Re: [Xen-devel] [qubes-devel] Re: Critique of the Xen Security Process

[Lars Kurth <lars.kurth.xen@xxxxxxxxx>]

> On 9 Nov 2015, at 18:15, Wojtek Porczyk <woju@xxxxxxxxxxxxxxxxxxxxxx> wrote:
> 
> On Mon, Nov 09, 2015 at 04:31:58PM +0000, Franz wrote:
>> Perhaps a way out of this impasse is to put bounties on Xen security tasks
>> identified by Joanna and properly advertise these bounties to Xen users.
>> [snip]
> 
> This is fundamentaly wrong idea. Security isn't something you can
> "apply" or put bounty on. It's a state of the mind, especcialy
> developer's.

I don't think this was what was proposed. What was proposed, if I understood 
correctly, was to use funds to sponsor solutions to specific problems in 
specific areas of code that have been developed in the past and where we may 
have issues due to past mistakes. 

> Joanna wrote in her mail:
> 
>>>> I can't help but have a feeling that some of the Xen developers seem to be
>>>> overconfident in their belief they can fully understand all the possible
>>>> execution paths in their code. Well, the XSAs quoted above are an 
>>>> indisputable
>>>> prove that this is not quite always the case. Realizing that, each 
>>>> developer by
>>>> themselves, might be a great step towards a more secure hypervisor...
> 
> And that's why we can't just "submit a patch" to "contribute security".

Although I agree that you can't submit a patch to fix security, it is possible 
to focus on some areas you care about and lead by example. In particular, if 
you believe that there is a mindset problem today. I think, you do also need to 
distinguish between what was happening in the past and what the project does 
today. There is little point to complain about what developers, who now don't 
work on Xen any more, did in the past. In particular, as the vast majority of 
active developers in the project were not around 6-7 years ago.

> There is something wrong with Xen as a whole project, but that something
> isn't the code. There is a mindset to be fixed.

I think this is a rather generalising statement, and maybe it would be more 
fruitful to focus on some concrete areas that can be improved. I also believe, 
that there has been a significant shift in mindset in many areas in the project 
in the last few years. 

Lars 


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel