On Wed, Jul 14, 2021 at 10:49:34AM +0200, Andreas K. Huettel wrote: > > > > > > 1) either the severity assignment of this bug by the Security project as > > > B1 wrong (i.e. it should have been classified "harmless")
<snip> > Well, over the last year or so every 2-3 months the (uninformed) discussion > came up, "don't use openrc stages because you are automatically rooted". That > leaves a rather bad impression of Gentoo, independent of whether it is true > or not. If noone from sec team noticed the discussions... Absolutely, that would leave a bad impression. Where were these discussions taking place? > > > > 2) or the entire classification of severity levels according to the > > > Security project pointless (i.e. you can't base any actions on them > > > because a mystery onion needs to be taken into account). > > > > > > > I am not sure if this is sarcasm, but every bug must be considered > > through the correct aperture. That is, based on your environment, > > protections in place, defense in depth, and other buzzwords... hence the > > onion analogy. > > It's not sarcasm. The point of the classification is to give clear rules (why > else would you list, e.g., required response times on the vulnerability > treatment page (no matter how illusory they are)). > > If you don't take all factors into account when *making* the classification, > then all gain you have from the classification is lost. > Let me explain differently. Gentoo has a vulnerability rating system that is indepedent of any other system. This system is used to classify bugs from a distro perspective and common usage of various applications. However, one cannot consider all possible attack vectors, impacts, and configuration scenarios being used by our users. So, it is not lost... we just can't possibly account for all the things. Yes, the response times are utter crap and as I mentioned the Gentoo system needs to be overhauled/adapted. -Aaron
signature.asc
Description: PGP signature
