On Fri, 8 Jan 2010 17:59:52 -0500 Michael Gilbert wrote: [...] > I propose to show all unspecified urgencies as low in the tracker. FWIW, I don't think this is a good idea. > > Here is the logic: if the commiter really thought the urgency deserved > elevatation, then they would have manually set that. Instead since they > have not done this, then it can and should be concluded that it is one > of low-priority since it wasn't significant enough to set higher. This would force the meaning of an unset urgency into being equivalent to a low urgency. IMHO, this would reduce the expressive power of the security tracker: to me, an unset urgency basically means "unclassified"; that is to say, something that could be low, medium, or even high, but requires further thinking before one can decide which is the correct category. Of course, I would love seeing as few "unclassified" vulnerabilities as possible, but claiming that they should be automatically considered as low urgency looks like cheating to me. An unset urgency is just that: unset. It could even be high urgency, in the worst case scenario, hence it should *not* be conflated with low urgency issues. > > Viewed from another perspective are the following questions. Is there > any real purpose for an unset urgency? I personally think there is one: it basically means "please someone look at me and classify me!" > How does the user interpret that information? I personally interpret it as explained above. > How is it useful? It avoids hiding the fact that some vulnerabilities still have to be classified, and hence are of uncertain urgency. I think that this should be considered as part of the "do not hide problems" philosophy (see SC #3). > Does it make any kind of impact? I think it makes. I hope my own personal opinion is useful as a contribution to the discussion. -- http://www.inventati.org/frx/progs/scripts/pdebuild-hooks.html Need some pdebuild hook scripts? ..................................................... Francesco Poli . GnuPG key fpr == C979 F34B 27CE 5CD8 DC12 31B5 78F4 279B DD6D FCF4
Attachment:
pgpjuJtDk9fqw.pgp
Description: PGP signature