Subject: Re: Protections against a mad maintainer?

From: [email-masked] (Bruce Perens)
Date: Wed, 11 Sep 96 10:18 PDT

From: Jean Orloff <[email-masked]>
> It just occured to me that any evil intentioned or mad maintainer could add
>	rm -rf /
> or anything of this sort in a postinst script.
>
> I just would like to know what kind of protection debian could offer against
> such an unpleasant event. I am sure Bruce cannot afford to be very picky in
> the choice of maintainers

This is a problem with any software - commercial or otherwise. How do you
know that a disgruntled Microsoft employee has not planted a booby-trap
in Windows 95? Indeed, several Microsoft products have shipped with viruses.
I think this is more of a problem with commercial software, since there is
much less scrutiny of the source code and the resulting binary programs than
there is with free software.

We identify the maintainers, and we provide security on the master system
so that non-maintainers will not be uploading packages. We encourage
maintainers to PGP-sign uploads, although we can't do it for everyone since
some countries (like France) prohibit encryption. If there ever was a problem,
we'd be able to trace it back to the cause and a criminal prosecution would
be the probable result.

We also have a testing program that goes on continuously. Users are on the
mailing lists the minute a problem comes up.

	Thanks

	Bruce

---

From: [email-masked]
Date: Mon, 16 Sep 1996 15:57:46 GMT

Hi Sue,
  I read with intrest your posting, you do make valid points with refrence to
the trade off's ... That is assuming the person involved is rational.  Believe
me, if you want to make sure that an upload from you is untracable... It can be
done .. and finally, it is a simple matter to delay the phenomenon so that it
occurs at a certain day of after a finite number of executions, 666 for
example..
	It is a frightening thought,...

Regards 

Jonathan

>Hi Jean --
>
>There are (at least) 3 counterarguments to the concern that Debian 
>maintainers could maliciously add dangerous commands to their 
?{pre,post}{inst,rm} scripts:
>-- the same package system which is open to many for development is 
>equally open to many for testing.
>-- by having both "stable" and "unstable" releases, Debian distinguishes 
>between packages which are [likely to have been] tested and those which 
>are not.
>-- as the saying goes, "Never interpret as malicious that which could 
>also be explained by stupidity."   Humans at commercial software firms
>are no more protected from their own stupidity than humans who are working
>to provide free software, _and_ who are offering the world the opportunity
>to scrutinize their source code.  
>
>Another way to pose the question is, what would motivate a developer to
>include mailicious software?  He could be pretty sure that the offending
>code would be found quickly, and he would be identified (via PGP keys)
>with the problem.  The perpetrator would be immediately banned from 
>using the system.  And all he got for his trouble was to inconvenience one
>or a few unknown, randomly selected, victims.  Not a very good tradeoff.
>
>All the same questions being asked of free software should be asked, 
>of course, of the commercial software...  
>
>HTH,
>Susan Kleinmann

---

From: [email-masked]
Date: 16 Sep 1996 18:05:19 -0000

Jonathan, writing from vega.netg.se:
> Believe me, if you want to make sure that an upload from you is
> untracable... It can be done ..

Untraceable is a matter of degree.

Forging someone's pgp signature is about as difficult as breaking
into a commercial software publisher's office and replacing the
master-copies of software there.  Sure, it can be done, but this
possibility doesn't favor one distribution channel over another.

Also, "untraceable" has a strong element of risk -- you're going
to have a presence somewhere, but does anyone care enough to want
to investigate that presence?  If someone cares, then maybe you find
out you're not as untraceable as you'd thought.

-- 
Raul