-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sorry for quoting a lot this time but it's important for understanding the issue.
On 01.02.2013 15:00, Ian Stakenvicius wrote: > On 01/02/13 08:56 AM, Wulf C. Krueger wrote: >> On 01.02.2013 14:47, Rich Freeman wrote: >>>> And how will you get to know about current or future >>>> security issues if nobody (in Gentoo) cares about the >>>> package? >>> The same way that you know about security issues in Firefox or >>> Chromium [...] Until somebody tells upstream about them you're >>> going to be vulnerable. >> Indeed. In contrast to many of the packages that were mentioned >> in this thread, Firefox and Chromium have an active upstream, >> though. What do you think will happen to projects with a dead >> upstream? I think the answer is pretty simple: Nothing. > Not really, no. A dead upstream means that there isn't an upstream > to push a fix or release a new version. That's all. If security > bugs occur then there's two options -- fix, or remove. So if the > gentoo dev in question doesn't have time/ability/desire to fix, > they or security remove it at that point. This isn't "nothing" to > me; I must be missing something from your response? Yes, the topmost two lines in my quote: >>>> And how will you get to know about current or future >>>> security issues if nobody (in Gentoo) cares about the >>>> package? In the "dead upstream" case it's unlikely anyone is checking the package for security issues in the first place. So neither the Gentoo security people will get notice via the usual sources nor will any upstream be informed. If there's a *known* bug, you're right. Case closed. If the package in question is just bit-rotting and nobody cares, you most likely won't ever know about any security issues, though - until something nasty happens. This is one of the problems with "dead upstream" packages. Best regards, Wulf -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iEYEARECAAYFAlELzGEACgkQnuVXRcSi+5rJAwCfYGcHAJzmxwD+2L0WZlajnfP4 TzsAn1NN88QQDG3Q9br73nM1KcFT9rDW =5aeo -----END PGP SIGNATURE-----
