Re: [gentoo-security] courier-imap

[Kurt Lieber]

On Fri, Mar 26, 2004 at 07:28:03AM -0500 or thereabouts, Ben Cressey wrote:
> I don't think that suggesting that I pay for a separate vulnerability
> service is an appropriate solution.  It's not simply that I don't feel like
> paying; it's that more so than any other distribution, Gentoo has always had
> a "community" feel, at least from the user's perspective.  (I gather the
> developer side of things is significantly more dictatorial.)  Like many of
> us on this list I have contributed a lot of my time to answering questions
> in the forums.

I think solar was suggesting that our core competencies as a project do not
include notifying the community every time a new security vulnerability is
released.  There are already a number of community-based resources that do
just that (bugtraq, etc).  We're already strapped for resources and time,
so suggesting that we take on this additional responsibility is not
feasible at this point in time.

> So in that vein it seems there should be a community-based way of handling
> security fixes.  Had this vulnerability been made known two weeks ago, I
> could have begun testing the unstable ebuild and submitting feedback about
> it that much earlier.  It is not so much the lack of a fix that concerns me,
> as the lack of any significant discussion of the problem apart from
> Bugzilla.

This is an open list -- people are free to discuss whatever
security-related issues they wish to here. 

> I take pains to keep my server secure.  I am frustrated by the illogic of
> regularly foisting annoying "minor" updates -- like the Perl 5.8.0 -> 5.8.2
> that is currently plaguing my update process, since I remember what a
> colossal pain the 5.6.0 -> 5.8.0 transition was -- while at the same time
> making security fixes highly inaccessible.

Suggesting that we deliberately made security fixes "inaccessible" is
inaccurate.  We are a community-based distro and are thus highly-dependent
on our community members to provide support and volunteer their time to
help make Gentoo better.  If enough people do not volunteer their time,
things like this will happen, plain and simple.

We have made efforts to recruit additional help with some success.  You can
also help by proactively monitoring security lists, filing bugs, creating
patches, testing security-relateed ebuilds etc.  If everyone sits around
passively waiting for someone else to tell them there is a problem, nothing
will ever get done.  I'm sorry if that comes across as rude (I don't mean
it that way) but I want to be explicitly clear: without your *active*
participation, we will not have a robust, solid security project.  ("your"
refers to the entire list, btw, not just you specifically). 

--kurt