On Wed, May 14, 2003 at 11:59:49PM -0400, Matt Zimmerman wrote:
> There are no mirrors of security.debian.org, and have not been for as long
> as I have been aware. See the security team FAQ.
deb http://mirror.pacific.net.au/debian-security/ stable/updates main
> Do you honestly think would be a good idea to use testing-security this way
> on a continual basis?
Yes, I do. I think we should release DSA's for security problems in
testing, too.
> Such an endeavor would not seem to require any of the
> facilities which make foo-security different from foo{,-proposed-updates}.
The same applies to stable: the key differences are immediacy,
announcements and control, all of which are equally valuable for testing
as stable. In any event, testing-proposed-updates exists and works at
present, the only thing missing is people reliably uploading to it, and
evaluating whether uploads work well enough to be included in testing
or not. All the technical issues have already been addressed.
> > > This is a related, more general issue, of how to minimize the blockage
> > > introduced by package dependencies. I think this problem is much more
> > > worthwhile to address than security updates targeted at 'testing'.
> > You're wrong: blockages can never be cleared quickly enough to make for
> > timely security fixes. For security fixes, "timely" is "same day"; for
> > testing, "timely" is "a couple of weeks".
> Finding ways to minimize these blockages would benefit all packages'
> progress into testing, security fixes included, and thereby greatly benefit
> 'testing' users, whatever their motivation might be.
Except that there can be no testing users while we don't provide security
updates. Using testing on a multi-user machine, or one that provides any
network services on a machine connected to the network is not something
anyone can recommend in good conscience, and that rules out almost
everything Debian's actually good at.
> Sidestepping the process to provide this kind of "timely" security update
> for "unreleased" software, on the other hand, doesn't seem particularly
> valuable to me.
What, precisely, is unreleased about it?
Cheers,
aj
--
Anthony Towns <aj@humbug.org.au> <http://azure.humbug.org.au/~aj/>
I don't speak for anyone save myself. GPG signed mail preferred.
``Dear Anthony Towns: [...] Congratulations --
you are now certified as a Red Hat Certified Engineer!''
Attachment:
pgp_Fj0k0D8X1.pgp
Description: PGP signature