Re: Sourceware / GNU Toolchain at Cauldron

["Frank Ch. Eigler" <fche@elastic.org>]

Hi -

> >> - Defense in depth
> >>   - Multiple servers, each with distinct services.
> >>   - Multiple servers for one service where possible.
> > 
> > Depends on the threat model.  Which one are you concerned about?

> Consider an attacker simply looking to disrupt services (DoS, DDos)
> using another service on the current system. The more services
> present on the system the more the opportunity to do this kind of
> attack.

I don't quite see the "more opportunity".  If someone wants to take
out a particular source hosting site, they'll go after it, whether or
not the target site is sharing resources with others.

We are fortunate to use fully decentralized source control systems,
where full clones at developers - and at other services like github
etc. - are routine, and permit work to continue.  I'd be surprised to
hear of any organization hoping to hurt free software development by
DoS'ing the sites - it'd be a futile gesture.


> >> - If governments want to use FOSS tools directly, do we need to
> >>   comply with security standards like a contractor would?
> >>   - Does NIST SP 800 53r5 apply to Sourceware.org?
> >>     [...]

> > If we don't have evidence that it does, what is the purpose of
> > bringing it up?

> Two downstream users of our sources have cited NIST SP 800-53 as
> something they had to comply with

Downstream corporations distributing products based on FOSS are
irrelevant to this question.


> and I want to dig more into two possible scenarios:
>
> (a) Is there an expectation that upstream source control
> repositories need to meet this regulation as well as the
> downstreams?  (b) If we met the regulation would it improve FOSS
> adoption and support downstream users?

I can only assume that you already have evidence/argument in the
affirmative for these questions, otherwise why are we discussing any
of this?  Can we hear that evidence/argument please?


> >> It is two proposals.
> >>
> >> A fiscal sponsor for infrastructure in the OpenSSF via the GNU
> >> Toolchain Infrastructure project at the Linux Foundation.
> >>
> >> A proposal to use managed services with the Linux Foundation IT for
> >> projects currently at sourceware.org.
> > 
> > Are they separable?
>
> They are, the fund is designed to support more than just managed services.

That's not quite the same thing.  Are the funds available for novel
things that the various development communities may start requesting,
**instead of** redirecting the vast majority to LF-IT for managed
services?  Or, are managed services an inseparable component of this
proposal?


- FChE