Rick Barry <existentialsai...@yahoo.com> posted 813873.32633...@web34604.mail.mud.yahoo.com, excerpted below, on Wed, 24 Dec 2008 05:19:02 -0800:
> I recently ran my update manager in Ubuntu 8.04. I installed 20 odd > "security" updates. Now PAN 0.132 will no longer import NZB files. Doing > so simply shuts the program down. So they patched the problem by patching out the ability to import *.nzbs... /only/ about five months after most reasonable distributions patched it using upstream's patch of the real problem, and four months plus since upstream released 0.133 including its patch. Or maybe they didn't update pan at all (the OP didn't say pan was updated), but rather one of its libraries... with an incompatible version... What about pan's usual tasks.nzb file that it stores its own tasks list in? Does that still work? If it does, the buffer underflow and thus the security issue may still exist in it. However, one could then work around the importing nzb problem by shutting pan down, renaming the nzb they wanted to import to replace pan's file, then reopening pan. If it doesn't, what do they use to store pan tasks over a shutdown, or do they just forget them now? Regardless, the experience with this, with their bug on the problem sitting open for months after many distributions have fixed the problem, their security address still CCed, I lost my formerly high respect for Ubuntu some months ago and would no longer recommend it to anyone. (Of course I use Gentoo, personally, but while it's a great fit for me, it's not something I'd recommend for the average person.) -- Duncan - List replies preferred. No HTML msgs. "Every nonfree program has a lord, a master -- and if you use the program, he is your master." Richard Stallman _______________________________________________ Pan-users mailing list Pan-users@nongnu.org http://lists.nongnu.org/mailman/listinfo/pan-users
