From owner-freebsd-ports@FreeBSD.ORG Tue Aug 30 05:48:33 2011 Return-Path: Delivered-To: freebsd-ports@FreeBSD.org Received: from mx2.freebsd.org (mx2.freebsd.org [IPv6:2001:4f8:fff6::35]) by hub.freebsd.org (Postfix) with ESMTP id BBB861065674; Tue, 30 Aug 2011 05:48:33 +0000 (UTC) (envelope-from dougb@FreeBSD.org) Received: from 172-17-198-245.globalsuite.net (hub.freebsd.org [IPv6:2001:4f8:fff6::36]) by mx2.freebsd.org (Postfix) with ESMTP id B0E6B152931; Tue, 30 Aug 2011 05:48:32 +0000 (UTC) Message-ID: <4E5C79AF.6000408@FreeBSD.org> Date: Mon, 29 Aug 2011 22:48:31 -0700 From: Doug Barton Organization: http://SupersetSolutions.com/ User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:6.0) Gecko/20110824 Thunderbird/6.0 MIME-Version: 1.0 To: "freebsd-ports@FreeBSD.org" , secteam@FreeBSD.org X-Enigmail-Version: undefined OpenPGP: id=1A1ABC84 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: Subject: Why do we not mark vulnerable ports DEPRECATED? X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Aug 2011 05:48:33 -0000 I'm doing some updates and came across mail/postfix-policyd-spf which relies on mail/libspf2-10. The latter had a vuxml entry added on 2008-10-27. So my question is, why has mail/libspf2-10 been allowed to remain in the tree vulnerable for almost 3 years? Wouldn't it make more sense to mark vulnerable ports DEPRECATED immediately with a short expiration? When they get fixed they get un-deprecated. If they don't, they get removed. Can someone explain why this would be a bad idea? Doug -- Nothin' ever doesn't change, but nothin' changes much. -- OK Go Breadth of IT experience, and depth of knowledge in the DNS. Yours for the right price. :) http://SupersetSolutions.com/