Transcript: Security Releases

I'm Will Vincent, joined as always by Carlton Gibson.

Hello, Carlton.

Hello, Will.

And this week I thought we'd talk about security releases because there was a particularly interesting one recently.

And so I'll tee it up and then I'll let you do the talking since you are one of the Django fellows.

So Django has a great security policy and does regular releases outside of the major releases.

So major releases would be 2.0, 1.2, 3.0, which came out in December.

And then after that, there's 3.0, 0.1, 0.2, which are minor releases, which are almost always security related.

So let's talk in the let's talk about what's a normal process for that, and then we'll get to this most recent one, which was a little bit interesting.

So we we first of all we'll do a an an alpha, and then there's a six weeks after that there's a beta, and then there's a release candidate, and there's a final release.

So you can follow those, and they're kind of outside of the normal cadence.

But then there's a month, there's basically a monthly Django release.

So it'll either be 3.0 or 3.0.1 or 3.0.2, and these are bug fixes in new features essentially, or data loss bugs which we will backport then to other versions.

So if you know uh what's currently supported 1.11 is just about to go end of life, upgrade if you're on that.

2.2, um, and then 3.0 are current versions, and so say there's a data loss, a data loss bug in 2.2, we'll we'll release a version of that, and that's on the monthly schedule, and that's normally at the beginning of the month, uh the first, the second, the third, you know, whatever the first Monday is normally.

And then the other kind of release that you get as part of those is a security release.

And normally that hit we will try and land those on the on the first Monday of the month as well, just as the normal cycle, you know.

Um, however, you mentioned one recently where we put out mid-months.

Well, yeah, so from a distance, um, something emerged and within I think two days it had gone through all the processes and was released to everyone.

But what what what's the the deep dive?

We can put a link, right?

So it was it was what what was the specific bug that came out?

It was Mozilla find it or something?

Yeah, so so uh is that password reset, yeah.

So um Unicode, God bless you.

And this is why you have to be using a framework like Django, right?

Because you would never ever in a million years find this bug yourself and be able to fix this bug yourself and secure your own system if you wrote this code by hand.

But because there's millions of people using it, you get those fixes.

But uh if for instance you've got uh an email address, mycut um example.com, right?

That's uh one we use in the test case.

But there's a there's a Unicode character which um the Turkish lowercase i without a dot, right?

And that when it's compared by a database normally, uh Postgres, MySQL, well SQLite doesn't have this issue, but though the normal lowercase I and this Turkish lowercase i without a dot, which are not the same character, compare the same when you do a an equality test in the database to look up the email address.

So in principle, somebody could register an address, a Unicode lookalike address for your email address.

It would have to be the same domain, so it'd have to be like you know, google.com or somewhere where they could get an email address on the same domain.

Or a domain which lowercase equivalent, of course.

Um and then they could get sent the reset token for your password, and then they could reset your password, they could capture your, they could capture your account.

Um and this was discovered as a vulnerability on GitHub, and GitHub published a blog post on their security blog telling the world about it, which obviously went to the front page of Hacker News, and then Simon Chalette, who's one of the major contributors to Django, uh was like, uh hang on, that affects us too.

And so this was on the this was on like the Monday or the Tuesday, and we had a release out on the Wednesday afternoon, which is as quick as we can do it, to be honest.

Because it was it's potentially devastating.

Because this like you know, they these people labor in the dark largely.

So GitHub released this thing.

Uh Simon Chalette saw it, or one of was one of the people who saw it and raised the flag.

I was working on it.

Uh who else?

Probably other people uh were directly involved.

But those people I definitely remember were on the ticket on the issue, and there was a lot of activity that went on behind the scenes to get it out.

And normally, normally we pre-announce a security release.

So normally we hit a week before we'll publicly announce it, and we have a security policy for you know if you need advanced notification.

Um, normally that would be uh if you're like Red Hat and your packaging Django up for um your package manager, you might need the security patches a little bit in advance just so you can uh get get that patch in place so people can yum update their uh their installed Django.

This time we weren't able to do that because it was so high profile and so potentially you know it's a big issue.

If it's not a minor thing.

So we just we we announced it as soon as we were sure.

We got the C V E, which is the there's a database of security issues uh which you you need a number for.

So they've got these numbers CVE 2019, you know, 1148 or whatever.

And um we released it, you know, on the Wednesday.

So that it's it was tweeted out, there's uh like what's the best way?

Um and shout out, I launched a Django newsletter with Jeff Triplett, Django News.jjango-news.com that will uh mention things like this.

Because in this case, because I saw, you know, it was very like the wording said, you know, this is like a high priority, but I'm where should people look for this, right?

There's the security email feed.

Okay, right?

What would be the number one place someone should look to, you know, when something like this happens where it's like, ooh, you really do need to update now?

And we sent that's where we'll send the pre-announce saying that the uh security releases are coming.

So normally on a security release, you get a week's notice.

Um for this one you got a day's notice because that was all we had.

Uh then there's the Django blog, which you should subscribe to anyway, because you get notifications about you know DjangoCon Europe or you know, the each each release.

There's a release blog post for each release which tells you about the release, what's in there, what's you know, what you need to do.

There's a Twitter account you can follow.

Where else?

I think that's about it.

Then Django News email.

I mean a half a dozen other ones, but not that one.

So the the blog post comes out like immediately.

Uh yeah, I mean that and so if you've got an RS if you've got an RSS read that you subscribe to, that will appear in your RSS reader.

If you're on Twitter, the that's automatically tweeted out.

So but Twitter's easy to miss, so I wouldn't use that as a reliable source.

And then just be on that latest version, whichever it is.

So if you're on 2.2, be on 2.2.8 or 2.2.9, and then be ready to update to 2.2.10 when it's released, and do that monthly.

Yeah if you're on, you know, if you're on the latest major release.

You know, again, uh James Bennett, who's been involved with Django for forever, the next day he was on a Django Software Foundation uh monthly meeting, um, which I'm on now, and you know, he was quite tired.

So he's going from one thing to another plus holding down a job.

And same for basically everyone else.

This isn't their job.

They're not getting paid to do this, they do this because they care.

Like James was James was able to point to the right RFC where it discusses, or not the RVC the Unicode technical document, where it discusses the exact algorithm you have to use to do safe comparison of Unicode strings.

And you know, that knowledge just isn't I don't have it, and you know, 99% of people don't have it, but James has got it.

And he what he doesn't know, well Florian will know, or Simon will know, or you know, and you know, there's a a dozen people perhaps on the security team who really they really know their stuff.

Yeah.

Well, so as ever, the more I learn about Django, the more I appreciate all this work that's done to make it what it is.

And I actually I just quickly mentioned um I was elected to the board, so there's a Django Software Foundation board.

So thank you, community.

Um so I'm now one of seven people on that who meet monthly, who and I'm the treasurer, so deal with things like paying the fellows, sponsors.

We'll do an episode on that, but I'm learning more about Django, and hopefully I'll share that with podcast listeners.

Since I think most podcast listeners don't know either much of how Django is run.

We all just take it for granted.

That's that's it, no.

Anything else?

This uh this is a short episode, but we wanted to highlight that security release because again, I in my world all the fire alarms were going off, and I was like, oh my god, like this is this is something we should highlight to people because it doesn't just happen from without action.

It's just a point release.

We shouldn't break anything, you know.

If it's but if it's a security issue and there's a small breaking change, there's a small breaking change.

So one previously for the admin in 2.1 reintroduced read-only views.

Um and in 2.1 you could have a read-only parent with editable inlines, and but it turned out that that wasn't going to be sustainably secure, so we had to pull that out, and now if unless the parent model's editable, the whole view will be read-only.

And that's more secure, and you can work around that by implementing custom views, but that was a breaking change.

But we made that with some great discussion.

We looked at alternatives and we looked at whether those were sustainable, and we're like, no, but if you're on the latest version, it's an easy update.

And okay, that there was a small breaking change.

If you're needing that, you've got to code around it.

But you know, for security issues, you can't quibble.

And yet another example of your analogy of the car.

This is just maintenance.

You have your test suite, right?

And you just run it and you're good to go.

Yeah, it's like if you need new tires, you put new tires on because otherwise you crash.

Yes.

Thank you, Carlton, for you and the fellows in the community that does all this work.

I appreciate it.

And that is about it, I think.

Join us next time.

Bye bye.

Okay, bye bye.