Salvatore Bonaccorso wrote... > I was hoping to see some other feedback/tests on that. But it worked > for me as well in my testinstance.
While the new appearence of the security tracker is a *huge* improvemnt, both in information details and design, thanks for that, there's still something I'd like to bother: While accurate, it sends the wrong message to those who don't know the background, that's a lot of people, and that's a problem. As an arbitrary example, <https://security-tracker.debian.org/tracker/CVE-2014-0207> lists "squeeze, squeeze (security)" and "wheezy" as "[red]vulnerable". The meaning is "squeeze, squeeze (security) is no longer supported, use squeeze (lts) instead"; and "wheezy will be handled in the next point release, use wheezy (security) and you're safe". We (as in Debian adept) know this, at least to some extent. The message sent to the unaware, for example from other distributions, however is: "These Debian guys haven't fixed some security issues yet." This conception, implying Debian was not secure to use, may arise even to those without bad intentions, nevertheless Debian's reputation might suffer from that. While originally the tracker might have been mostly for internal use, it's public information, and I think it's important to put some clarification into it. So I'd suggest to use "[red]vulnerable" only in places where action by someone (maintainer/security team/LTS) is required. And yes, this means more than just two states. As a suggestion for the above issue: + squeeze, squeeze (security) 5.04-5+squeeze5 [gray]No longer supported¹ | squeeze (lts) 5.04-5+squeeze7 [green]fixed + wheezy 5.11-2+deb7u3 [light red]fix pending² | wheezy (security) 5.11-2+deb7u5 [green]fixed | jessie, sid 1:5.19-2 [green]fixed + ¹ The squeeze suite has been discontinued. Use the "squeeze-lts" version + ² Will be handled in due course. Use the "wheezy (security)" version The footnotes are part of the text. And yes, they'd have to appear on every page. Your opinion on that? Christoph
signature.asc
Description: Digital signature
