[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Mozilla "PostScript/default" security problems



On Fri, 2004-07-09 at 02:29, Ralph Aichinger wrote:
> In-reply-to: <[🔎] 1089332159.6413.69.camel@duke.gregfolkert.net>
> References: <[🔎] 1089332159.6413.69.camel@duke.gregfolkert.net>
> 
> 
> Greg Folkert wrote:
> > A non-working Epiphany browser or non-working Galeon Browser. All I
> can
> > say, if you don't know to fix it in Sid, you should be using Stable.
> 
> As several threads on debian-user and debian-gtk-gnome point out,
> the only way to fix this in sid is by recompiling the package.

Er-kay. I see, umm, well EXACTLY MY POINT.

> Hopefully Sarge will be released by Autumn. It does not look like
> there will be a solution by then, at least for Epiphany (no Idea 
> about Galeon, don't use it). So this "don't use sid" is a non-argument.
> Epiphany won't get a XPrint backend until Sarge is released unless
> it somehow magically appears. As recompiling is not an option and
> a browser without printing is considered broken, Ephy will be
> possibly dropped from Sarge.

If it has to be that way, then it does. Many packages I want to use are
either orphaned or up for adoption. the WNPP list is getting insane. If
I were a true developer instead of a Network/Systems Analyst that will
program around bugs/difficulties to get the job done, I'd be more than
happy to work on them.

> Also while I am not strictly against recompiling stuff, this does not
> scale. What if OpenOffice compiles out stuff next, that can only
> be fixed by rebuilding stuff? If I thought recompiling large packages
> was so much fun, I would probably be using Gentoo.
This I will agree. But, then why use Sid? If you are not willing to bear
some hard times with Sid, you are not Worthy.

I can not tell enough people, enough times, that using Sid for daily
production work can be and at sometimes is extremely painful. If you do
not know how to workaround/fix these issues... USE STABLE.

> Add to this the compatibility problems some people have with
> the XPrint backend (inferior graphics output, complicated 
> resolution settings, cut-off page borders on some printers)
> even if they do not use Epiphany or Galeon, but Mozilla or 
> Firefox.

Well now that is just silly beyond compare. I have not had any real
difficulty making XPrint work as acceptably as any other printing
alternative.

> *And*

Big AND there buster.

> Even if I can compile the PS backend in again, the original
> *security bug*, if there is one will be reintroduced into
> my binaries. This security bug has *never been exactly defined*,
> *no* Advisories have been shown (see comments to #256072).
> So even if I can print again, I do not know if I actually 
> want this, if I can be owned instantly by doing this
> (same is true for woody boxes, where PS is still enabled).

There is another thread is debian-security right now that has disclosed
the threat and the web-site that offers the advisory.

It might _not_ *BE* vulnerable in the older code set that Stable uses, I
am not sure on this one.

Cheers.
-- 
greg@gregfolkert.net
REMEMBER ED CURRY! http://www.iwethey.org/ed_curry

Novell's Directory Services is a competitive product to Microsoft's
Active Directory in much the same way that the Saturn V is a competitive
product to those dinky little model rockets that kids light off down at
the playfield. -- Thane Walkup

Attachment: signature.asc
Description: This is a digitally signed message part


Reply to: