On Sun, 11 Feb 2007, Kevin F. Quinn wrote: > I think if we're to promote packages that have security issues on an > arch, we need to be very clear that we're not making reasonable efforts > to ensure that arch is free of known exploits. >
I agree. The term "promote" is perhaps a little bit exaggerated, but a vulnerabilities monitoring is useful only if it's exhaustive - so far as possible. If, say, 5% of security weaknesses are voluntarily kept in portage, that means that the security concerned users can't rely on GLSAs and package.mask: they should rely on their own security vulnerabilities monitoring, and that means we've failed. But a "temporary masking GLSA" which would not cover all arches may be acceptable, without abuse. I still prefer see vulnerable packages in p.mask with a 2-lines short comment and the bug number. Cheers, -- Raphael Marichez aka Falco
pgpVFyU0ilqVU.pgp
Description: PGP signature
