[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: About the security issues affecting dcraw/ufraw/libraw/rawtherapee/rawstudio/exactimage/freeimage in Squeeze

Holger Levsen <holger@layer-acht.org> writes:

> (mostly using darkstar as an example. I don't event know that package - but I 
> noticed that I decided not to care much about my squeeze-backports anymore (eg 
> not to backport piuparts) while realizing I'd still do security fixes.)

darktable is probably a good example of a package where even security
support doesn't make much sense.

- The code is changing very quickly to support new camera hardware;
  upstream already considers the version in Jessie obsolete.

- It's consumer/desktop code. I guess there's no server infrastructure
  depending on photo editing software. I'm just not that sympathetic to
  the individual user who hasn't upgraded from squeeze.

- The software is quite demanding; essentially it is barely functional
  on 32 bit machines because of memory demands. So I doubt very much
  there are many people running it on old computers.

- The development version (for stretch) will actually be more secure,
  since it eliminates libraw, a constant source of CVEs.

My expectation when uploading a backport is to support it until the next
stable release. Sorry LTS people, but in this case your itch is not my
itch. If that's wrong, please let me know, and I'll think very carefully
about what I backport in the future.

Reply to: