Meeting Minutes - Office Hours for CTI - 2026-08-28

[Joseph Myers]

On Mon, 28 Sep 2026, Zack Weinberg wrote:

> The project's critical services have been maintained acceptably well by
> part time volunteer administrators for something like 25 years now. I
> think they can be trusted to do it for at least a couple more years--

The current rate at which security vulnerabilities are found and exploited 
means "a couple more years" probably has much greater security risk than 
the previous 25 years put together.  (And I think it was already urgent 
four years ago when I said that if Sourceware wanted to take this 
seriously it should be reimplemented as maybe 50 separate isolated 
systems, it's just got much more urgent since then.)

> Rushing to execute a process that hasn't been thoroughly tested on non-
> critical services is asking for a disaster on the level of "oops, there
> was a typo in the migration script that wiped the primary Git repo on
> *both* the old machine and the new one, and it turns out the backups
> haven't been working for years either, and now we have to try to
> reconstruct things by comparing all the clones on contributors'
> machines."  Is that really a risk you're willing to run?

I think a planned but urgent migration to properly isolated infrastructure 
for the most critical (project, service) pairs is much better than trying 
to do it in an unplanned way after an attack has compromised or destroyed 
existing infrastructure.  Isolated infrastructure with minimal inferfaces 
doesn't guarantee invulnerability to attacks, but it significantly reduces 
the risk of them propagating from one piece of infrastructure to another.

-- 
Joseph S. Myers
josmyers@redhat.com