Re: How (un)safe would Debian be when only using the security.debian.org repository?

2013-11-11 Thread Norbert Kiszka
Dnia 2013-11-10, nie o godzinie 19:50 +, adrelanos pisze: Hi! How (un)safe would it be...? When using Debian while... Not using: deb http://ftp.us.debian.org/debian stable main contrib non-free deb http://security.debian.org stable/updates main contrib non-free Only using: deb

Re: How (un)safe would Debian be when only using the security.debian.org repository?

2013-11-11 Thread Michael Gilbert
On Mon, Nov 11, 2013 at 6:17 AM, Norbert Kiszka wrote: Missing dependencies can break upgrade. For ex. one package from security-update can depend on other package, so it will not be installed. Unless You install it by hand. That isn't quite right since excepting mistakes, security updates

Re: How (un)safe would Debian be when only using the security.debian.org repository?

2013-11-11 Thread Bastian Blank
On Mon, Nov 11, 2013 at 04:56:27PM -0500, Michael Gilbert wrote: That isn't quite right since excepting mistakes, security updates will never require packages outside the security archive. This is incorrect: | Package: asterisk-mysql | Depends: […] libc6 (= 2.4), […] | $ apt-cache policy

Re: How (un)safe would Debian be when only using the security.debian.org repository?

2013-11-11 Thread Michael Gilbert
On Mon, Nov 11, 2013 at 5:06 PM, Bastian Blank wrote: On Mon, Nov 11, 2013 at 04:56:27PM -0500, Michael Gilbert wrote: That isn't quite right since excepting mistakes, security updates will never require packages outside the security archive. This is incorrect: | Package: asterisk-mysql |

Re: SSL for debian.org/security?

2013-11-11 Thread Mike Mestnik
I don't see how this is relevant? Obviously if hardware is seized then the owners no longer have control. If you have suggestions as to how to secure hardware that's great, but if you just want to point out that Nothing can be done. That's not helpful. On Tue, Oct 29, 2013 at 4:52 AM, Tormen

Re: SSL for debian.org/security?

2013-11-11 Thread Jérémie Marguerie
On Mon, Nov 11, 2013 at 2:48 PM, Mike Mestnik che...@mikemestnik.net wrote: I don't see how this is relevant? Obviously if hardware is seized then the owners no longer have control. If you have suggestions as to how to secure hardware that's great, but if you just want to point out that

Re: SSL for debian.org/security?

2013-11-11 Thread Hans-Christoph Steiner
On 11/11/2013 07:41 PM, Jérémie Marguerie wrote: On Mon, Nov 11, 2013 at 2:48 PM, Mike Mestnik che...@mikemestnik.net wrote: I don't see how this is relevant? Obviously if hardware is seized then the owners no longer have control. If you have suggestions as to how to secure hardware that's

Re: How (un)safe would Debian be when only using the security.debian.org repository?

2013-11-11 Thread Paul Wise
On Tue, Nov 12, 2013 at 6:30 AM, Michael Gilbert wrote: Which confirms my point. That asterisk update, for example, required no new package dependencies outside the security archive. You said no deps outside the security archive, not no new deps outside the security archive. Anyway, the

Re: How (un)safe would Debian be when only using the security.debian.org repository?

2013-11-11 Thread Michael Gilbert
On Mon, Nov 11, 2013 at 11:20 PM, Paul Wise wrote: On Tue, Nov 12, 2013 at 6:30 AM, Michael Gilbert wrote: Which confirms my point. That asterisk update, for example, required no new package dependencies outside the security archive. You said no deps outside the security archive, not no new

Re: SSL for debian.org/security?

2013-11-11 Thread Andreas Kuckartz
Hans-Christoph Steiner: The crypto smartcard (aka Hardware Security Module) are some work to setup, but not really all that much. And they are easy to use once setup. And they provide a huge boost in the security of the certificate. Such hardware also costs a significant amount of money. Are