Re: How can we make security updates faster?

2012-06-04 Thread David Tardon
On Tue, May 29, 2012 at 05:46:38AM +, Jóhann B. Guðmundsson wrote: On 05/29/2012 05:21 AM, Adam Williamson wrote: We actually have this on the QA wishlist and it was one of the projects we proposed for GSoC for QA, but it didn't quite make it. We may still wind up doing it through some

Re: How can we make security updates faster?

2012-06-04 Thread David Tardon
On Tue, May 29, 2012 at 06:58:00PM +, Jóhann B. Guðmundsson wrote: On 05/29/2012 06:13 PM, Rex Dieter wrote: It makes no sense to have a gui application ( or an application for that matter ) without having written the relevant how to debug/how to test pages for each component to

Re: How can we make security updates faster?

2012-05-30 Thread Jaroslav Reznik
- Original Message - Jóhann B. Guðmundsson wrote: On 05/29/2012 05:21 AM, Adam Williamson wrote: We actually have this on the QA wishlist and it was one of the projects we proposed for GSoC for QA, but it didn't quite make it. We may still wind up doing it through some other

Re: How can we make security updates faster?

2012-05-30 Thread Kevin Fenzi
On Tue, 29 May 2012 21:56:37 + Jóhann B. Guðmundsson johan...@gmail.com wrote: On 05/29/2012 07:49 PM, Kevin Fenzi wrote: Bodhi does. https://admin.fedoraproject.org/updates/ F17 security updates: 122 F16 security updates: 310 F15 security updates: 444 Luke probably has

Re: How can we make security updates faster?

2012-05-29 Thread Rex Dieter
Jóhann B. Guðmundsson wrote: On 05/29/2012 05:21 AM, Adam Williamson wrote: We actually have this on the QA wishlist and it was one of the projects we proposed for GSoC for QA, but it didn't quite make it. We may still wind up doing it through some other channel, though. See also

Re: How can we make security updates faster?

2012-05-29 Thread Kevin Fenzi
On Mon, 28 May 2012 12:57:18 -0400 (EDT) Paul Wouters pwout...@redhat.com wrote: Hi, I've recently had release updates to two packages with CVE issues in then. A few weeks ago, pidgin-otr needed a lot of me prodding people to try it and give karma to get the security update out. Right

Re: How can we make security updates faster?

2012-05-29 Thread Jóhann B. Guðmundsson
On 05/29/2012 06:13 PM, Rex Dieter wrote: It makes no sense to have a gui application ( or an application for that matter ) without having written the relevant how to debug/how to test pages for each component to accommodate it. Indeed. However, I'd argue*both* pieces, a karma app and

Re: How can we make security updates faster?

2012-05-29 Thread Jóhann B. Guðmundsson
On 05/29/2012 06:39 PM, Kevin Fenzi wrote: Perhaps if there's enough interest we could (re)vive a Security SIG of some kind? One of their goals could be to cross test updates and provide karma? Would not their participation be more geared to test if the exploit has actually been closed rather

Re: How can we make security updates faster?

2012-05-29 Thread Kevin Fenzi
On Tue, 29 May 2012 19:15:21 + Jóhann B. Guðmundsson johan...@gmail.com wrote: On 05/29/2012 06:39 PM, Kevin Fenzi wrote: Perhaps if there's enough interest we could (re)vive a Security SIG of some kind? One of their goals could be to cross test updates and provide karma? Would not

Re: How can we make security updates faster?

2012-05-29 Thread Jóhann B. Guðmundsson
On 05/29/2012 07:27 PM, Kevin Fenzi wrote: It wouldn't have to be I wouldn't think... they could also test for general functionality or serious regressions. Does infrastructure keep somewhere statistic how many security updates we push per release cycles so we can roughly calculate how much

Re: How can we make security updates faster?

2012-05-29 Thread Kevin Fenzi
On Tue, 29 May 2012 19:42:21 + Jóhann B. Guðmundsson johan...@gmail.com wrote: On 05/29/2012 07:27 PM, Kevin Fenzi wrote: It wouldn't have to be I wouldn't think... they could also test for general functionality or serious regressions. Does infrastructure keep somewhere statistic how

re: How can we make security updates faster?

2012-05-29 Thread enclair
Hi, I have a suggestion, not totally related. It would be nice to have a tool which does the same thing than portaudit for FreeBSD. This tool is simple: you launch it, and it lists which packages are vulnerable. That's way you don't need to wait for a package to be in -testing or in -stable to

Re: How can we make security updates faster?

2012-05-29 Thread Jóhann B. Guðmundsson
On 05/29/2012 07:49 PM, Kevin Fenzi wrote: Bodhi does. https://admin.fedoraproject.org/updates/ F17 security updates: 122 F16 security updates: 310 F15 security updates: 444 Luke probably has previous releases historical data somewhere. That means ca 2 hours per day spent in testing for all

How can we make security updates faster?

2012-05-28 Thread Paul Wouters
Hi, I've recently had release updates to two packages with CVE issues in then. A few weeks ago, pidgin-otr needed a lot of me prodding people to try it and give karma to get the security update out. Right now, my socat CVE security releases sits in all four branches with no karma after four

Re: How can we make security updates faster?

2012-05-28 Thread Jóhann B. Guðmundsson
On 05/28/2012 04:57 PM, Paul Wouters wrote: Perhaps a new mailinglist that just announces the security releases, to remind people to test them and give karma. We already have a list that all test related information is supposed to go to including security related ones, in fact all QA

Re: How can we make security updates faster?

2012-05-28 Thread Paul Wouters
On Mon, 28 May 2012, Jóhann B. Guðmundsson wrote: Perhaps a new mailinglist that just announces the security releases, to remind people to test them and give karma. We already have a list that all test related information is supposed to go to including security related ones, in fact all QA

Re: How can we make security updates faster?

2012-05-28 Thread Michael Scherer
Le lundi 28 mai 2012 à 12:57 -0400, Paul Wouters a écrit : Hi, I've recently had release updates to two packages with CVE issues in then. A few weeks ago, pidgin-otr needed a lot of me prodding people to try it and give karma to get the security update out. Right now, my socat CVE security

Re: How can we make security updates faster?

2012-05-28 Thread Jóhann B. Guðmundsson
On 05/28/2012 08:35 PM, Paul Wouters wrote: The point of a seperate list would be that peopel interested in giving security updates some extra attention wouldn't be swamped with other emails, causing them just to filter and file those emails unseen. If the pidgin-otr and socat security update

Re: How can we make security updates faster?

2012-05-28 Thread Adam Williamson
On Mon, 2012-05-28 at 23:49 +0200, Michael Scherer wrote: Le lundi 28 mai 2012 à 12:57 -0400, Paul Wouters a écrit : Hi, I've recently had release updates to two packages with CVE issues in then. A few weeks ago, pidgin-otr needed a lot of me prodding people to try it and give karma to

Re: How can we make security updates faster?

2012-05-28 Thread Jóhann B. Guðmundsson
On 05/29/2012 05:21 AM, Adam Williamson wrote: We actually have this on the QA wishlist and it was one of the projects we proposed for GSoC for QA, but it didn't quite make it. We may still wind up doing it through some other channel, though. See also