Re: security in testing

[Theodore Ts'o <tytso@mit.edu>]

On Wed, May 14, 2003 at 05:53:50PM -0400, Don Armstrong wrote:
> Manoj's answer, while witty, is closer to the mark than you may
> realize.
> 
> Debian will always be for whoever the people contributing to Debian
> are willing/want it to be for. No more, no less.

Um, when we all agreed to be Debian Developers, we agreed to the
following from the social contract:

* Our Priorities are Our Users and Free Software

	We will be guided by the needs of our users and the free-software
	community. We will place their interests first in our priorities. We
	will support the needs of our users for operation in many different
	kinds of computing environment.....


So what does that mean?  If the we define "our users" as ourselves,
then the social contract reduces to "we will place our interests first
in our priorities", and that doesn't sound so good, does it?  :-)

If our users include those who want something that is less stale than
"stable", but where they don't want to deal with having to stich
together their system after an update to perl or lilo leaves their
system completely unusable, how do we meet their needs?  There are
certainly disagreements at the tactical level (we could solve this
problem by applying pressure to people to not upload broken packages
to unstable; we could solve the problem by fixing enough RC bugs that
packages flow into testing much more reliably and quickly; we could
solve the problem by recruiting people to upload into
"testing-security").  

But the first question before we discuss tactics is whether or not we
"should" do it.  Does the fact that we've accept the Social Contract
put any kind of moral claim on what we as an organization do?  If the
question to that question is yes, then individual developers will need
to search their souls and decide whether or not this means they are
feeling called to put in the time to fix an RC bug, or work to NMU or
otherwise clear a blocked, critical package, or contribute to security
or testing-security, or do something else to further the goal.

> I'd argue that the converse is more important. [Unless most developers
> do everything they do for purely altruistic reasons. I know I do what
> I do for selfish reasons first.]

That may be true, but the ideals articulated in the Social Contract
aspire to something a higher more than that.

						- Ted