Re: Need for security model

On Tue, Dec 09, 2003 at 09:59:55PM +0800, Low Zhen Lin wrote:
> 
> On Tuesday, December 9, 2003, at 04:11  AM, Chris Frey wrote:
> 
> > What is Xeta?  Is it a build manager?  Is it a download manager?
> > Is it a file transfer protocol?  Is it a web server?  Is it is an
> > rsync server?  Is it all of the above? :-)
> 
> Much of that. It is the build manager, download manager, package 
> manager among some other things. It will be distributable, meaning, you 
> can run the components on different computers, but it will be able to 
> form one coherent whole.

This was the concept that was missing from my understanding of Xeta.
A picture is beginning to emerge (no pun intended).  Thank you.

> Since Xeta is based on a multi-tiered model, what the client can do can 
> and must be controlled server-side. Even clients on the local computer 
> will have to communicate via IPC of sorts. Therefore... It will not be 
> necessary to invoke the client as root... But, the server is running as 
> root. Thus, the client cannot be trusted - some form of authentication 
> and access control must be implemented.

I can see why authentication is needed now.  Now my worries are shifting
to having to run the server as root... :-)

> You already have the root password... who needs Xeta?

I assume this means that users can install packages on a system, not
just root.  Very interesting.

> > I would prefer this integrity to rely on as few points of failure as
> > possible: i.e. something like a developer-signed XBuild, and not
> > something that ever relies on the security of the server or mirrors
> > holding the data.
> 
> As few? I'd rather install integrity checks at every point possible.

As few points of failure, or rather, as few possibilities to corrupt
things along the way as possible.  For example, I don't want to care
whether a mirror has been compromised.  A mirror is only free disk space
and bandwidth, nothing more, and I don't want to worry that every mirror
along the path of the software getting to me is secure.

The developer is at the prime position to verify that sources and binaries
are good, and his signature would ideally be the one that propagates through
the system.

I have no problems with adding integrity checks everywhere.

> > Is discussion of Xeta and Zynot development happening outside the 
> > mailing
> > lists, perhaps in irc?  Are there logs of irc meetings that can be
> > read somewhere?  Couldn't find it with a cursory glance at the 
> > website...
> 
> Mostly IRC. Realtime discussion is good. I can provide logs, but since 
> my personal computer failed, I can't get to them. Obviously, they are 
> also gaps from the time when my IRC client was not active and I was not 
> able to restart it.

I was thinking that such logs should be posted to the website, continually,
so that people can follow what going on.  Not everyone has the time
to participate in IRC discussions, but may notice something during
a logged discussion and comment on it.

Actually as I think about it, an automatic posting of irc logs to the
dev mailing list would be ideal, as they would get automatically archived
anyway, and gives a more flexible access point.

> If you're wondering about the integrity of this message... I cannot 
> cryptographically sign it - owing to the fact that I am not sending 
> this from my personal computer.

No worries, I'm not that paranoid yet. :-)

> Please post all future followups to [email protected] - only the 
> initial message goes out to both. Duplication is bad.

No problem.

Thanks for your detailed reply,
- Chris