| 1 |
Rich Freeman wrote, on 08/27/2011 02:13 PM: |
| 2 |
> Note that I'm basically advocating ditching the tool. A tool is good |
| 3 |
> when it improves productivity. However, right now it appears that the |
| 4 |
> tool is keeping people from contributing who want to contribute. |
| 5 |
> Certainly things couldn't get worse without the tool. If a user just |
| 6 |
> edits an xml template and email template and posts it on the bug, then |
| 7 |
> very little work should be required to review the files before posting |
| 8 |
> them. Contributors wouldn't need any special access either - freeing |
| 9 |
> up devs to provide more of a QA role. |
| 10 |
> |
| 11 |
> Ditching the tool would also simplify fixes to GLSAs. I haven't run |
| 12 |
> it in a while, but took glsa-checker out of my cron ages ago when it |
| 13 |
> would just report packages with vulnerabilities that had none. I did |
| 14 |
> log bugs, but apparently adding one line to the xml files requires as |
| 15 |
> much pain as sending out the original notice. |
| 16 |
|
| 17 |
I have read that idea multiple times now, each of them by people not on |
| 18 |
the security team or something similar. It just doesn't work that way. |
| 19 |
It's like suggesting to ditch Bugzilla and instead enter bugs manually |
| 20 |
with SQL commands into a database. Well, not quite, but you get the idea. |
| 21 |
|
| 22 |
Also, as previously stated, we know that the tool sucks, which is why |
| 23 |
Alex has been working for months on new tools. We really wouldn't spend |
| 24 |
that much time on that if it wasn't worth it. |
Archives