public inbox for cygwin-xfree@sourceware.org
help / color / mirror / Atom feed
From: Keith Packard <keithp@keithp.com>
To: Keith Whitwell <keith@tungstengraphics.com>
Cc: Keith Packard <keithp@keithp.com>,
"roland@webde" <devzero@web.de>,
cygwin-xfree@cygwin.com, xserver@pdx.freedesktop.org,
dri-devel <dri-devel@lists.sourceforge.net>
Subject: Re: security, cvs, was Re: interface bindings of x-server
Date: Wed, 19 Nov 2003 08:49:00 -0000 [thread overview]
Message-ID: <E1AMO1w-0005fy-00@evo.keithp.com> (raw)
In-Reply-To: Your message of "Wed, 19 Nov 2003 08:15:22 GMT." <3FBB269A.9080306@tungstengraphics.com>
Around 8 o'clock on Nov 19, Keith Whitwell wrote:
> Is it foolhardy to continue running anoncvs, especially without the checks &
> balances which caught the backdoor attempt in linux?
The pserver running on fd.o has been specially hacked to run as 'nobody'
from the very start, unlike most pserver implementations which run as root
and setuid to the user specified in the CVS password file. I think this
should make it rather difficult to affect any of the repositories on fd.o
unless files in those directories are world writable.
But, if we want to be extra paranoid, the right solution is to have
anoncvs use a separate mirror machine rsynced from the main repository.
I'd like to avoid that as it makes anoncvs 'second class' which seems like
it will encourage more people to ask for project membership that they
otherwise don't really need just to avoid the anoncvs delay.
Of course, an even better solution would be to throw CVS in the garbage
and use some more robust configuration management system. Sigh.
-keith
next prev parent reply other threads:[~2003-11-19 8:49 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <038f01c3ae12$35ca4a80$2000000a@schlepptopp>
[not found] ` <3FBA82CC.6050500@msu.edu>
2003-11-19 1:53 ` roland@webde
2003-11-19 4:13 ` Keith Packard
2003-11-19 8:15 ` security, cvs, was " Keith Whitwell
2003-11-19 8:35 ` [Dri-devel] " Mike Mestnik
2003-11-19 8:49 ` Keith Packard [this message]
2003-11-19 9:22 ` roland@webde
2003-11-19 9:35 ` Keith Packard
2003-11-19 9:52 ` Corinna Vinschen
2003-11-19 19:34 ` Alan Coopersmith
2003-11-19 21:12 ` roland@webde
2003-11-19 23:49 ` Dave Dodge
2003-11-20 0:13 ` Alan Coopersmith
2003-11-20 0:13 ` Keith Packard
2003-11-20 0:32 ` Dave Dodge
2003-11-19 14:01 devzero
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=E1AMO1w-0005fy-00@evo.keithp.com \
--to=keithp@keithp.com \
--cc=cygwin-xfree@cygwin.com \
--cc=devzero@web.de \
--cc=dri-devel@lists.sourceforge.net \
--cc=keith@tungstengraphics.com \
--cc=xserver@pdx.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).