Re: [SECURITY] [DSA 3547-1] imagemagick security update
On Wed, Apr 13, 2016, at 02:32, Peter Palfrader wrote:
> On Tue, 12 Apr 2016, Michael Stone wrote:
>
> > On Tue, Apr 12, 2016 at 08:56:35PM -0300, Henrique de Moraes Holschuh wrote:
> > >Then, maybe we should consider a better way to deal with areas where you
> > >get only one choice out of geoip?
> >
> > Reach out to the relevant team outlining your issues (e.g., lack of IPv6
> > connectivity)? Advising people to hard code security mirrors isn't the right
> > solution.
>
> There's also nothing inherently wrong with just having a single address
> in an RRSet.
It means a single point of failure for that region: e.g. if the mirror
is stale, everything in that region will hit the same stale mirror, be
them users using apt, or "unrecommended" leaf mirrors of
debian-security. This makes it harder for an user to work around the
breakage (they would need to use an unofficial security mirror from a
different region as the backup source for security updates).
Well, it is not a common issue, and it will be even less common if
someone manages to implement the staleness check.
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique de Moraes Holschuh <hmh@debian.org>
Reply to: