Re: [gentoo-dev] Why masks are being used for security issues instead of GLSA?

[Pacho Ramos]

El mar, 30-09-2014 a las 13:47 +0400, Sergey Popov escribió:
[...]
> I think you are get some things wrong - they are masked not instead of
> GLSA, but prior to it.
>
> Let me explain the process on behalf on my security hat - before
> releasing GLSA we should rid of all vulnerable versions in tree.
> However, sometimes it leads to problems with migration on new
> versions(usually happens with complex packages, for example OpenLDAP).
> So, to mark that some versions are really not for ordinary users we can
> security mask them. After that - we do not need to remove them, just
> keep an eye that they would not be unmasked. The next step for these
> versions is only to be removed from tree, after all issues with
> dependant packages will be fixed.
>
> And then - we can proceed with making GLSA. Masking of package does not
> replace making GLSA and never was!
>
> If you are claim that GLSA making process is too slow, well... We have
> vast amount of security issues and not many people who handles them, so
> - here we are...
>
> As for ppp, i masked it, because there are some packages in tree that
> hardcodes usage for specific versions of ppp and they should be patched
> BEFORE vulnerable versions of ppp will leave tree.
>
> I want to notice, that such practice was established a long time ago,
> from the very beginning of Gentoo Security team and i do not think that
> we should change something in it
>

Only a question: why GLSAs aren't released until the vulnerable version
is not dropped? Wouldn't be better for people relying on GLSAs to get
the glsa as soon as they can install the fixed version (I mean, when
that version is stabilized)? 

Thanks for the info :)