From owner-freebsd-security Tue Mar 12 14:12: 1 2002 Delivered-To: freebsd-security@freebsd.org Received: from vapour.net (vapour.net [198.96.117.180]) by hub.freebsd.org (Postfix) with ESMTP id 9343737B405 for ; Tue, 12 Mar 2002 14:11:58 -0800 (PST) Received: from vapour.net (vapour.net [198.96.117.180]) by vapour.net (8.11.6/8.11.6) with ESMTP id g2CM4vb17820; Tue, 12 Mar 2002 17:04:57 -0500 (EST) (envelope-from batsy@vapour.net) Date: Tue, 12 Mar 2002 17:04:54 -0500 (EST) From: batz To: Christopher Schulte Cc: lewwid , freebsd-security@FreeBSD.ORG, Max Mouse Subject: Re: PHP 4.1.2 In-Reply-To: <5.1.0.14.0.20020312155431.04f93ac0@pop3s.schulte.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Tue, 12 Mar 2002, Christopher Schulte wrote: :I don't think so. The port maintainers can upgrade their ports without :much fear of breaking the rest of the base OS, unlike commits to :STABLE. This is why RELENG_4_X was created. You get all the critical :fixes ( mostly security at this point ) without having to worry about all :the other muck in -STABLE that could possibly cause problems or change :expected behavior. : :No need to add unnecessary complexity. The ports work quite well as is. I don't see how my suggestion would change the way the ports work at all. It could work in paralell and co-exist quite peacefully. So just a point of clarification then. By what you are saying, I can infer that RELENG_4_X also includes security fixes in ports which I can cvsup on a daily basis, and by doing this, fix any ports which have been declared vulnerable. I should further be able to automaticly upgrade any ports which use the vulnerable one as a dependency, by cvsup'ing RELENG_4_X. This is true? Thx, -- batz To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message