[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Security EOL within Debian Stable

On Wed, Feb 4, 2015 at 8:09 PM, Stephen Dowdy wrote:
> So, if a user installs said package, but fails to notice any EOL DSA
> on it, the package gets left in place in a potentially VULNERABLE
> state.  I.E. if a known exploit comes out, and the package is still
> installed, the end-user could get a nasty surprise thinking that
> because they've added security support to apt-sources and regularly
> update, that they are protected.   This is a non-optimal and undesired
> end-result.

The debian-security-support package somewhat addresses those concerns
[0], but it is not currently installed by default.  There was some
discussion to make that happen, but hasn't been followed through.

> Note that chromium is in 'main' -- not 'contrib' or ..., so there's a
> valid expectation that its security support won't just silently stop
> -- unlike the other FAQ entry that says there's basically no security
> support or contrib, non-free..

I'm not sure where you get the "silently" concern from, but this topic
is already discussed in wheezy's release notes [1].  The problem with
that of course you'll point out is that users often don't read that...

Best wishes,

[0] https://packages.qa.debian.org/d/debian-security-support.html
[1] https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#browser-security

Reply to: