[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Reducing the attack surface caused by Berkeley DB...



On Thu, Jan 25, 2018 at 11:59:06PM +0100, Lionel Debroux wrote:
> In practice, Berkeley DB is a core component of most *nix distros.
> Debian popcon indicates that libdb5.3 is installed on ~80% of the
> computers which report to popcon.

I wonder how many of this ~80% is only due to having installed apt-utils
(99.83%) for apt-extracttemplates (which is responsible for having many
debconf questions before the installation process starts).

Anyway, the only util in apt-utils making use of libdb is apt-ftparchive
which a) isn't used much in Debian – but by some derivatives¹ and b) can
operate without the backing of a db, but you don't want to run a large
archive without it.

Famous last words, but I doubt there is anything libdb does for
ftparchive which couldn't be done by any other database, so switching
shouldn't be too hard database-wise…

Finding someone performing the daunting task of actually switching code,
documentation and existing databases over on the other hand… I at least
don't see me enthusiastically raising my arm crying "let me, let me, …".


Best regards

David Kalnischkies

¹ The Census has a field for "Archive tool", but that isn't filled by
everyone in the census. The biggest fish might be launchpad/Ubuntu.

Attachment: signature.asc
Description: PGP signature


Reply to: