Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 7 Oct 2020 19:18:56 +0000
From: Jeremy Stanley <>
Subject: Re: Debian FEATURE: /home/loser is with permissions
 755, default umask 0022

On 2020-10-07 21:00:35 +0300 (+0300), Georgi Guninski wrote:
> ===
> /home/loser is with permissions 755, default umask 0022
> on multiuser machines this sucks much.
> on a multiuser debian mirror we found a lot of data,
> including the wordpress password of the admin.
> ===

It's tradition that on multi-user systems, users would want to share
data with one another and also serve content from their home
directories in Web sites. Further, it's not at all uncommon for
sysadmins to not understand or consider the system defaults when
making deployment decisions and failing to secure sensitive files.

As a long-time Debian user myself, I agree that this default is
showing its age, and can represent a risk for operators who overlook

> Then in the thread someone with email explains
> to me it is a feature, not a bug.

Nowhere in that response do they call it a feature, and it's
disingenuous of you to imply that they did. It's a default, which is
almost always going to be a balance between two (or more) competing
needs. Also, I encourage you to take a guess at how many people
there are "with email" (hint, it's not a small number).

A more informative response would probably have been to point you to which provides pointers to
where and how this would need to be solved in the long run.

> In a addition, they suggest to tell them the mirror, lol.

Yes, do you fault them for wanting to remove a likely compromised
server from the network of volunteer-run package mirrors?

> Are debian detached from reality?

Your brusque and insulting attitude (saying their choices suck,
calling them detached from reality, laughing at their explanations)
is likely to trigger glib responses and cause people to be less
inclined to pay attention to what you have to say.
Jeremy Stanley

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.