Why does Debian change software?
blog.liw.fi
Why does Debian change software?
1–10 of 210 posts
Re: Why does Debian change software?
#2Not the best name for the article. My first guess was version changes, or software being added/removed from repo. Turns out this is about source code modification.
Re: Why does Debian change software?
#3But what does Debian see as the risks of patching the software they distribute and how do they mitigate them?
Re: Why does Debian change software?
#4 Debian will remove code that “calls home”
or tries to update software in a way that
bypasses the Debian packaging system.
Re: Why does Debian change software?
#5The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature?
[1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...
Re: Why does Debian change software?
#6Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.
It's not guaranteed that they manage to catch all the software that does this though :D
Re: Why does Debian change software?
#7Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.
It's not guaranteed that they manage to catch all the software that does this though :D
Any such leftover behavior is going to be a reportable and fixable bug then.
Re: Why does Debian change software?
#8The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature? [1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...
Do you have any statistics that show that Debian patches introduce more CVE worthy bugs than the software already contains? OpenSSL doesn't really have a pristine history.
Let's not forget that the patch had been posted on the OpenSSL mailing list and had received a go ahead comment before that.
Having said that, if you're asking if there's a penetration test team that reviews all the patches. No there isn't. Like there isn't any such thing on 99.999999999% of all software that exists.
Re: Why does Debian change software?
#9The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature? [1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...
https://research.swtch.com/openssl provides more context: openssl was asked about the change, and seemingly approved it (whether everyone understood what was being approved is a different question). It's not clear why openssl never adopted the patch (was everyone else just lucky?), but I wonder what the reaction would have been if the patch had been applied (or the lines hidden away by a build switch).
Re: Why does Debian change software?
#10The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature? [1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...
Do you have any statistics that show that Debian patches introduce more CVE worthy bugs than the software already contains? OpenSSL doesn't really have a pristine history. Let's not forget that the patch had been posted on the OpenSSL mailing list and had received a go ahead comment before that. Having said that, if you're asking if there's a penetration test team that reviews all the patches. No there isn't. Like th…
That was the kind of answer I wanted to hear, thanks. (Of course I don't think Debian should be blamed for incidents.) Does Debian send other patches as well? For example, I didn't know that Debian also often creates a man page by its own.