Gentoo Archives: gentoo-dev

From: Jason Stubbs <jstubbs@g.o>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] [Fwd: [gentoo-security] Trojan for Gentoo, part 2]
Date: Sun, 07 Nov 2004 11:41:36
Message-Id: 200411072043.27297.jstubbs@gentoo.org
In Reply to: Re: [gentoo-dev] [Fwd: [gentoo-security] Trojan for Gentoo, part 2] by Patrick Lauer
1 On Sunday 07 November 2004 20:06, Patrick Lauer wrote:
2 > On Sun, 2004-11-07 at 12:19 +0900, Jason Stubbs wrote:
3 > > On Sunday 07 November 2004 05:56, Joshua Brindle wrote:
4 > > > perhaps some motivation for portage devs....
5 > > >
6 > > > See bug #26110
7 > >
8 > > The bug was originally about versioning eclasses, which has very little
9 > > to do with adding a trojan.
10 >
11 > As long as there are no eclass versions they can be modified without any
12 > checks detecting it. That was one of the things the original poster
13 > found to be very lacking since it even allows for "evil" eclasses.
14
15 Bah.. I don't know why I even bothered answering this in the first place. Oh,
16 right, yeah. My point was that this shouldn't be pinned on the portage team.
17
18 Versioning of eclasses has absolutely nothing to do with portage. Do you use
19 eclasses? Do they have versions? Why not? As far as I can tell, the only
20 people to have decided upon using versioned eclasses are the kernel team.
21
22 The real problem is the general apathy toward many issues. Many people like me
23 just say "it's not my fault" and many people like you say "well, somebody has
24 to do it" but don't actually step up to the plate.
25
26 The truth of the matter, as far as I can see, is that nobody cares enough
27 about this issue to put the effort into planning, coordinating and executing
28 a given solution. Somebody, please prove me wrong.
29
30 Regards,
31 Jason Stubbs
32
33 --
34 gentoo-dev@g.o mailing list

Replies

Subject Author
Re: [gentoo-dev] [Fwd: [gentoo-security] Trojan for Gentoo, part 2] Chris Bainbridge <chris.bainbridge@×××××.com>