From owner-freebsd-ports@FreeBSD.ORG Tue Aug 30 18:55:26 2011 Return-Path: Delivered-To: freebsd-ports@FreeBSD.org Received: from mx2.freebsd.org (mx2.freebsd.org [IPv6:2001:4f8:fff6::35]) by hub.freebsd.org (Postfix) with ESMTP id DA4E1106566B for ; Tue, 30 Aug 2011 18:55:26 +0000 (UTC) (envelope-from dougb@FreeBSD.org) Received: from 172-17-198-245.globalsuite.net (hub.freebsd.org [IPv6:2001:4f8:fff6::36]) by mx2.freebsd.org (Postfix) with ESMTP id 56CD814FEA9 for ; Tue, 30 Aug 2011 18:55:26 +0000 (UTC) Message-ID: <4E5D321D.9020209@FreeBSD.org> Date: Tue, 30 Aug 2011 11:55:25 -0700 From: Doug Barton Organization: http://SupersetSolutions.com/ User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:6.0) Gecko/20110824 Thunderbird/6.0 MIME-Version: 1.0 To: "freebsd-ports@FreeBSD.org" References: <4E5C79AF.6000408@FreeBSD.org> <20110830152920.GB69850@guilt.hydra> In-Reply-To: <20110830152920.GB69850@guilt.hydra> X-Enigmail-Version: undefined OpenPGP: id=1A1ABC84 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: Subject: Re: Why do we not mark vulnerable ports DEPRECATED? X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Aug 2011 18:55:26 -0000 On 08/30/2011 08:29, Chad Perrin wrote: > On Mon, Aug 29, 2011 at 10:48:31PM -0700, Doug Barton wrote: >> I'm doing some updates and came across mail/postfix-policyd-spf which >> relies on mail/libspf2-10. The latter had a vuxml entry added on >> 2008-10-27. So my question is, why has mail/libspf2-10 been allowed to >> remain in the tree vulnerable for almost 3 years? >> >> Wouldn't it make more sense to mark vulnerable ports DEPRECATED >> immediately with a short expiration? When they get fixed they get >> un-deprecated. If they don't, they get removed. Can someone explain why >> this would be a bad idea? > > Might that not interfere with the process of getting a new maintainer for > a popular port when its previous maintainer has been lax (or hit by a > bus)? Sorry if I'm being dense, but I'm not seeing the connection. Can you elaborate? Doug -- Nothin' ever doesn't change, but nothin' changes much. -- OK Go Breadth of IT experience, and depth of knowledge in the DNS. Yours for the right price. :) http://SupersetSolutions.com/