Steve McIntyre <st...@einval.com> writes: > Depressingly, it seems a lot of the same web typists don't have any > problems with doing the equivalent of "curl http://some.site/install.sh > | sudo bash" . That doesn't mean we have to do the same in Debian. If > there's no sensible way to do controlled web development, let's just > drop this from Debian *now*.
While this is a fair critique of a lot of these systems, I think it's worth pointing out that it's entirely possible to make this sort of development process secure, or at least as secure as Debian is. All it requires is that the dependencies be pulled from a repo via a protocol that checks signatures, and that push access to that repo be relatively controlled. Debian does not exactly have a high standard of comprehensive code audits for everything we push to *our* repos, so we can't really throw stones at other people for having repos full of random software. If they do signature validation on their downloads (and I do realize that some of them don't, but it's entirely possible to keep the same model and just add that), and they have some sort of security update process, they're doing about as well as we do. It's not at all clear to me that we're really in a position to claim the moral high ground here. -- Russ Allbery (r...@debian.org) <http://www.eyrie.org/~eagle/>
