Whatever the fix I hope we all agree that a policy is needed allowing or
requiring the ports and security teams to reject ports and patches which
exfiltrate (i.e, upload) _any_ local information without an explicit,
detailed and robust opt-in.
Roger Marquis
On 08/04/2021 18:24, Shawn Webb wrote:
[..]
1. Ad hominem much? I understand the underlying problem very well.
2. Your hostility is incredibly annoying.
3. You attribute malice where there is none.
4. This is volunteer work, where volunteers have everyones well-being
in mind.
5. Threatening to go to journalists accomplishes... what? What makes
you think journalists are NOT paying attention to this list? What
makes you think journalists care about you?
6. I really, really, really, really, really hate the "Karen" meme. But
it fits incredibly well here.
7. Where can I review your patches that fix the problem?
To be honest, the original post contained link to PR 251152 where Steve Wills
posted patch 2020-12-07. What more patch is needed? The same patch again?
The fix was not committed for a 5 months
The sending of the data is not unintentional as the maintainer stated in his
comment #13 from 2020-12-29
Even the code in periodic/monthly/300.statistics is written in "very unusual
way". There are cases with 3 switches:
if YES = run it
if NO = tell user to enable it
if anything else = run it
Is this how all periodic scripts should behave? I don't think so. It should
run if _enable="YES" and be silent in any other case.
Again - the first patch was provided 5 months ago by Steve Wills and the
problem was not fixed to this day because maintainer thinks there is nothing
to fix.
Your first jump in this thread with "lolwut" reaction was very far from
expected. Trying to neglect the problem, trying to say that FreeBSD is not
responsible for how packages behave in install time and nobody should be
upset that something sends data on install time...
Kind reagards
Miroslav Lachman
8. Entitlement mentality much?
Sure, the bsdstats package shouldn't submit just on "pkg install."
Instead of fixing the problem, you went the hostile route.
I'm sure you won't learn anything from this, but I hope you do. To me,
it reinforces how random people feel entitled to force their will on
others.
Thanks,
_______________________________________________
freebsd-security@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscr...@freebsd.org"
_______________________________________________
freebsd-security@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscr...@freebsd.org"
