On Sun, 11 Feb 2007 12:33:52 +0000 Ciaran McCreesh <[EMAIL PROTECTED]> wrote:
> On Sun, 11 Feb 2007 13:22:48 +0100 "Kevin F. Quinn" > <[EMAIL PROTECTED]> wrote: > | Do you object to such packages (specifically with security issues) > | being p.masked? > > If it's forcing a downgrade, yes. > > | I'm not sure we should be encouraging people to continue using > | packages when we know there are known security issues. > > You assume that being affected by a local denial of service on a > system where all users have the root password is more important than > using a package that has been verified to work by an arch team member. I said nothing about local denial of service; perhaps you're thinking of a particular instance - I'm not. To rhetorically follow your line of discussion, you're happy to have remote exploits remain in the tree (i.e. promoted by Gentoo) if a package is marked stable and a patch isn't available? The point about p.masking (rather than removal) is that we have then made reasonable efforts to inform the user and give them the opportunity to decide what they want to do, based on their own security policy - which could be to unmask locally and continue regardless, or could be to remove the package and try something else. That way they'd be making informed decisions. I think if we're to promote packages that have security issues on an arch, we need to be very clear that we're not making reasonable efforts to ensure that arch is free of known exploits. -- Kevin F. Quinn
signature.asc
Description: PGP signature
