[gentoo-dev] Re: Things one could be upset about

[Duncan]

Rich Freeman posted on Mon, 26 Jan 2015 09:20:30 -0500 as excerpted:

> Honestly, I think we should really reconsider the current GLSA policy.

What's the next step, not to step on anyone's toes?  It's going to take 
coordination, so get a sense of the council first and then see what the 
security team and archs think?  Security team first, then archs and 
council?

Or start a new thread here with a security proposal title and see where 
that goes first?

Because it's nice to think we should reconsider current policy, and I 
obviously think so too, but way down in this thread as it is, this could 
easily get lost and nothing will change, at present.  And that would be a 
shame.  It might be that the changes we're talking have a fatal flaw, but 
if so, better to get a proposal out there and have it properly shot down, 
ideally with another proposal substituted, than to have it sink and never 
know what that fatal flaw was.

Because, well, I shudder to think of the actual security of a publicly 
accessible installation if they're waiting on GLSAs, the way thinks are 
now.  That being the case, it'd arguably be better not to even have the 
charade.  Yes, have a security team and have them do the updates they are 
doing now.  Just don't have GLSAs at the end.  So people can't have a 
false sense of security relying on them.

But if they can be fixed, say by sending the GLSA at first-to-stable or 
even stable-request, I think the GLSAs would actually be useful, and it 
seems you, at least, are of the same opinion.

So where /does/ it go from here?

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman