Re: [gentoo-user] Re: Heads up: Your system might be broken and/or insecure due to serious patch-2.6 bug

[Philip Webb]

091205 daid kahl wrote:
>>  2  pieces of advice to avoid such problems:
>> (1) never use the 'testing' versions of system pkgs;
>> (2) never run 'emerge world' without the '-p' flag.
> I kindly disagree.

Thanks for the "kindly": I thought I'd walked into a high-school locker room.

> ~[arch] is testing for Gentoo ebuild.  It's considered stable upstream.
> This was an upstream bug, not a Gentoo bug.

Yes, my comments didn't respond exactly to the problem reported,
but offered more general advice which might help avoid such problems.

> someone's got to be testing stuff and filing reports upstream.
> It doesn't mean you want to do it, but I really think
> considering ~ as a test of upstream is rather silly.

The defective version of 'patch' had got into 'testing',
where the only remaining problems are supposed to be in the ebuild;
in fact in this case, there was still a serious problem upstream
& that version of 'patch' has been re-masked (I believe).

Anyway, don't do testing on the machine you use for everyday computing.
If you want to get into testing, use a dedicated machine for it.

It's late Friday, so let me stick my neck out again
(grins, sighs & gets another beer out of the fridge).

At least once/month, if not once/week, someone reports on Gentoo User:
"I did an emerge sync, installed the latest blahblah-1.2.3,
did 'emerge world' & something dreadful has happened to my system".

I've been using Gentoo for more than 6 years & it's never happened to me.
I believe the reason is that I follow my own advice as above:
I do install 'testing' versions of non-vital pkgs (eg 'eix')
& items which are well-supported upstream (eg KDE, kernel),
but I am very cautious about installing testing versions of system pkgs
whose collapse would do real damage to my everyday activities.
Even when stuff is well-supported upstream, I give it a few weeks
to see if there are reports anywhere of bad things happening.

Eg I have not moved upto the testing 'eix-0.18.3',
because it requires that I replace 'lzma-utils' with 'xz-utils':
it's not worth the risk of doing real damage elsewhere
simply to get the latest version of 'eix', which is useful but non-essential.
When 'xz-utils' reaches 'stable' (and has a less frightening version number),
I will happily make the upgrade.

Also, I never do a bald 'emerge world'. I look thro' the output of 'eix-sync',
write -- with a pencil+paper -- a list of installed pkgs which have changed,
run 'emerge -Dup world' to see what order of emerging is recommended,
then individually 'emerge -pv <pkg>' & -- if all looks well -- 'emerge <pkg>'.
Yes, it takes a bit longer for my weekly update session (tomorrow Sat),
but I don't risk the nightmare of reducing my system to chaos
with all the extra frantic labor which would result.

Again, I've been doing this for  6 years  with Gentoo on  2  machines
& haven't run into any major setbacks.

By all means, ignore my advice & do it your own ways (smile).

-- 
========================,,============================================
SUPPORT     ___________//___,   Philip Webb
ELECTRIC   /] [] [] [] [] []|   Cities Centre, University of Toronto
TRANSIT    `-O----------O---'   purslowatchassdotutorontodotca