Re: [gentoo-dev] why is the security team running around p.masking packages

[J. Roeleveld]

On Wednesday, July 06, 2016 11:13:55 PM Andrew Savchenko wrote:
> On Wed, 06 Jul 2016 20:23:46 +0900 Aaron Bauman wrote:
.....

> Please understand me correctly: I'm not blaming you or security
> team for this or that issue. But it looks like security team indeed
> needs to review some policies and approaches to suit needs of
> Gentoo users better in both of terms of security and usability, to
> find some reasonable compromise between them, which will satisfy
> most users. For these very issues it looks like canceling "removal
> in 30 days" clause from p.mask action will do the job.

+1 on this. Please don't simply tree-clean packages because of security 
issues. Masking them with a reference to the security issues should be 
sufficient.

Some applications can easily be used safely even with gaping security holes. 
(A heavily firewalled box or air-gap comes to mind).

--
Joost