i'll go ahead and start the discussion since no one else is running
with it. this matter is rather urgent since the problem is now being
considered release-critical for lenny. i see three possible courses
of action:
1. ignore the problem: mark the bug wontfix
rationalle: the firmware fetching stuff is a small component of the
package and the debian policy is not explicitly clear on the matter
cons: leaves vector for possible security attacks and script can
become non-functional (e.g. getweb has been non-functional in over a
year in etch)
2. fix the problem now: either remove getweb completely or make a
separate foo2zjs-contrib package with just getweb, and have this ready
for the lenny release
rationalle: since getweb is a security risk and could break, it should
be eliminated
cons: less functionality for user. some work for the maintainer.
3. fix the problem later: same as above, but tag lenny-ignore
rationalle: same as above, but with limited time, this is the least
path of resistance
cons: same as above, but leaves users vulnerable during the lenny time frame.
there is also the matter of whether the policy should be clarified for
this type of situation -- and whether all other cases of fetching
scripts should be tagged release-critical. i will leave this for
further discussion since it isn't so urgent.
let me again stress that action is URGENT since this is
release-critical for lenny.
regards,
mike
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
