Extra security measures for next week's releases
postgresql.org
Extra security measures for next week's releases
1–10 of 43 posts
Re: Extra security measures for next week's releases
#2As much as I don't like stuff being hidden from me I think this is a good move. The title made me think it was a permanent move but it's just till this update is completed. The bad part of this is, that it's obviously a very serious vulnerability...
Re: Extra security measures for next week's releases
#3This is an interesting tradeoff between responsible security and open source transparentness that the Postgres team is facing. I personally think this is a good way to handle a situation with a serious bug, but there are some questions it raises...
Is Postgres working with downstream teams to have everything in place to do a coordinated security release? For instance, are they working with the likes of Debian's security team (for example) to not only make the direct source pullable, but also have releases available to as many users as possible in the platform preferred formats?
If they are, how do they do keep this under wraps? It seems like the kind of thing that would require a fairly wide "pre-disclosure", and managing trust in a large network gets hard.
Re: Extra security measures for next week's releases
#4Wouldn't it make somewhat more sense to branch to a private repo without telling the public, make the required changes there, create the packages from that branch, and then later push the changes into the public repo?
The way they are doing it now entices hackers who don't know the exploit but happen to have a recent clone of the repo to look for the big hole in hopes of finding it ahead of the fix. Granted, hackers are probably already doing that sort of thing on high profile services like Postgresql to begin with, but in my experience it is easier to find something exploitable when you already know something exploitable exists than it is when you're just randomly poking around. At the very least it makes it easier to stay motivated and focused.
Re: Extra security measures for next week's releases
#5As much as I don't like stuff being hidden from me I think this is a good move. The title made me think it was a permanent move but it's just till this update is completed. The bad part of this is, that it's obviously a very serious vulnerability...
And now the bad guys know there is a very serious vulnerability, somewhere.
Re: Extra security measures for next week's releases
#6Wouldn't it make somewhat more sense to branch to a private repo without telling the public, make the required changes there, create the packages from that branch, and then later push the changes into the public repo? The way they are doing it now entices hackers who don't know the exploit but happen to have a recent clone of the repo to look for the big hole in hopes of finding it ahead of the fix. Granted, hackers…
Yes, folks are already attempting to find exploitable weakness in these projects. We can assume they exist. Just mentioning that one is confirmed doesn't really lend any insight. The surface area is pretty huge on that project.
If I had to guess where it is, though, I'd bet it was in a PL module. I'm sure there is quite a bit of activity around finding NativeHelper-like situations.
Re: Extra security measures for next week's releases
#7As much as I don't like stuff being hidden from me I think this is a good move. The title made me think it was a permanent move but it's just till this update is completed. The bad part of this is, that it's obviously a very serious vulnerability...
And now the bad guys know there is a very serious vulnerability, somewhere.
They'd know it was there as soon as a patch was released, anyway.
Re: Extra security measures for next week's releases
#8As much as I don't like stuff being hidden from me I think this is a good move. The title made me think it was a permanent move but it's just till this update is completed. The bad part of this is, that it's obviously a very serious vulnerability...
And now the bad guys know there is a very serious vulnerability, somewhere.
Knowing that there is a vulnerability might motivate them to look for it, but given the size of the software, I doubt they'll be able to find it without knowing more.
Re: Extra security measures for next week's releases
#9As much as I don't like stuff being hidden from me I think this is a good move. The title made me think it was a permanent move but it's just till this update is completed. The bad part of this is, that it's obviously a very serious vulnerability...
And now the bad guys know there is a very serious vulnerability, somewhere.
The bad guys already assumed that.
Seriously - the entire premise of IT security (no matter the color of your hat) is the assumption that there is no such thing as a secure computer.
Re: Extra security measures for next week's releases
#10Earlier quoted context omitted.
And now the bad guys know there is a very serious vulnerability, somewhere.
Knowing that there is a vulnerability might motivate them to look for it, but given the size of the software, I doubt they'll be able to find it without knowing more.
You'd be surprised; on Windows, at least, there are people who reverse engineer the security patches from Microsoft in order to determine the initial vulnerability[1].
[1] http://www.phreedom.org/presentations/reverse-engineering-an...
Edit: Misinterpreted your post. You're right, it's unlikely that they'll guess where it is until a patch comes out.