Date: Tue, 06 Sep 2011 14:53:12 +1000 From: Yar Tikhiy <yar.tikhiy@gmail.com> To: Kostik Belousov <kostikbel@gmail.com> Cc: ports@freebsd.org, "Mikhail T." <mi+thun@aldan.algebra.com>, Chris Rees <utisoft@gmail.com> Subject: Re: sysutils/cfs Message-ID: <4E65A738.7080903@gmail.com> In-Reply-To: <20110905180214.GS17489@deviant.kiev.zoral.com.ua> References: <CADLo838g=r3C4pHVteObPYrA6VxB7%2B4banaEXeVrPwGD7MDAtg@mail.gmail.com> <CADLo83_A%2BOh%2Bi4ZFQ=KnZyvBk0h2pf%2BbJnjhYHm=5UyacjE3cA@mail.gmail.com> <4E6503C2.5080002@aldan.algebra.com> <CADLo838bxRPmJS-qzRF9wzGseKr6CoxoXEWb0rmcYDfhK_ZLQg@mail.gmail.com> <20110905180214.GS17489@deviant.kiev.zoral.com.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi, On 9/6/11 4:02 AM, Kostik Belousov wrote: > On Mon, Sep 05, 2011 at 06:32:00PM +0100, Chris Rees wrote: >> On 5 Sep 2011 18:15, "Mikhail T."<mi+thun@aldan.algebra.com> wrote: >>> >>> On -10.01.-28163 14:59, Chris Rees wrote: >>>>> >>>>> I've had to deprecate sysutils/cfs -- there's a confirmed issue with >>>>> failing locks [1] which has been open for two years with no fix. >>>>> >>>> >>>> Whoops, also missed a CVE -- buffer overflows can cause a DoS. >>>> Expiration date altered to 1 month accordingly. >>> >>> >>> Is this the only vulnerability you are talking about? >>>> >>>> http://www.debian.org/security/2006/dsa-1138 >>> >>> Does not seem hard to fix at all... Listing all of the fatal problems >> would be helpful... >>>> >>>> -mi >> >> If it's not that hard to fix then do it. If you're not going to fix it, why >> are you even commenting? >> >> More noise. Stop whining and do something about it. > > No, it is not a noise. > > First, note that an issue in the local deamon can be only utilized by > local users. As a consequence, there is a huge set of machines for which > the cited issue is simply irrelevant. > > For the analogous issues that are irrelevant for 90% of the port users, > look at the vulnerabilities listed for the quake ports. By the way, the Debian folks invested certain effort in keeping cfs up to date. Their git repo is still available at http://smarden.org/git/cfs.git/ . In particular, the DoS fix can be easily obtained from the repo and placed under files/ in the port. > Second, I personally consider the crusade to remove old but compiling > and working (*) ports as a damage both to the project functionality and > to the project reputation. > > * Working exactly because users report bugs in the software, otherwise > they would not be able to describe corner cases that break. This is true: cfs is still in use out there. E.g., I know a company still relying on cfs. They don't seem to care about ports/137378. I'd be glad to suggest they move on to something newer and better supported but I'm aware of no other open-source file encryption framework that is a) transparent at filesystem level and at the same time b) can support multiple security domains without requiring as many mount points. As soon as there is an alternative available, the cfs port can be safely retired, but trashing it prematurely would be unwise. Cheers, Yar
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4E65A738.7080903>