[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: setuid/setgid binaries contained in the Debian repository.



Manoj Srivastava wrote:
> 	I note that later discussion tried to paint this whole process
>  as getting people involved in auditing code, and not a mandatory
>  requirement (ie, if you do not get a consensus then your package is
>  buggy) that was in the original proposal.

Fundamentally you make a wrong assumption. If policy requires that
"developers MUST hop on one leg while uploading packages", and someone
catches me sitting down during a long upload, a bug on my package will
do nothing to correct that, and will be "fixed" by a bit-identical
upload made in the privacy of my own home (while lying down, probably).
Policy cannot mandate developer behavior outside the strings of bits
we're allowed to put into Debian.

> 	I have a full log of this email conversation, as indeed do the
>  list archives, so just go back and lok the whole thread up.

It'd be great if you'd use your archive to read the thread and motivatons 
that led up to the draft proposal before you try to falsly accuse us
as you do in the first paragraph I've quoted.

> 	Well, If this proposal was in plain text, not a properly
>  formed patch against current policy, and thus meant to be interpreted
>  in the context of the policy document, perhaps that would have been
>  clearer.

It was clearly marked as a draft proposal, and not a formal policy
proposal. And frankly, the thread was quite congenial and productive
until you came along.

-- 
see shy jo

Attachment: pgpI7zStUTTwc.pgp
Description: PGP signature


Reply to: