Re: How should we handle greenbone-security-assistant?
On Fri, Dec 18, 2020 at 05:12:53PM +0100, Jonas Smedegaard wrote:
> Quoting Adrian Bunk (2020-12-18 15:36:23)
> > On Fri, Dec 18, 2020 at 01:33:33PM +0100, Jonas Smedegaard wrote:
> > > It is indeed not realistic to fit all fast-changing code projects
> > > into Debian. We have made a few fast-paced projects like Firefox
> > > fit, but in my opinion we did that in a problematic way: By
> > > endorsing embedded code copies, which is painful to maintain.
> > >
> > > I think we should not relax our rules, but (improve our packages so
> > > that we can) tighten our rules to apply more consistently - e.g.
> > > avoid embedded code copies also in Firefox.
> >
> > Embedded code copies are the smallest problem with Firefox, and on
> > that I would actually trust Mozilla to release fixes quickly.
>
> I do trust Mozilla to release fixes quickly - my point was a different
> one: Mozilla and Google and GNOME and KDE each being quick to release
> fixes for libusrsctp or some other embedded library is still different
> from linking with a shared copy.
Firefox in unstable is mostly using shared libraries, in (old)stable it
is using some static libraries because Firefox wants more recent
versions than are in the distribution.
The big problem is that Firefox is not security supportable without
upgrading to new upstream versions that are not on the same stable
branch, such software is not suitable for distributions with
security supported stable series like Debian or Ubuntu.
> - Jonas
cu
Adrian
Reply to: