Re: debian.org/security is wrong to say what it does
On Sun, Dec 26, 2021 at 09:36:47PM +0100, maxwillb wrote:
> December 26, 2021 1:25:30 PM CET "Andrew M.A. Cater" <amacater@einval.com> wrote:
>
> > but that doesn't mean that everything marked as vulnerable is still at risk.
>
Hi maxwillb
I've tried to explain what I understand by the security tracker.
The security tracker is based on sid / Debian unstable and if it is fixed
in Sid, it's marked as such and others are automatically marked as vulnerable.
That doesn't mean to say that each distribution point marked as vulnerable
remains vulnerable throughout the life of the distribution: maintainers
are constantly fixing stuff.
> I couldn't understand what you meant, and figured you were referring to some extra hardening done by Debian. Did some googling, and apparently, it's the opposite. Debian disables Chromium's own hardening?
>
> https://www.whonix.org/wiki/Dev/Chromium#Chromium_Debian_Package_Security
Whonix is itself based on Debian. Each distribution does its own thing.
If you are not sure on what is patched or why, maintainers can
probably tell you. Just reading patch sets very quickly there are
bits that don't need to be included. If the only "official" build of
Chromium comes from Google/Alphabet, then it's not for Debian to set that,
for example, and Debian doesn't build for Android.
>
> """
> Thus, the Debian Chromium has substantially worsened
> security than an official version. However, despite this,
> it may still be more secure than Firefox (Firefox never
> had many of the disabled mitigations in the first place).
> """
>
> > If you're unhappy with data presentation, feel free to contact the security team
>
> Am I the only one unhappy with it? Are you happy with it?
>
I'm not particularly unhappy with it and not as upset as you appear to be.
I hang around here to try and help users: I publish the monthly FAQ
but I'm not necessarily authoritative and my opinions can always be very
wrong.
I think I've probably said enough on this topic: I'd hoped to be more clear
but it's obvious to me that it is probably not productive for me to labour
the point further. Happy to help where I can, however.
With every good wish, as ever,
Andy Cater
> --
> Sent with https://mailfence.com
> Secure and private email
>
Reply to: