Re: [security] What's being done?

[Martin Schulze <joey@infodrom.org>]

Daniel Stone wrote:
> Considering that an upload hasn't been made to rectify this root hole,
> why hasn't something else been done about it - regular or security NMU?
> One would think that this is definitely serious.
> 
> Oh and BTW, Slackware released an update today. Without trolling, I can
> say that I was honestly surprised to note that Debian, a distro with
> ~850 developers and a dedicated security team, is behind Slackware on
> security issues.

Glibc always is a difficult problem.

 1. It takes ages to build packages and they need to be build on
    currently six architectures (11 when woody is out).

 2. Glibc is the most important package.  If something in the security
    update causes glibc to fail, imagine what will happen to all those
    systems that just have updated their glibc due to a security
    upload.  Even if they should manage to get their system working
    again, it will take use *days* to provide fixed packages.

 3. Glibc is a beast that not many people want to deal with.  All
    glibc problems I know of have been dealt by the Security Team
    *together* with the glibc maintainer.  Both parties are busy
    people as well.

 4. Supporting one or two architectures is way easier than supporting
    six architectures.

 5. Because of that, we have to be extraordinary careful.  This takes
    time.

Sorry for the inconvenience.  We are doing what we can.  Providing
patches and test reports are always welcome, but advisories for the
kernel and glibc will probably continue to take more time than usual.

Regards,

	Joey

-- 
It's practically impossible to look at a penguin and feel angry.

Please always Cc to me when replying to me on the lists.