Subject: Protections against a mad maintainer?

From: Jean Orloff <[email-masked]>
Date: Wed, 11 Sep 1996 11:53:56 +0200

Hi,

It just occured to me that any evil intentioned or mad maintainer could add
	rm -rf /
or anything of this sort in a postinst script.

I just would like to know what kind of protection debian could offer against
such an unpleasant event. I am sure Bruce cannot afford to be very picky in the
choice of maintainers (there are orphan packages crying for one).

This is the kind of argument against Debian being used at large in my
institute, the result being that half man pages are missing, even if you have
such a complete manpath as

MANPATH=/lapphp8/users/orloff/local/man:/usr/man:/usr/local/man:/usr/local.old/man:/lapphp0_2/local/X11R5/man:/lapphp1_1/usr/man:/lapphp1_1/usr/local/man:/usr/contrib/man

Amities,

		Jean Orloff
+++++++++	+	+	+	+	+	+	+	++++++
+Tel:(33)50.09.16.75   Fax:(33)50.09.94.95  http://lapphp0.in2p3.fr/~orloff/ +
+++++++++	+	+	+	+	+	+	+	++++++
In a Belgrade hotel elevator:
       To move the cabin, push button for wishing floor. If the cabin 
       should enter more persons, each one should press a number of 
       wishing floor.  Driving is then going alphabetically by 
       national order.
+++++++++	+	+	+	+	+	+	+	++++++

---

From: [email-masked] (J.H.M.Dassen)
Date: Wed, 11 Sep 1996 13:31:42 +0200 (METDST)

> or anything of this sort in a postinst script.

Yes. Or hide stuff in the binaries. You need root permissions to install
stuff in /bin etc.

> such a complete manpath as

This argument is not limited to Debian. It is as valid for any binaries
whatsoever, including those in commercial systems (how do you know that
your nice Commercial Unix (or DOS, or...) will not autodestruct on 
March 4, 1997?)

This is a matter of trust.

If you don't trust binaries, install only a minimal system, read the
source (every line of it), understand it, compile it and install it.

At least with free software, you have the source...
(as Joey puts it: "never trust an OS you don't have the sources for").

And with Debian, uploads are PGP-signed by their (known) maintainer, so
you can at least be reasonably sure from whom they're coming from.

If I would want to destroy systems, I'd upload some binaries to sunsite;
with "reasonable" precautions, it is very difficult or even impossible to
trace them back to me.

This kind of subject comes up very often on comp.security.{unix,misc}
and likely comp.risks too.

Ray
-- 
ART  A friend of mine in Tulsa, Okla., when I was about eleven years old. 
I'd be interested to hear from him. There are so many pseudos around taking 
his name in vain. 
- The Hipcrime Vocab by Chad C. Mulligan

---

From: "Susan G. Kleinmann" <[email-masked]>
Date: Wed, 11 Sep 1996 08:50:23 -0400

Hi Jean --

There are (at least) 3 counterarguments to the concern that Debian 
maintainers could maliciously add dangerous commands to their 
{pre,post}{inst,rm} scripts:
-- the same package system which is open to many for development is 
equally open to many for testing.
-- by having both "stable" and "unstable" releases, Debian distinguishes 
between packages which are [likely to have been] tested and those which 
are not.
-- as the saying goes, "Never interpret as malicious that which could 
also be explained by stupidity."   Humans at commercial software firms
are no more protected from their own stupidity than humans who are working
to provide free software, _and_ who are offering the world the opportunity
to scrutinize their source code.  

Another way to pose the question is, what would motivate a developer to
include mailicious software?  He could be pretty sure that the offending
code would be found quickly, and he would be identified (via PGP keys)
with the problem.  The perpetrator would be immediately banned from 
using the system.  And all he got for his trouble was to inconvenience one
or a few unknown, randomly selected, victims.  Not a very good tradeoff.

All the same questions being asked of free software should be asked, 
of course, of the commercial software...  

HTH,
Susan Kleinmann

---

From: Dale Scheetz <[email-masked]>
Date: Wed, 11 Sep 1996 09:37:43 -0400 (EDT)

> > such a complete manpath as
I would argue that Debian's large and diverse development group provides
better protection from this kind of activity than smaller, closed
development groups. This gives us a large, diverse group of testers. It is
very unusual for a package to move from unstable to stable without someone
trying it out. Because of the new pgp signatures, only one person is
responsible for the contents of the package. This makes it unlikely that
someone smart enough to build a package would not understand their
identifiability. This means that the likelyhood of a "nasty" getting out
is small, and the identification of the perp is certain.
Tell your institute that Debian is better protected from this kind of
event than most Linux distributions.

Luck,

Dwarf

------------                                          --------------

aka   Dale Scheetz                   Phone:   1 (904) 877-0257
      Flexible Software              Fax:     NONE 
      Black Creek Critters           e-mail:  [email-masked]

------------ If you don't see what you want, just ask --------------

---

From: [email-masked] (J.H.M.Dassen)
Date: Wed, 11 Sep 1996 13:31:42 +0200 (METDST)

Ray

---

From: "Susan G. Kleinmann" <[email-masked]>
Date: Wed, 11 Sep 1996 08:50:23 -0400

Hi Jean --

HTH,
Susan Kleinmann

---

From: Dale Scheetz <[email-masked]>
Date: Wed, 11 Sep 1996 09:37:43 -0400 (EDT)

Luck,

Dwarf

------------ If you don't see what you want, just ask --------------

---

From: Jim Pick <[email-masked]>
Date: Wed, 11 Sep 1996 11:48:28 -0700

> source (every line of it), understand it, compile it and install it.

... and keep backups!!!

 - Jim

---

From: Boris Beletsky <[email-masked]>
Date: Thu, 12 Sep 1996 02:51:45 +0300 (IDT)

-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 11 Sep 1996, Jim Pick wrote:

jim>
jim>
jim>> 
jim>> This is a matter of trust.
jim>> 
jim>> If you don't trust binaries, install only a minimal system, read the
jim>> source (every line of it), understand it, compile it and install it.
jim>> 
jim>
jim>... and keep backups!!!

one prob.
u'll need to install _some_ bin's

___
Boris Beletsky <[email-masked]>
For pgp public key, e-mail me 
with subject "get pgp-key."
___
In Linux veritas