Re: [gentoo-security] Additional vulnerability in SAMBA <=3.0.7

[Ed Grimm]

On Mon, 15 Nov 2004, Calum wrote:
> On Monday 15 November 2004 12:50, Christophe Garault wrote:
>>
>> This is one of my main question before having Gentoo on my servers.
>> What is the lifetime of ebuilds? Will I still be able to maintain
>> PHP4 in two years, or will I have to upgrade to PHP5 even if I don't
>> want new features?
>
> I wonder the same thing. I am building a server that will be very hard
> and expensive for me to access if anything goes wrong with the
> networking.
>
> I have the same questions - devfs and udev is the one I am asking
> myself currently. If I need to upgrade the kernel at some stage due to
> some exploit, or whatever, and devfs is dropped, do I trust myself to
> swap over to udev remotely, and get the device name changes perfect
> remotely?
>
> Or do I go for a slightly less mature udev now?

Most of the systems that I have encountered in a role where physical
access is limited do not need either devfs or udev - if nobody can get
to it, hotswapping USB/Firewire devices is not going to be a priority,
and devfs/udev isn't actually required even for hotswap (it just makes
it a whole lot easier).  Personally, one of my annoyances with Gentoo is
that it complains if you don't have either (but it doesn't require udev
be executed, so I've installed it simply to have less panicy boots.)

On the other hand, my answer on the main question - nowhere near long
enough for any serious use, at the moment.  Personally, I think there's
a need for a new set of keywords, for 'enterprise stable'.  I don't see
this happening until many of the devs are full-time paid staff, however.
After all, supporting old versions is extra work, and it's not something
the devs are personally interested in doing.

Ed

--
gentoo-security@g.o mailing list