Re: [gentoo-security] courier-imap

[Ben Cressey]

On Friday, March 26, 2004 at 6:48 , Ned Ludd wrote:

> Yeah.. We don't provide a vulnerability announcement/assessment service.
> We provide updates when they exist. If you would like a vulnerability
> announcement service then you should pay. Or simply track the
> security@g.o via bugzilla as most us do.

I don't think that suggesting that I pay for a separate vulnerability
service is an appropriate solution.  It's not simply that I don't feel like
paying; it's that more so than any other distribution, Gentoo has always had
a "community" feel, at least from the user's perspective.  (I gather the
developer side of things is significantly more dictatorial.)  Like many of
us on this list I have contributed a lot of my time to answering questions
in the forums.

So in that vein it seems there should be a community-based way of handling
security fixes.  Had this vulnerability been made known two weeks ago, I
could have begun testing the unstable ebuild and submitting feedback about
it that much earlier.  It is not so much the lack of a fix that concerns me,
as the lack of any significant discussion of the problem apart from
Bugzilla.

I take pains to keep my server secure.  I am frustrated by the illogic of
regularly foisting annoying "minor" updates -- like the Perl 5.8.0 -> 5.8.2
that is currently plaguing my update process, since I remember what a
colossal pain the 5.6.0 -> 5.8.0 transition was -- while at the same time
making security fixes highly inaccessible.

(Sure, delete the perfectly functional perl 5.8.0 ebuilds, but leave the
vulnerable courier-imap one in portage.  This is the worst of both worlds,
in my opinion.)

This is the first time I've seen the suggestion to track security@g.o
via Bugzilla.  I will do so in the future.

Ben


--
gentoo-security@g.o mailing list