Re: security in testing
On Wed, May 14, 2003 at 01:27:12PM -0400, Matt Zimmerman wrote:
> On Wed, May 14, 2003 at 10:03:32AM -0500, Steve Langasek wrote:
>
> > Figuring that a security upload would be preferable, I approached the
> > security team and offered to prepare an upload. I was effectively told
> > that this isn't done, and because it isn't done, most testing users don't
> > have security.d.o in their sources.list, so don't bother.
>
> This is an excellent point.
Really? I think it's a pisspoor point. I think that maintainers who care
enough to do the necessary work should be encouraged to do it. The argument
above is circular, chicken-and-egg style.
If people like Steve, who maintain important packages like Samba, bother
to create the necessary packages, then:
a) It's a good start -- once people see these things starting to appear,
more maintainers will bother, and users will start to put the relevant
lines in their sources.list;
b) They damn well should be made available.
> Testing users do not have such an entry in sources.list, so any other
> repository would be on equal footing. However, so far no one has taken any
> action to coordinate this, nor has anyone prepared updates for testing that
> would occupy such a repository.
If this other repository had access to autobuilding facilities, then yes,
it might be on an equal footing. I believe that the work was put in to
enable automated security builds for woody (as aj keeps telling us).
Why not use it? If it's a case of manpower, what's needed?
As others have argued, I don't believe it's necessary that testing's security
effort be as good as stable's. If it's not, it's important to make sure that
users are aware of the level of security they're getting (so perhaps a
different name for the repository would be advisable?).
In any case, I think that "security updates when anyone can be bothered"
(which would be likely to be whenever the maintainer cared lots, or when
the issue and the package were important enough to motivate another
developer to contribute) would be an improvement on the status quo.
> This is a related, more general issue, of how to minimize the blockage
> introduced by package dependencies. I think this problem is much more
> worthwhile to address than security updates targeted at 'testing'.
There is no denying that that would be a useful issue to overcome, but
I'm not sure I agree that it's more important than (at least some potential)
security updates to testing, let alone much more.
Cheers,
Nick
--
Nick Phillips -- nwp@lemon-computing.com
Avoid reality at all costs.
Reply to: