[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: The keychain package, its debconf templates, the security hole induced



On Mon, Jan 24, 2005 at 10:08:11AM -0600, Cesar Mendoza wrote:
> Hi,
> 
> You know, I'm parent. You look a lot like my son when he doesn't get
> his way. When I don't do what he wants, he would start screaming and
> making noise. I have learned that is better to ignore him for a while
> until he calms down and we can have a normal conversation.

I'm not sure your son provided over hundred patches in bugs to get a really
simple issue fixed in every other package. ;)

> If you have
> contacted me instead of having a tantrum, you would have known that I made
> a mistake and I would have worked with you to have your bug report resolved
> to your satisfaction.

This is not my satisfaction we are speaking about. It's your package (that I
don't even use). I repported a bug against your package just to help you and
improve the overall quality of debian.

I never received any mail from you. Not "thanks", not "go to hell and learn
english in there", nothing. Only an automatic mail stating: 
  * l10n changes Closes: #235812,#259567,#262738,#266356,#274900,#192165

Not even spaces after the colon, it would take 2 lines to close all those
bugs in one shoot (note that my request was about i18n, not l10n).

> I think that is why people receive emails from the
> Bug tracking system. So, people can verify if the Bug was resolved or
> not. Please contact me once you feel that you are ready to have a normal 
> conversation. I will work with you to have the bug resolved.

If you want to improve your package's quality, I already gave you all the
advices I could. If there is something you don't understand, I'd be glad to
assist you. If you expect me to implore your pardon, you're dreaming, dude.

> > So, please do at least the following to your package:
> >  - speak about the potential security hazard in description
> >  - check the pre-installed version before showing your crufty template (or
> >    use README.Debian, it's what it's good for)
> >  - use a proper config script instead of blocking the install with a db_get
> >    in the postinst (just read the debconf documentation)
> >  - do usefull changelog entries in your packages in the future.

Note that I was too mad about all this to think properly. You should convert
your template to an entry into NEWS.Debian, not README.Debian.

And, as a conclusion, I think I owe you an explanation. I reported 151 bug
report about converting debconf templates to po-debconf or dropping them (49
still being open). I become mad about this from time to time. This time, it
falls on you. Last time it was mono packagers...

Have a nice day anyway, 
Mt.

Attachment: signature.asc
Description: Digital signature


Reply to: