Re: [Exim-dev] Security & Development issues

Página superior
Eliminar este mensaje
Responder a este mensaje
Autor: Yann Golanski
Fecha:  
A: exim-dev
Asunto: Re: [Exim-dev] Security & Development issues
Quoth Nigel Metheringham on Wed, Mar 10, 2004 at 14:11:59 +0000
>       * Exim is a large (normally) setuid daemon with lots of
>         privileges.


Is that a bad thing? You could always run it in a jail?

>       * No matter how good we are, exim *will* have security issues.
>       * We need to have processes to:-
>               * Inspect committed code for security issues


I think there are some document (OpenBSD?) that define how to avoid most
of C "nasty" functions. Of course, attracting someone who knows about
those security things would be good too.

>               * Ensure released code is not compromised
>               * Accept security reports in a timely fashion
>               * Engineer security fixes without (if possible) giving
>                 those who might attack vulnerable installations an
>                 advance attack period.


I think that if we have a security officer or some such this should be
easily done. It does not have to be the head developer but someone else
in charge.

> We also need to think through the ways of handling security issues - we
> do not have any good means to ensure that someone is always available
> :-/


Apart from a security (invite only?) list, I don't see how this can be
done. All of us have work and other commitment and can't spend the time
Phil is spending on Exim.

-- 
yann@???                  -=*=-                      www.kierun.org
    PGP:   009D 7287 C4A7 FD4F 1680  06E4 F751 7006 9DE2 6318