From owner-freebsd-security Mon Mar 20 23: 0:57 2000 Delivered-To: freebsd-security@freebsd.org Received: from mail.rpi.edu (mail.rpi.edu [128.113.100.7]) by hub.freebsd.org (Postfix) with ESMTP id 96FCA37BD1F for ; Mon, 20 Mar 2000 22:59:20 -0800 (PST) (envelope-from drosih@rpi.edu) Received: from [128.113.24.47] (gilead.acs.rpi.edu [128.113.24.47]) by mail.rpi.edu (8.9.3/8.9.3) with ESMTP id BAA216502; Tue, 21 Mar 2000 01:58:52 -0500 Mime-Version: 1.0 X-Sender: drosih@mail.rpi.edu Message-Id: In-Reply-To: <4195.953229554@zippy.cdrom.com> References: <4195.953229554@zippy.cdrom.com> Date: Tue, 21 Mar 2000 01:59:38 -0500 To: "Jordan K. Hubbard" From: Garance A Drosihn Subject: Re: FreeBSD Security Advisory: FreeBSD-SA-00:08.lynx Cc: Sheldon Hearn , kjm@rins.ryukoku.ac.jp (KOJIMA Hajime), freebsd-security@FreeBSD.ORG Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 9:59 AM -0800 3/16/00, Jordan K. Hubbard wrote: > > assorted people wrote: > > > > But, /stand/sysinstall still use lynx as default text > > > > browser. If you want to read HTML documents in sysinstall, > > > > /stand/sysinstall will go to install lynx package > > > > automatically (and it will fail in 4.0-RELEASE). > > > > > >I don't think this is a problem, since any host from which it is > > >likely to read documentation is quite unlikely to be malicious. > > > > I would think it's a problem if sysinstall expects to use lynx, > > it thus goes to install lynx, and that installation *FAILS*. If > > I'm reading that right, you're then left with sysinstall trying > > to use a package that does not exist. > >The installation does not fail if lynx is missing. Well, I just did a 4.0 install and this was not a problem, but then I didn't try to read any html pages during the sysinstall... I didn't mean the install of 4.0-release would fail, but if sysinstall defaults to lynx, and lynx can not be installed, then, uh, it seems to me that should cause a problem somewhere. I lost track of who said what above, but someone said that sysinstall will try to install lynx if the user tries to read html documents. It was *that* installation, of lynx, that I was referring to as failing. Note that I'm not saying lynx should be brought back, I'm just thinking that the default browser for sysinstall should probably be a package which WILL be available if someone goes to use it. (or is it that lynx IS available on the install CD?) --- Garance Alistair Drosehn = gad@eclipse.acs.rpi.edu Senior Systems Programmer or drosih@rpi.edu Rensselaer Polytechnic Institute To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message