Re: Bug severity and private data disclosure

2013-06-11 Thread Jonathan Dowland
On Mon, Jun 10, 2013 at 08:10:22PM +0600, Andrey Rahmatullin wrote: > Life for the maintainer or for the user? Well, the severity of a bug, from a user POV, makes no guarantee on how serious the maintainer takes it, nor whether they will actually fix it. Admittely some users get comfort from being

Re: Bug severity and private data disclosure

2013-06-10 Thread Vincent Lefevre
On 2013-06-10 23:28:28 +0600, Andrey Rahmatullin wrote: > On Mon, Jun 10, 2013 at 04:15:27PM +0200, Vincent Lefevre wrote: > > This is important for apt-listbugs, which takes into account RC bugs by > > default > Which too is not ideal: for example, I don't think users should care about > such RC

Re: Filtering bugs from apt-listbugs reports (was Re: Bug severity and private data disclosure)

2013-06-10 Thread Andrey Rahmatullin
On Mon, Jun 10, 2013 at 02:40:17PM -0400, James McCoy wrote: > > > > It's amazing how much simpler Debian life becomes if one simply > ignores > > > > bug severities entirely. Of course harder to do nearer to release, but > > > > we live in a time of relative luxury right now… > > > > > > This is i

Filtering bugs from apt-listbugs reports (was Re: Bug severity and private data disclosure)

2013-06-10 Thread James McCoy
On Jun 10, 2013 1:28 PM, "Andrey Rahmatullin" wrote: > > On Mon, Jun 10, 2013 at 04:15:27PM +0200, Vincent Lefevre wrote: > > > It's amazing how much simpler Debian life becomes if one simply ignores > > > bug severities entirely. Of course harder to do nearer to release, but > > > we live in a ti

Re: Bug severity and private data disclosure

2013-06-10 Thread Andrey Rahmatullin
On Mon, Jun 10, 2013 at 04:15:27PM +0200, Vincent Lefevre wrote: > > It's amazing how much simpler Debian life becomes if one simply ignores > > bug severities entirely. Of course harder to do nearer to release, but > > we live in a time of relative luxury right now… > > This is important for apt-

Re: Bug severity and private data disclosure

2013-06-10 Thread Ian Jackson
Vincent Lefevre writes ("Re: Bug severity and private data disclosure"): > Note that this is a regression. Using the testing version (= stable > currently) is fine w.r.t. this bug. Oh, I see. In that case I agree with you. Have you asked the release team ? They are the right

Re: Bug severity and private data disclosure

2013-06-10 Thread Vincent Lefevre
On 2013-06-10 17:16:12 +0200, Cyril Brulebois wrote: > Since you seem concerned about apt-listbugs, make it support listing > security bugs (optionally with a given severity threshold, so as to > ignore minor or normal bug reports tagged security), and there you go. > > [ From a quick look at the

Re: Bug severity and private data disclosure

2013-06-10 Thread Cyril Brulebois
Vincent Lefevre (10/06/2013): > I reported a bug involving private data disclosure, more precisely, > on some network, when printing a file with CUPS 1.6, the file is > printed on a wrong printer[*]. The bug severity was downgraded to > important (i.e. non-RC), despite the obvious security problem

Re: Bug severity and private data disclosure

2013-06-10 Thread Didier 'OdyX' Raboud
Hi Ian, Le lundi, 10 juin 2013 16.11:26, Ian Jackson a écrit : > (I have CC'd cups-client@packages.) (I'd prefer the discussion to happen on the bug.) > I'm not sure exactly what consequences you think should have flowed > from the bug's RC severity. Do you think the release should have been >

Re: Bug severity and private data disclosure

2013-06-10 Thread Vincent Lefevre
On 2013-06-10 15:11:26 +0100, Ian Jackson wrote: > I agree with you that that bug is a potential security vulnerability. > I think the maintainer adopted an overly-close and legalistic reading > of the bug severity guidelines. On the other hand I think the > maintainer makes good points about the

Re: Bug severity and private data disclosure

2013-06-10 Thread Vincent Lefevre
On 2013-06-10 15:05:05 +0100, Jonathan Dowland wrote: > It's amazing how much simpler Debian life becomes if one simply ignores > bug severities entirely. Of course harder to do nearer to release, but > we live in a time of relative luxury right now… This is important for apt-listbugs, which takes

Re: Bug severity and private data disclosure

2013-06-10 Thread Ian Jackson
(I have CC'd cups-client@packages.) Vincent Lefevre writes ("Bug severity and private data disclosure"): > I reported a bug involving private data disclosure, more precisely, > on some network, when printing a file with CUPS 1.6, the file is > printed on a wrong printer[*]. The bug severity was do

Re: Bug severity and private data disclosure

2013-06-10 Thread Andrey Rahmatullin
On Mon, Jun 10, 2013 at 03:05:05PM +0100, Jonathan Dowland wrote: > It's amazing how much simpler Debian life becomes if one simply ignores > bug severities entirely. Life for the maintainer or for the user? -- WBR, wRAR -- To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org with a

Re: Bug severity and private data disclosure

2013-06-10 Thread Jonathan Dowland
It's amazing how much simpler Debian life becomes if one simply ignores bug severities entirely. Of course harder to do nearer to release, but we live in a time of relative luxury right now… -- To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org with a subject of "unsubscribe". Troubl

Re: Bug severity and private data disclosure

2013-06-10 Thread Bastien ROUCARIES
On Mon, Jun 10, 2013 at 1:15 PM, Vincent Lefevre wrote: > I reported a bug involving private data disclosure, more precisely, > on some network, when printing a file with CUPS 1.6, the file is > printed on a wrong printer[*]. The bug severity was downgraded to > important (i.e. non-RC), despite th