| Message ID | 87v8nbjgck.fsf@pelzflorian.de |
|---|---|
| State | New |
| Headers | show |
| Series | [bug#59383] doc: Call out potential for downgrade attacks with time-machine. | expand |
| Context | Check | Description |
|---|---|---|
| cbaines/comparison | success | View comparision |
| cbaines/git-branch | success | View Git branch |
| cbaines/applying patch | success | |
| cbaines/issue | success | View issue |
Hi Florian, and thanks for the patch. pelzflorian (Florian Pelz) 写道： > +@quotation Note > +Naturally, no security fixes can be provided for old versions > of Guix > +or its channels. This also means that careless use of > @command{guix > +time-machine} opens the door to downgrade attacks. > +@xref{Invoking guix pull, @option{--allow-downgrades}}. > +@end quotation ‘Attack’ is a very big word. It should not end a paragraph. What would the downgrade attack—distinct from a downgrade—look like? Kind regards, T G-R
Hi Tobias, thanks for your thoughts. Tobias Geerinckx-Rice <me@tobias.gr> writes: > pelzflorian (Florian Pelz) 写道： >> @quotation Note >> Naturally, no security fixes can be provided for old versions of Guix >> or its channels. This also means that careless use of @command{guix >> time-machine} opens the door to downgrade attacks. >> @xref{Invoking guix pull, @option{--allow-downgrades}}. >> @end quotation > ‘Attack’ is a very big word. It should not end a paragraph. What > would the downgrade attack—distinct from a downgrade—look like? My choice of words was the same as in the unattended upgrades service, but perhaps I should add before the @xref: Suggestions to ``just use the time machine'' could be attempts to trick people to use old software. But they can also get you back to a working state. Regards, Florian
Hi, On Sat, 19 Nov 2022 at 18:39, "pelzflorian (Florian Pelz)" <pelzflorian@pelzflorian.de> wrote: >>> @quotation Note >>> Naturally, no security fixes can be provided for old versions of Guix >>> or its channels. This also means that careless use of @command{guix >>> time-machine} opens the door to downgrade attacks. >>> @xref{Invoking guix pull, @option{--allow-downgrades}}. >>> @end quotation >> >> ‘Attack’ is a very big word. It should not end a paragraph. What >> would the downgrade attack—distinct from a downgrade—look like? Why not something like, --8<---------------cut here---------------start------------->8--- @quotation Note The history of Guix is immutable and @command{guix time-machine} provides the exact same software as they are in a specific Guix revision. Naturally, no security fixes are provided for old versions of Guix or its channels. A careless use of @command{guix time-machine} opens the door to security vulnerabilities @xref{Invoking guix pull, @option{--allow-downgrades}}. @end quotation --8<---------------cut here---------------end--------------->8--- ? Cheers, simon
Hi, zimoun <zimon.toutoune@gmail.com> skribis: > @quotation Note > The history of Guix is immutable and @command{guix time-machine} > provides the exact same software as they are in a specific Guix > revision. Naturally, no security fixes are provided for old versions > of Guix or its channels. A careless use of @command{guix time-machine} > opens the door to security vulnerabilities @xref{Invoking guix pull, > @option{--allow-downgrades}}. > @end quotation I like that wording. Florian, WDYT? Ludo’.
zimoun’s wording is good; less alarmist. I used his words (with a period before @xref, no french spacing and a less alarmist commit message and Co-authored by line). Pushed as b8d4c323f5d089dd800b358143d5bae26c965404. Closing. Regards, Florian
diff --git a/doc/guix.texi b/doc/guix.texi index eaecfd0daa..c29db13be6 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -60,7 +60,7 @@ Copyright @copyright{} 2018 Mike Gerwitz@* Copyright @copyright{} 2018 Pierre-Antoine Rouby@* Copyright @copyright{} 2018, 2019 Gábor Boskovits@* -Copyright @copyright{} 2018, 2019, 2020 Florian Pelz@* +Copyright @copyright{} 2018, 2019, 2020, 2022 Florian Pelz@* Copyright @copyright{} 2018 Laura Lazzati@* Copyright @copyright{} 2018 Alex Vong@* Copyright @copyright{} 2019 Josh Holland@* @@ -4834,6 +4834,13 @@ Invoking guix time-machine large number of packages; the result is cached though and subsequent commands targeting the same commit are almost instantaneous. +@quotation Note +Naturally, no security fixes can be provided for old versions of Guix +or its channels. This also means that careless use of @command{guix +time-machine} opens the door to downgrade attacks. +@xref{Invoking guix pull, @option{--allow-downgrades}}. +@end quotation + The general syntax is: @example