[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Debian policy and security fixes (Was: Re: Debian i386 binaries for Mozilla 1.7 with PostScript available)



Jacob S. wrote:

On Wed, 14 Jul 2004 15:07:13 +0200
Paul Dwerryhouse <paul@dwerryhouse.com.au> wrote:

On Tue, Jul 13, 2004 at 11:26:53PM +0200, Paul Seelig wrote:
Hopefully PostScript will soon be enabled in the official Debian
packages again.
It appears that it will be re-enabled in 1.7.1:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=256072

Why it can't be re-enabled in 1.7, I don't know. Has anyone worked
out why the maintainer was so stubborn about this issue?

Along those lines, isn't there some Debian-policy concerning stuff like
this? I saw someone else ask in a previous thread about Mozilla, but
never saw an answer to it.

Let me say I know it takes a lot of work to build packages and upload
them to the Debian server. I understand that it's not just a matter of
getting it to build right, but also to use the right config options so
that it Just Works(tm) the way Debian is famour for. I really appreciate
all the work Debian Developers do in this regard, but it seems to me
that the Debian Developer for Mozilla is lacking some crucial
experience.
After all, what knowledgeable DD would remove a feature and upload a new
version based on 3 sentences from a non-dd, without at least 1) checking
with upstream about mentioned exploit 2) look in upstream forums and bug
reports for mentioned exploit 3) get the proper folks to issue a DSA
about the problem and explain why we have to use an inferior product to
fix a non-fixable hole in the superior product.

So, how did said DD become a DD for such an important package as Mozilla
and Firefox if they didn't know such standard procedures?

Is there a Debian policy for forcefully removing a package from a DD's
jurisdiction and assigning it to another DD? Not that I'm not willing to
give the Mozilla DD a second chance, just that this experience has made
me curious about what procedure might be.

This is a matter probably better directed to the technical committee.


--

Cheers
John

-- spambait
1aaaaaaa@computerdatasafe.com.au  Z1aaaaaaa@computerdatasafe.com.au
Tourist pics http://portgeographe.environmentaldisasters.cds.merseine.nu/



Reply to: