Re: Why back-porting patches to stable instead of releasing a new package.
On Sat, Aug 16, 2003 at 10:56:35AM -0400, Andrew Pimlott wrote:
> On Sat, Aug 16, 2003 at 10:44:17AM -0400, Matt Zimmerman wrote:
> > As compared to what policy, exactly? There exists no policy which can
> > defend against unknown bugs. Period.
>
> The policy of fixing bugs regardless of whether they are known to be
> security holes. I know many people will dismiss this possibility out of
> hand, and it would be a challenge (mostly in enforcing a bug-fix-only
> restriction), but I think the result would be significantly more secure
> and only slightly less stable.
So if maintainers prepare thoughtful updates for stable, with clear and
documented changes which fix real bugs and nothing more, then we should
accept them into stable?
That is what proposed-updates is. Most maintainers don't use it.
> > Show me a distribution where that _doesn't_ apply. This is the reality
> > of security. If you can't afford to audit everything, you rely on
> > others to own up to their bugs.
>
> Yes, but I'm saying we shouldn't rely on upstream, or even the Debian
> maintainer, to distinguish security-related bugs. Then, at least the
> cracker would have to find his own holes.
For almost every bug we have fixed in woody, even if we had somehow pushed
every upstream change into stable since it was released, we would still have
been vulnerable. Security researchers, of all kinds, can and do find new
bugs all the time.
> > ...but not the security team, apparently.
>
> I thought it would be better to let the maintainer handle this, but if I
> don't hear from him soon, I will inform the security team myself. As the
> bug has existed since woody was released, I don't think it is urgent.
The urgency of a bug does not, in general, bear any direct relationship to
its age. Consider the local root vulnerabilities in the kernel which
existed from 2.2 through 2.4. If the bug is significant enough to warrant a
fix in stable, please send a note to team@security.debian.org with the
details.
--
- mdz
Reply to: