From owner-freebsd-ports@FreeBSD.ORG Sun Sep 4 20:37:27 2011 Return-Path: Delivered-To: ports@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 057B8106564A; Sun, 4 Sep 2011 20:37:27 +0000 (UTC) (envelope-from utisoft@gmail.com) Received: from mail-iy0-f182.google.com (mail-iy0-f182.google.com [209.85.210.182]) by mx1.freebsd.org (Postfix) with ESMTP id B9EB18FC1A; Sun, 4 Sep 2011 20:37:26 +0000 (UTC) Received: by iadx2 with SMTP id x2so7230987iad.13 for ; Sun, 04 Sep 2011 13:37:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; bh=0qLhNnDUDirL4Yy3wx6XmApL5NZULcbD4GZDTUQ/nPc=; b=dMewR5FNMVE0V516nj5ATFYfdTkK6Cm3YSWeXZcKDvuQqGFnjD/WmwYS3b4v2WfqgP hL4vMrgwxjC0aAxhncrkVeWmHd7mwOlGUaSMdm4LGOn/yrdAvgMIIxwU03kwd6kabQ7l qpVhymxMblpALTEMJDovtj9c/2VTfKIurO2Zw= Received: by 10.231.26.68 with SMTP id d4mr6296751ibc.66.1315168645119; Sun, 04 Sep 2011 13:37:25 -0700 (PDT) MIME-Version: 1.0 Received: by 10.231.61.148 with HTTP; Sun, 4 Sep 2011 13:36:55 -0700 (PDT) In-Reply-To: <201109042032.p84KWUIF073409@fire.js.berklix.net> References: <201109042032.p84KWUIF073409@fire.js.berklix.net> From: Chris Rees Date: Sun, 4 Sep 2011 21:36:55 +0100 Message-ID: To: "Julian H. Stacey" Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: ports@freebsd.org, yar@freebsd.org Subject: Re: sysutils/cfs X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Sep 2011 20:37:27 -0000 On 4 September 2011 21:32, Julian H. Stacey wrote: >> >> Whoops, also missed a CVE -- buffer overflows can cause a DoS. >> Expiration date altered to 1 month accordingly. > > It is not responsible to threaten to remove ports without warning > between releases for non urgent reasons. > > Better to deprecate such non urgent ports, & wait a while after next > release is rolled, to give release users a warning & some time > to volunteer (or if a firm using releases, perhaps time to allocate > a staff member if a port is important to them). Yeah... perhaps if there isn't a vulnerability. At the moment it's marked FORBIDDEN, so it's useless -- anyone who is serious about fixing it at whatever time is welcome to check it out of the Attic -- a slight inconvenience for which we apologise. In the mean time, the ports tree is not a museum for ancient insecure bug-ridden software. Chris --=20 Chris Rees =A0 =A0 =A0 =A0 =A0| FreeBSD Developer crees@FreeBSD.org =A0 | http://people.freebsd.org/~crees