Where are all the security updates?

Great!!!

El sáb, 23 de ago 2014 a las 9:17 , name at domain escribió:
> There are going to be a lot of changes for Trisquel 7, so we should
> just wait.
> https://trisquel.info/en/issues/12244

Great!!!

El sáb, 23 de ago 2014 a las 9:17 , name at domain escribió:
> There are going to be a lot of changes for Trisquel 7, so we should
> just wait.
> https://trisquel.info/en/issues/12244

It has been mostly rectified in Trisquel 7 (the packages modified by Trisquel haven't been updated, it seems). I don't know about T6.

Strongly agree
El 24/08/2014 18:20, <name at domain> escribió:

> When running any operating system security has to be the top priority then
> stability. There are no excuses when it comes down to security. Hopefully
> this is taken serious and rectified soon.
>

6.0.1 didn't have updates either for a few weeks.

It is but quidam is working on the plumbing.

https://trisquel.info/en/issues/12244

Can more confirm this? I also haven't had any security updates in awhile. Thanks

I reopened the bug.

@Mzee, this is the bug report: https://trisquel.info/en/issues/12244

Ruben said he disabled the automatic taking of updates from Ubuntu in preparation for the new release. Anyway, this is not a reason to completely stop the security updates since he can do it manually.

> This is a VERY serious issue. Why is there not even an official
> comment? I feel very uncomfortable recommending Trisquel to anyone at
> this point if there are no guaranteed security updates.

Forum readers, don't let my membership status fool you, this is all
strictly IM-experienced-O only.

I differ. Timeliness of security updates is just one security metric,
it isn't the be all and end all of security. Yes, it's _significant_
that updates have been delayed but the really dangerous part of those
bugs was their lifetime before discovery. Just as with Heartbleed
the prediscovery period is where most of the danger is.

The reality is bug and security patches are just as likley to
introduce additional security and functional bugs as any other new
code. Further a good number of security bugs cover local exploits,
which mostly are a concern for multiuser systems not the average
Trisquel user. Most remote exposures have no known exploits, and many
are avoided when you're in a typical end user 'behind a firewall (home
/public wifi/LAN or GPRS/3/4G environment. Thus unless any of the
outstanding fixes are critical for remote intrusion and have known
exploits[*] many a pro-IT shop would have you wait a lot longer than
Ruben has with these thus far.

So a delay _is_ significant, by all means prompt Ruben again, but as a
general rule a few weeks is not 'VERY serious.' Think of how long it
took websites to roll out the Hearbleed fixes. E.g. it took my bank a
month of auditing to confirm it wasn't using openssl anywhere.

I'll point out Ruben would have the time to handle these manually if
he was working full time on Trisquel as he used to. Therefore the
proper answer to security update concerns is to become an Associate
Member so Trisquel has the money to pay him to do that.

[*] you can check this by looking up the CVEs they fix on the web.

"Why is there not even an official comment?"

I think there was - See the bug report.

> I know some of you do have access to Ruben - he ignores outsiders
> and has ignored my offers to help in the past, but if you do have
> contact with Ruben, the most important message I'd give him is that
> he cannot do everything.

I'm also a Trisquel "outsider" here.

Regarding security, although I'm not entirely familiar with the process
I doubt Ruben would hand over control of the updates repository to an
outsider.

There are other ways that outsiders can help--check out the issues page
on the website for problems. I'm sure Ruben would accept patches for
those issues.

The best way of getting in contact with Ruben is via the Trisquel IRC
channel on freenode, his username is quidam. Just keep in mind that he's
in the timezone for Spain.

Andrew.

not only Trisquel, he has to manage even icecat as stated in a previous post in this forum.

> "but the really dangerous part of those bugs was their lifetime before
> discovery"
>
> No, that gets it backwards. The really dangerous part is when the
> vulnerability is public and can be exploited by anyone. It is critical
> that vulnerabilities are patched as soon as they become public.

I think the brevity of my language has led to us talking at cross
purposes. If I were to expand my original 'prediscovery' statement
with the proviso 'providing you're applying security patches in a
_appropriate_ fashion' I think you'd be in agreement with it.

I'm in full agreement with your statement if e.g. we take the nonsense
documented here:

http://www.cert.org/historical/advisories/ca-2001-02.cfm

Where DNS/BIND vulnerabilities, which are a security exposures against
critical Internet infrastructure, went unpatched by some distributors,
professional sysadmins etc for over a year. Appalling, just as the
current/recent BGP nonsense is/was.

However, in the context of a desktop/laptop user who as per the
default has Update Manager set to check for patches once a week and as
is common puts off applying them in a haphazard fashion, perhaps for
several weeks, until it is 'more convenient.' Then a shortish delay
in shipping ordinary security patches at the distro end while
_significant_ is not grounds for proclaiming the end of the (Trisquel)
world. We have to remember the GNU/Linux distro security patch
process is best in class and providing the delay remains modest and
things like the next Heartbleed don't languish Ruben is still doing a
lot better than many proprietary offerings.

So my message is essentially - read the back of the Hitchhikers' Guide
to the Galaxy (DON'T PANIC). That said, Ruben slipped on security
patch timeliness during Toutatis beta too, so twice is definitely
something which needs publicly addressing with a statement.

> It's just another example of the project's difficulties in relying on
> one person. Looking back on the forums, many people have arrived with
> great enthusiasm and a range of skills, and have offered to help in
> all sorts of ways, but Ruben usually doesn't respond, seems not to
> ever read the forums, and rarely responds on IRC.

IMO much of this is down to what FSF call 'geek culture' (others
mistakenly call it hacker culture). If one reads around a bit, say
some of ESR's essays and package maint-guide, then you'll find that
volunteers are expected to be self motivated thus teach themselves and
keep contributing in the publicised ways until they make quality and
commitment criteria for being accepted as a dev (or whatever). Any
volunteer organisation has to triage out those who say they want to
contribute but don't sustain effort so they're not unecessarily
expending valuable limited resources on them - this is the geek method
for it, which (obviously) works.

Although even by those communication standards Ruben misses somethings
e.g. announcing the change from bazaar to git repos for the package
helpers so people have way to help if they're so inclined. Nor is he
'perfect' or possessed of some all seeing wisdom. From what I can
work out he's relatively recently corrected the classic small business
mistake of assuming customers will just come to you without you doing
anything by issuing press releases and giving talks. However, by
extension many forum critics apportion themselves knowledges and
wisdoms which if they actually had them would best be demonstrated by
coding and submitting patches or similar. Ruben is at least
demonstrating he's learning from his mistakes and doing something
about the matters.

The current security update delays are in fact because he's putting in
the infrastructure to make contributing to the distro easier and more
varied in order to build a community of developers etc. So that issue
is presently being (belatedly) addressed. Given a part time Ruben is
effectively the current limit of Trisquel's resources then something
was bound to give. Plainly the migration to the new system was not as
straightforward as he and Aklis (who was tasked with part of the work)
had planned.

You say:

"But at the moment, the message is that Free software is lagging
behind, is buggy and is insecure."

True and not true. Trisquel has deliberately chosen to be a derivative
of Ubuntu LTSes so it's on a part of the stability axis where 'lagging
behind' is accepted. In many real life use cases this is desirable.
Try Parabola GNU/Linux if you want not lagging (aka bleeding edge).
You'll learn it is as Ruben says the users' blood which is spilled and
it requires you join a cult where maintaining/admining ones computer
is more important than making productive use of it. Also, yes, as yet
there isn't a free software program for everything - just all the
common ones and a large number of others besides.

All software has bugs, they're unavoidable (well short of the
singularity or equivalent software writing AI tech perhaps). Free
software is no more buggy than proprietary software and Trisquel is
for the most part only as buggy as Ubuntu. If a particular bug sticks
in your craw do as I do, code a patch, use it yourself and submit it -
you can't do that with proprietary software. Remember quite a few of
the packages are for pre v1.0 software which is by definition 'use
only if you want to help with bug squashing / new features' because
it's still in development.

As to 'insecure,' there's no such thing as a theoretically secure
computer, although wise opinion has it a dismantled computer which is
never used and is locked in a vault in Fort Knox might qualify. Real
security practice is about balancing a range of factors specific to
the situation at hand. Which Ruben is quite capable of.

Admittedly we're in a period of delayed security patch delivery, but
from this forum how many Trisquel users are complaining of computer
pathogen infections or compromises? Compare this with some
proprietary anti-virus companies' estimates that in the region of 90%
of W$ machines are infected? With Ubuntu's practice of including
proprietary blobs, drivers and other non-free software, even with the
current delay you can't reliably claim 'less secure than upstream' let
alone 'insecure.'

IMO if Ruben is right and this new system helps build a decent dev etc
community then he has the balance about right at a 2/3 week delay for
common or garden lesser security patches given the apparent nature of
the average Trisquel user. If educational and business users et al
feel the need for better than this for the duration of this system
commissioning project then they can club together and stump up the few
K of Euros it will take for him to take bits of unpaid leave from his
day job and process the updates manually.

> Until there are others involved in developing the project, or the lead
> developer is at least heavily invested, Trisquel will continue to be
> seen as a novelty.

I don't see how Ruben living off just a part time job to be free to
develop Trisquel in the rest of the week can be described as anything
other than 'heavily invested.'

>
> I know some of you do have access to Ruben - he ignores outsiders and
> has ignored my offers to help in the past, but if you do have contact
> with Ruben, the most important message I'd give him is that he cannot
> do everything. He has done great work, and this can be built on to
> become something the Free software community can be proud of, but by
> holding onto everything himself he is critically harming the project
> he loves, and Free software in general.

As I've said, these delays are because he's fixing that. But don't
expect at the end of this contributor enablement project for there to
be a meeter and greeter who gives volunteers warm (virtual) hugs and
encouragement - there aren't the people to do it. Few free software
organisations have such resources, and when they have they focus them
on minorities such as women.

Not that I don't have sympathy with wanting that encouragement,
handholding and well just some thanks occasionally. That's why I
gravitate to chatting and answering questions on trisquel-users rather
than handling issues or writing patches. On trisquel-users you get
thanked more often.

I should explain I style myself as a 'disability rocket scientist'
i.e. the 'science' of regaining things others take for granted which
you lost as a result of your disability. Obviously when other
people's molehills are my mountains it's extra hard to keep going
without feedback. So things like a simple thank you are even more
valuable to me than is usual.

Yet based on a handfull of days when I was well enough I was the only
person to submit patches to trisquel-devel in nearly a year. Exhuming
skills I hadn't used in decades and learning the tools in question
almost from scratch in the process. Admittedly, you have to allow
that with over 30 years in computing I've obviously accrued over those
famous 10,000 hours in it and yeah, I've surprised the local medics.
But, still if I can do this, and keep coming back when I'm well
enough, you have to say there are no insurmountable barriers to
volunteering for Trisquel. IMO volunteers who claim to the contrary
are exhibiting what Sartre calls 'bad faith.'

And so if you're concerned about the apparent sole developer situation
(when e.g. Legimet has had patches accepted), these patch delays and
all the other things you've mentioned then either do something more to
help the project (not necessarily a dev) or as I said before pay for
an associate membership so we get more Ruben time. At it's cheapest
membership is the cost of two coffees a month (UK prices). As the
British proverb goes 'an ounce of practice is worth a pound of
theory.'

@jxself: The last official comment is almost a month old now.

I don't think anything has changed. :)