Didier 'OdyX' Raboud <o...@debian.org> schrieb:
>> FWIW, I don't. I think the compromise that the security team is proposing is
>> much more reasonable than such an alternative.
>
> That compromise (which I do definitely support for wheezy) puzzles me most
> for
> the precedent it creates: if we "give up" [0] maintaining some of the most
> security-sensitive softwares up to our stable policy, why should other
> packages be bound to it?
- having a web browser in the distro is crucial and
$random-other-app-to-buggy-to-support isn't
- Mike has done a terrific job of backporting security fixes (up to 100
security patches per month!), but modern web browsers expose a unique
environment on their own. Even if we backport security fixes (and we
cannot continue any longer since the resources are not there anymore!)
we still miss out important security enhancements (e.g. lenny-security
missed CSP support). Not to mention the fast-moving browser requirements,
which are not security related (e.g. HTML, WebGL).
- The policy we're following is the intended update policy for enterprise
envionments (e.g. Ubuntu updates to the current upstream release even in
their oldest supported distro)
- The ESR releases shipped by Mozilla receive more QA testing than we
could possibly provide for our backports.
Cheers,
Moritz
--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/slrnkqm1v1.4u1....@inutil.org
