From owner-freebsd-ports@FreeBSD.ORG  Thu May 28 17:31:43 2015
Return-Path: <owner-freebsd-ports@FreeBSD.ORG>
Delivered-To: freebsd-ports@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id BD2C5572
 for <freebsd-ports@freebsd.org>; Thu, 28 May 2015 17:31:43 +0000 (UTC)
 (envelope-from feld@FreeBSD.org)
Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com
 [66.111.4.29])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 90BCA9DC
 for <freebsd-ports@freebsd.org>; Thu, 28 May 2015 17:31:43 +0000 (UTC)
 (envelope-from feld@FreeBSD.org)
Received: from compute6.internal (compute6.nyi.internal [10.202.2.46])
 by mailout.nyi.internal (Postfix) with ESMTP id D55A820943
 for <freebsd-ports@freebsd.org>; Thu, 28 May 2015 13:31:42 -0400 (EDT)
Received: from web3 ([10.202.2.213])
 by compute6.internal (MEProxy); Thu, 28 May 2015 13:31:42 -0400
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=
 messagingengine.com; h=cc:content-transfer-encoding:content-type
 :date:from:in-reply-to:message-id:mime-version:references
 :subject:to:x-sasl-enc:x-sasl-enc; s=smtpout; bh=AZkFBCpB90LvIZf
 PzwXaaA0de0I=; b=j1sn9rOjIe2eSyDSaULwK4w8WUZWb/kQmBow6qaqklZBTDt
 l1qv105NAG7rdSB81dE+nDjroadQBMi1KxNczDti1a0Sk1uoWo+q4UD+oTGvYFTy
 hAPVPFgL8T04pwI78LcshuLlCWwRJugDI9Le/tyBQePh3wbLZlJH/u08OjH4=
Received: by web3.nyi.internal (Postfix, from userid 99)
 id B0B4A10E3A6; Thu, 28 May 2015 13:31:42 -0400 (EDT)
Message-Id: <1432834302.3255751.280669169.3E59C44B@webmail.messagingengine.com>
X-Sasl-Enc: vF41pNFAmRcFhpr3V5UXQ7mrgKyH3U8bhfO6FBRiAghF 1432834302
From: Mark Felder <feld@FreeBSD.org>
To: Bryan Drewery <bdrewery@FreeBSD.org>, Roger Marquis <marquis@roble.com>
Cc: freebsd-ports@freebsd.org
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain
X-Mailer: MessagingEngine.com Webmail Interface - ajax-073992ec
Subject: Re: New pkg audit / vuln.xml failures (php55, unzoo)
Date: Thu, 28 May 2015 12:31:42 -0500
In-Reply-To: <556746A4.4090208@FreeBSD.org>
References: <alpine.BSF.2.11.1505171402430.52815@eboyr.pbz>
 <20150523153029.B7BD3280@hub.freebsd.org>
 <1432659389.3130746.278522905.6D1E6549@webmail.messagingengine.com>
 <20150527174037.EF719B11@hub.freebsd.org>
 <556746A4.4090208@FreeBSD.org>
X-BeenThere: freebsd-ports@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Porting software to FreeBSD <freebsd-ports.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-ports>,
 <mailto:freebsd-ports-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ports/>
List-Post: <mailto:freebsd-ports@freebsd.org>
List-Help: <mailto:freebsd-ports-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports>,
 <mailto:freebsd-ports-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 28 May 2015 17:31:43 -0000



On Thu, May 28, 2015, at 11:47, Bryan Drewery wrote:
> 
> Personally I agree on all points. Our ports security regime is not
> working. 

I already communicated further with Roger off-list, but would like to
point out that I *do* think there is a problem, but I don't think it's
"the sky is falling / don't use FreeBSD" yet. This is a solvable problem
that simply requires some defined processes and
participation/organization. 

It seems like we're talking to ourselves here, so do we need to hijack
the ports-secteam@ alias and start figuring things out ourselves?