Date: Wed, 7 Oct 2020 19:18:56 +0000 From: Jeremy Stanley <fungi@...goth.org> To: oss-security@...ts.openwall.com Subject: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 On 2020-10-07 21:00:35 +0300 (+0300), Georgi Guninski wrote: > https://lists.debian.org/debian-security/2020/10/msg00000.html > > === > /home/loser is with permissions 755, default umask 0022 > > on multiuser machines this sucks much. > > on a multiuser debian mirror we found a lot of data, > including the wordpress password of the admin. > === It's tradition that on multi-user systems, users would want to share data with one another and also serve content from their home directories in Web sites. Further, it's not at all uncommon for sysadmins to not understand or consider the system defaults when making deployment decisions and failing to secure sensitive files. As a long-time Debian user myself, I agree that this default is showing its age, and can represent a risk for operators who overlook it. > Then in the thread someone with @debian.org email explains > to me it is a feature, not a bug. Nowhere in that response do they call it a feature, and it's disingenuous of you to imply that they did. It's a default, which is almost always going to be a balance between two (or more) competing needs. Also, I encourage you to take a guess at how many people there are "with @debian.org email" (hint, it's not a small number). A more informative response would probably have been to point you to https://wiki.debian.org/Debate/umask which provides pointers to where and how this would need to be solved in the long run. > In a addition, they suggest to tell them the mirror, lol. Yes, do you fault them for wanting to remove a likely compromised server from the network of volunteer-run package mirrors? > Are debian detached from reality? Your brusque and insulting attitude (saying their choices suck, calling them detached from reality, laughing at their explanations) is likely to trigger glib responses and cause people to be less inclined to pay attention to what you have to say. -- Jeremy Stanley Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.