Hi, > Debian doesn't use chfn & friends from util-linux. wouldn't it make sense (in a case like this) to release a DSA, just stating "we are not affected by this", since this fact is not obvious? Cheers, Thomas