Heartbleed (CVE-2014-0160) in OpenSSL made it into stable. The Debian-specific bug that broke the OpenSSL RNG resulting in predictable keys (CVE-2008-0166) made it into stable. There have even been cases where an attacker realized that a non-security bugfix fixed something that can be exploited. In such cases unstable might get fixed, but stable not. Perhaps a case can be made that stable is slightly more secure, but an intentional backdoor that gets detected early is rather rare so far. > -Jonathan cu Adrian
