Re: Security concerns with minified javascript code
Bas Wijnen <wijnen@debian.org> writes:
> On the other hand, shipping packages that cannot be rebuilt with tools
> from Debian will also result in angry users. For me personally, one of
> the bigger reasons I use Debian is that we take good care that I can
> modify everything on my system, and use the modified version. The users
> you're talking about probably don't care (much) about this, and should
> have contrib and non-free enabled.
> Why should code that doesn't meet our standards (compiler in main) be
> allowed in main? What is the downside of putting it in contrib? "Users
> who don't have contrib enabled can't use it then" is a feature, not a
> bug.
Last time I checked, Doxygen includes minified Javascript in all of its
generated output. Would we have to move every piece of Doxygen-generated
documentation into a separate package so that we could put it in contrib,
or strip it from our packages? Maybe someone has fixed this in Doxygen
somehow?
This is typical of the sorts of problems that I would expect. It would
surprise me if this were a smaller project than the GFDL purging. It
might be quite a bit larger.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: