Re: [gentoo-security] No, apparently not. (was: Is anybody else worried about this?)

[Kurt Lieber]

On Mon, Nov 08, 2004 at 12:52:42AM +0100 or thereabouts, Peter Simons wrote:
> There is a certain irony to the fact that you (and others)
> go on and on lecturing me (and others), all the while it is
> perfectly obvious that you have absolutely no idea what this
> problem really *means*.

Perhaps you haven't done a good job of educating us, then.

I will say that I was one of the folks arguing most strongly for getting
ebuild signing support in portage, so I certainly see the value in that
feature.  I also see the value in getting signed eclasses in portage, but I
believe that value to be less and not as important as other things within
portage that I'd like to see.

> So if you guys would like to be the laughing stock of the
> free software community once this vulnerability is exploited
> for the first time, all I say is: Be my guest.

Gentoo is a community-based distribution.  I'm sorry you see it as an "us
vs. them" thing.  I'm also sorry you apparently ignored the part where I
said that if you believe this to be a serious problem, then please feel
free to provide patches that fix it.  Being a community-based distro, we
rely on each other to make Gentoo a better distribution.  We don't wait for
"them" to fix problems.  Instead, we roll up our sleeves and become part of
the solution.  Just because I don't personally agree with your
interpretation of this issue doesn't mean that you can't fix it.

--kurt