Re: Reducing the attack surface caused by Berkeley DB...

2018-06-18 Thread Lionel Debroux
Time to reply to myself again :) I went silent in this thread since the end of January because I spent time fuzzing 8 libraries + CLI front-ends of the DBM family, starting with LMDB: > > liblmdb* or libleveldb* are much less popular in popcon by_inst than > > libdb, yeah... > > > > > > Do we kno

Re: Reducing the attack surface caused by Berkeley DB...

2018-01-27 Thread Lionel Debroux
Hi Adrian, On 1/27/18 1:35 PM, Adrian Bunk wrote: > On Sat, Jan 27, 2018 at 12:25:20PM +0100, Lionel Debroux wrote: > > Hi Adrian, > > Hi Lionel, > > > On 1/27/18 6:27 AM, Adrian Bunk wrote: > > ... > > > There doesn't seem to be any disagreement on th

Re: Reducing the attack surface caused by Berkeley DB...

2018-01-27 Thread Lionel Debroux
Hi David, On 1/27/18 1:12 PM, David Kalnischkies wrote: > On Fri, Jan 26, 2018 at 11:49:41PM +0100, Lionel Debroux wrote: > > > Anyway, the only util in apt-utils making use of libdb is > > > apt-ftparchive which a) isn't used much in Debian – but by some > > &

Re: Reducing the attack surface caused by Berkeley DB...

2018-01-27 Thread Lionel Debroux
Replying to myself... On 1/26/18 11:48 PM, Lionel Debroux wrote: > Hi Scott, > > On 1/26/18 7:05 AM, Scott Kitterman wrote: > > On Thursday, January 25, 2018 11:59:06 PM Lionel Debroux wrote: > > > > > > [...] > > > --- > > > Do you

Re: Reducing the attack surface caused by Berkeley DB...

2018-01-27 Thread Lionel Debroux
Hi Adrian, On 1/27/18 6:27 AM, Adrian Bunk wrote: > On Fri, Jan 26, 2018 at 11:49:41PM +0100, Lionel Debroux wrote: > > ... > > On 1/26/18 11:39 AM, David Kalnischkies wrote: > > ... > > > Finding someone performing the daunting task of actually switching > >

Re: Reducing the attack surface caused by Berkeley DB...

2018-01-27 Thread Lionel Debroux
Hi Guillem, On 1/27/18 1:42 AM, Guillem Jover wrote: > On Thu, 2018-01-25 at 23:59:06 +0100, Lionel Debroux wrote: > > Several days ago, jmm from the security team suggested that I start > > a discussion on debian-devel about Berkeley DB, which has known > > security issues,

Re: Reducing the attack surface caused by Berkeley DB...

2018-01-26 Thread Lionel Debroux
Hi, On 1/26/18 11:39 AM, David Kalnischkies wrote: > On Thu, Jan 25, 2018 at 11:59:06PM +0100, Lionel Debroux wrote: > > In practice, Berkeley DB is a core component of most *nix distros. > > Debian popcon indicates that libdb5.3 is installed on ~80% of the > > computers w

Re: Reducing the attack surface caused by Berkeley DB...

2018-01-26 Thread Lionel Debroux
Hi Scott, On 1/26/18 7:05 AM, Scott Kitterman wrote: > On Thursday, January 25, 2018 11:59:06 PM Lionel Debroux wrote: > > > > [...] > > --- > > Do you think we should start the journey of getting rid of libdb5.3 > > at a wide scale ? And if so, how to optim

Re: Reducing the attack surface caused by Berkeley DB...

2018-01-26 Thread Lionel Debroux
Hi Timo, On 1/26/18 12:21 PM, Timo Aaltonen wrote: > On 26.01.2018 00:59, Lionel Debroux wrote: > > --- > > Do you think we should start the journey of getting rid of libdb5.3 > > at a wide scale ? And if so, how to optimize resource usage in > > general ? :) >

Re: Reducing the attack surface caused by Berkeley DB...

2018-01-26 Thread Lionel Debroux
Hi Marco, On 1/26/18 1:46 AM, Marco d'Itri wrote: > On Jan 25, Lionel Debroux wrote: > > Several days ago, jmm from the security team suggested that I start > > a discussion on debian-devel about Berkeley DB, which has known > > security issues, because doing so may ena

Re: Reducing the attack surface caused by Berkeley DB...

2018-01-26 Thread Lionel Debroux
Hi Ryan, On 1/26/18 1:02 AM, Ryan Tandy wrote: > On Thu, Jan 25, 2018 at 11:59:06PM +0100, Lionel Debroux wrote: > > the vast majority of the ~170 reverse dependencies of libdb5.3 > > listed by `apt-cache rdepends libdb5.3` on sid will require (much) > > more work to get r

Reducing the attack surface caused by Berkeley DB...

2018-01-25 Thread Lionel Debroux
d packagers do it on their spare time won't help. --- Do you think we should start the journey of getting rid of libdb5.3 at a wide scale ? And if so, how to optimize resource usage in general ? :) --- TIA and regards, Lionel Debroux. [1] http://www.oracle.com/technetwork/database/database