From: zimoun <zimon.toutoune@gmail.com>
To: "pelzflorian (Florian Pelz)" <pelzflorian@pelzflorian.de>,
Tobias Geerinckx-Rice <me@tobias.gr>
Cc: 59383@debbugs.gnu.org
Subject: [bug#59383] [PATCH] doc: Call out potential for downgrade attacks with time-machine.
Date: Mon, 21 Nov 2022 12:19:05 +0100 [thread overview]
Message-ID: <86a64kk11y.fsf@gmail.com> (raw)
In-Reply-To: <87wn7qn8rd.fsf@pelzflorian.de>
Hi,
On Sat, 19 Nov 2022 at 18:39, "pelzflorian (Florian Pelz)" <pelzflorian@pelzflorian.de> wrote:
>>> @quotation Note
>>> Naturally, no security fixes can be provided for old versions of Guix
>>> or its channels. This also means that careless use of @command{guix
>>> time-machine} opens the door to downgrade attacks.
>>> @xref{Invoking guix pull, @option{--allow-downgrades}}.
>>> @end quotation
>>
>> ‘Attack’ is a very big word. It should not end a paragraph. What
>> would the downgrade attack—distinct from a downgrade—look like?
Why not something like,
--8<---------------cut here---------------start------------->8---
@quotation Note
The history of Guix is immutable and @command{guix time-machine}
provides the exact same software as they are in a specific Guix
revision. Naturally, no security fixes are provided for old versions
of Guix or its channels. A careless use of @command{guix time-machine}
opens the door to security vulnerabilities @xref{Invoking guix pull,
@option{--allow-downgrades}}.
@end quotation
--8<---------------cut here---------------end--------------->8---
?
Cheers,
simon
next prev parent reply other threads:[~2022-11-21 11:27 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-19 12:09 [bug#59383] [PATCH] doc: Call out potential for downgrade attacks with time-machine pelzflorian (Florian Pelz)
2022-11-19 13:37 ` Tobias Geerinckx-Rice via Guix-patches via
2022-11-19 17:39 ` pelzflorian (Florian Pelz)
2022-11-21 11:19 ` zimoun [this message]
2022-11-22 7:58 ` Ludovic Courtès
2022-11-22 14:47 ` bug#59383: " pelzflorian (Florian Pelz)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=86a64kk11y.fsf@gmail.com \
--to=zimon.toutoune@gmail.com \
--cc=59383@debbugs.gnu.org \
--cc=me@tobias.gr \
--cc=pelzflorian@pelzflorian.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.