Re: Sourceware / GNU Toolchain at Cauldron

[Carlos O'Donell <carlos@redhat.com>]

On 9/28/22 07:14, Frank Ch. Eigler wrote:
> Hi -
> 
> 
>> - Defense in depth
>>   - Multiple servers, each with distinct services.
>>   - Multiple servers for one service where possible.
> 
> Depends on the threat model.  Which one are you concerned about?
 Completely agree.

Consider an attacker simply looking to disrupt services (DoS, DDos) using another
service on the current system. The more services present on the system the more
the opportunity to do this kind of attack.

This isn't a full threat model, but they are prevalent enough that it is expected
risk decreases as the number of services on the system decreases. The cost to
manage goes up too, so there is a tradeoff that the projects using the service
must decide is acceptable.

>> - If governments want to use FOSS tools directly, do we need to
>>   comply with security standards like a contractor would?
>>   - Does NIST SP 800 53r5 apply to Sourceware.org?
>>     [...]
> 
> If we don't have evidence that it does, what is the purpose of bringing it up?
 
Two downstream users of our sources have cited NIST SP 800-53 as something they
had to comply with, and I want to dig more into two possible scenarios:

(a) Is there an expectation that upstream source control repositories need to meet this
    regulation as well as the downstreams?

(b) If we met the regulation would it improve FOSS adoption and support downstream users?

With the new "infrastructure" bugs in bugzilla I filed this:
https://sourceware.org/bugzilla/show_bug.cgi?id=29629

I noted that gitlab and github both have slightly different technical answers to this
question.
 
>> It is two proposals.
>>
>> A fiscal sponsor for infrastructure in the OpenSSF via the GNU
>> Toolchain Infrastructure project at the Linux Foundation.
>>
>> A proposal to use managed services with the Linux Foundation IT for
>> projects currently at sourceware.org.
> 
> Are they separable?
They are, the fund is designed to support more than just managed services.

The details are posted here:
https://sourceware.org/pipermail/overseers/2022q3/018896.html

-- 
Cheers,
Carlos.