Re: conflicts-based solution (was Re: security in testing)

2003-05-16 Thread Matthias Urlichs
Hi, Anthony Towns wrote: > If someone > would like to volunteer whose not in with the security team, or a > release assistant, please talk to herr DPL about doing so, rather than > me. [ patiently waiting for AM approval ] Will do. And, thanks for the info. Whether to further automate this (i.e

Re: conflicts-based solution (was Re: security in testing)

2003-05-15 Thread Anthony Towns
On Thu, May 15, 2003 at 10:40:25AM -0500, Steve Langasek wrote: > An upload to testing-proposed-updates is not the same as an upload to > testing-security, AFAIK (different upload queue, different machinery). > But it was my understanding that both were in working order, they just > aren't used --

Re: conflicts-based solution (was Re: security in testing)

2003-05-15 Thread Sven Luther
On Thu, May 15, 2003 at 05:19:17PM +0200, Matthias Urlichs wrote: > Hi, Sven Luther wrote: > > > On Thu, May 15, 2003 at 10:26:35PM +1000, Anthony Towns wrote: > >> No, it's sitting there, waiting for someone to use it. After a year's > >> neglect it might need some metaphorical oil on its hinges

Re: conflicts-based solution (was Re: security in testing)

2003-05-15 Thread Steve Langasek
On Thu, May 15, 2003 at 04:22:30AM -0700, David Nusinow wrote: > On Thu, May 15, 2003 at 09:03:06PM +1000, Anthony Towns wrote: > > On Thu, May 15, 2003 at 08:09:48AM +0200, Sven Luther wrote: > > > On Thu, May 15, 2003 at 01:13:19PM +1000, Anthony Towns wrote: > > > > On Wed, May 14, 2003 at 07:12

Re: conflicts-based solution (was Re: security in testing)

2003-05-15 Thread Matthias Urlichs
Hi, Sven Luther wrote: > On Thu, May 15, 2003 at 10:26:35PM +1000, Anthony Towns wrote: >> No, it's sitting there, waiting for someone to use it. After a year's >> neglect it might need some metaphorical oil on its hinges and some >> dusting, but it really is there. I'm not just saying this for >>

Re: conflicts-based solution (was Re: security in testing)

2003-05-15 Thread Sven Luther
On Thu, May 15, 2003 at 10:26:35PM +1000, Anthony Towns wrote: > On Thu, May 15, 2003 at 11:13:59AM +0200, Sven Luther wrote: > > On Thu, May 15, 2003 at 09:03:06PM +1000, Anthony Towns wrote: > > > On Thu, May 15, 2003 at 08:09:48AM +0200, Sven Luther wrote: > > > > On Thu, May 15, 2003 at 01:13:1

Re: conflicts-based solution (was Re: security in testing)

2003-05-15 Thread Anthony Towns
On Thu, May 15, 2003 at 11:13:59AM +0200, Sven Luther wrote: > On Thu, May 15, 2003 at 09:03:06PM +1000, Anthony Towns wrote: > > On Thu, May 15, 2003 at 08:09:48AM +0200, Sven Luther wrote: > > > On Thu, May 15, 2003 at 01:13:19PM +1000, Anthony Towns wrote: > > > > On Wed, May 14, 2003 at 07:12:1

Re: conflicts-based solution (was Re: security in testing)

2003-05-15 Thread David Nusinow
On Thu, May 15, 2003 at 09:03:06PM +1000, Anthony Towns wrote: > On Thu, May 15, 2003 at 08:09:48AM +0200, Sven Luther wrote: > > On Thu, May 15, 2003 at 01:13:19PM +1000, Anthony Towns wrote: > > > On Wed, May 14, 2003 at 07:12:15PM -0400, Joey Hess wrote: > > > > Take the harden package, or creat

Re: conflicts-based solution (was Re: security in testing)

2003-05-15 Thread Sven Luther
On Thu, May 15, 2003 at 09:03:06PM +1000, Anthony Towns wrote: > On Thu, May 15, 2003 at 08:09:48AM +0200, Sven Luther wrote: > > On Thu, May 15, 2003 at 01:13:19PM +1000, Anthony Towns wrote: > > > On Wed, May 14, 2003 at 07:12:15PM -0400, Joey Hess wrote: > > > > Take the harden package, or creat

Re: conflicts-based solution (was Re: security in testing)

2003-05-15 Thread Anthony Towns
On Thu, May 15, 2003 at 08:09:48AM +0200, Sven Luther wrote: > On Thu, May 15, 2003 at 01:13:19PM +1000, Anthony Towns wrote: > > On Wed, May 14, 2003 at 07:12:15PM -0400, Joey Hess wrote: > > > Take the harden package, or create something similar: a package that > > > conflicts with all versions o

Re: conflicts-based solution (was Re: security in testing)

2003-05-15 Thread Sven Luther
On Thu, May 15, 2003 at 01:13:19PM +1000, Anthony Towns wrote: > On Wed, May 14, 2003 at 07:12:15PM -0400, Joey Hess wrote: > > Take the harden package, or create something similar: a package that > > conflicts with all versions of packages with known security holes. > > Why not just /fix/ the hol

Re: conflicts-based solution (was Re: security in testing)

2003-05-14 Thread Anthony Towns
On Wed, May 14, 2003 at 07:12:15PM -0400, Joey Hess wrote: > Take the harden package, or create something similar: a package that > conflicts with all versions of packages with known security holes. Why not just /fix/ the holes? Is uploading a package with a well known patch _really_ that hard? C

Re: conflicts-based solution (was Re: security in testing)

2003-05-14 Thread Joey Hess
Matt Zimmerman wrote: > If no one will step forward to do even this, then surely this service must > not be considered particularly valuable. Indeed. I am tempted to do it myself, but I don't currently use testing.. -- see shy jo pgp7DigvDPeLQ.pgp Description: PGP signature

Re: conflicts-based solution (was Re: security in testing)

2003-05-14 Thread Matt Zimmerman
On Wed, May 14, 2003 at 07:12:15PM -0400, Joey Hess wrote: > So here's an alternative that would actually work: > > Take the harden package, or create something similar: a package that > conflicts with all versions of packages with known security holes. Note > that harden currently does not track

conflicts-based solution (was Re: security in testing)

2003-05-14 Thread Joey Hess
Matt Zimmerman wrote: > On Wed, May 14, 2003 at 11:53:31PM +0300, Chris Leishman wrote: > > > Then people can bitch and moan about package X not being available and > > can do something to fix it (eg. finally start doing security updates > > for testing). Or they can just put up with it. But e