On Thu, Apr 28, 2005 at 03:45:48PM +0200, Jeroen van Wolffelaar wrote: > It'd be wise for those projects to take the extra precaution by allowing > (and the Debian maintainer to do so) include files outside the web root, > but to DSA for such a thing when there might not even be a vulnerability > at all, seems premature to me. It'd be like fixing all uses of sprintf > because the programmer could have used snprintf to be more sure there is > no problem. That's proactive security to me, and should be done (maybe not through a DSA, but before the package is released). E.g.: OpenBSD. There is no easy way to demonstrate that "there is no problem", and maybe there is one, but nobody noticed, its safer to just purge those unsafe functions anyway. Regards Javier
Attachment:
signature.asc
Description: Digital signature