Hi,
On 9/6/11 4:02 AM, Kostik Belousov wrote:
On Mon, Sep 05, 2011 at 06:32:00PM +0100, Chris Rees wrote:
On 5 Sep 2011 18:15, "Mikhail T."<[email protected]> wrote:
On -10.01.-28163 14:59, Chris Rees wrote:
I've had to deprecate sysutils/cfs -- there's a confirmed issue with
failing locks [1] which has been open for two years with no fix.
Whoops, also missed a CVE -- buffer overflows can cause a DoS.
Expiration date altered to 1 month accordingly.
Is this the only vulnerability you are talking about?
http://www.debian.org/security/2006/dsa-1138
Does not seem hard to fix at all... Listing all of the fatal problems
would be helpful...
-mi
If it's not that hard to fix then do it. If you're not going to fix it, why
are you even commenting?
More noise. Stop whining and do something about it.
No, it is not a noise.
>
First, note that an issue in the local deamon can be only utilized by
local users. As a consequence, there is a huge set of machines for which
the cited issue is simply irrelevant.
For the analogous issues that are irrelevant for 90% of the port users,
look at the vulnerabilities listed for the quake ports.
By the way, the Debian folks invested certain effort in keeping cfs up
to date. Their git repo is still available at
http://smarden.org/git/cfs.git/ . In particular, the DoS fix can be
easily obtained from the repo and placed under files/ in the port.
Second, I personally consider the crusade to remove old but compiling
and working (*) ports as a damage both to the project functionality and
to the project reputation.
* Working exactly because users report bugs in the software, otherwise
they would not be able to describe corner cases that break.
This is true: cfs is still in use out there. E.g., I know a company
still relying on cfs. They don't seem to care about ports/137378. I'd
be glad to suggest they move on to something newer and better supported
but I'm aware of no other open-source file encryption framework that is
a) transparent at filesystem level and at the same time b) can support
multiple security domains without requiring as many mount points. As
soon as there is an alternative available, the cfs port can be safely
retired, but trashing it prematurely would be unwise.
Cheers,
Yar
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ports
To unsubscribe, send any mail to "[email protected]"
