On Fri, 1 Feb 2013 09:45:07 -0500 Rich Freeman <[email protected]> wrote:
> That seems rather speculative. I'm sure that people look for > vulnerabilities in unmaintained software - if they didn't then nobody > would be able to exploit them in the first place (you have to find a > vulnerability to exploit it). I imagine most vulnerabilities are > found by people outside of projects in the first place. > > We don't know how many vulnerabilities there are in maintained > packages, let alone unmaintained ones, so a comparison is a bit > difficult. Also, there are plenty of packages that can't really *have* interesting security vulnerabilities in the first place. I don't know the specifics of the games that were removed, but games in general, if they are purely single-player and only ever read and write files in the player's home directory, don't really have an attack surface to start with. You can't remotely exploit a program that never creates a socket, and you can't locally exploit a program that never tries to access files other than those in its invoker's home directory and root-writable directories like /usr/share, and does so with the invoker's usual privileges. Do you treeclean those because "they might have security holes"? Chris
