Date: Fri, 6 Oct 2000 09:01:31 +0200 From: Andre Albsmeier <andre.albsmeier@mchp.siemens.de> To: Alfred Perlstein <bright@wintelcom.net> Cc: cvs-all@FreeBSD.ORG Subject: Re: cvs commit: src/usr.bin/finger finger.c Message-ID: <20001006090131.A61051@curry.mchp.siemens.de> In-Reply-To: <20001005233620.B27736@fw.wintelcom.net>; from bright@wintelcom.net on Thu, Oct 05, 2000 at 11:36:20PM -0700 References: <ru@FreeBSD.org> <200010051715.e95HFVn34590@hak.lan.Awfulhak.org> <20001005135833.A87853@citusc17.usc.edu> <20001005142209.G27736@fw.wintelcom.net> <20001006074832.A9078@curry.mchp.siemens.de> <20001005233620.B27736@fw.wintelcom.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 05-Oct-2000 at 23:36:20 -0700, Alfred Perlstein wrote: > * Andre Albsmeier <andre.albsmeier@mchp.siemens.de> [001005 22:48] wrote: > > On Thu, 05-Oct-2000 at 14:22:09 -0700, Alfred Perlstein wrote: > > > > > > > > You know, perhaps after two security holes we should just > > > > back this darn thing out until someone can review it? > > > > > > I think a good policy about this is to: > > > > > > 1) look at the feature and patch > > > 2) think about it really hard > > > 3) realize how f*cking useless and dangerous it is > > > 4) tell the submitter "no, sorry but i can't possibly put this in!" > > > 5) sit back and have a beer to congratulate yourself after not > > > introducing yet another security issue. > > > > > > http://www.FreeBSD.org/cgi/query-pr.cgi?pr=bin%2F11997 > > > > The patch described in the PR mentioned above is NOT useless. > > Maybe for you since you either got /var/spool/samba and > > /var/spool/lpd each on different 8GB filesystems or because > > all of your 1200 dpi color printers are currently out for > > repair. > > > > Of course, a patch can contain security holes -- especially > > if the submitter mentiones it in the text and is explicitly > > asking for reviewing it. > > > > I wouldn't judge things useless only because _I_ can't use it... > > In the form it was in the PR, ie "huge gaping security hole the > size of Montana" it was entirely useless. > > I should have said "useless/dangerous", not all useless patches > are dangerous but all dangerous patches are useless until corrected. In this case, it would have been enough to write 3) realize how (f*cking) dangerous it is :-). I read your words as if you tried to say that the whole thing is useless but, anyway, this has been cleared out now. -Andre To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001006090131.A61051>