Date: Mon, 5 Sep 2011 21:02:14 +0300 From: Kostik Belousov <kostikbel@gmail.com> To: Chris Rees <utisoft@gmail.com> Cc: ports@freebsd.org, "Mikhail T." <mi+thun@aldan.algebra.com>, yar@freebsd.org Subject: Re: Re: sysutils/cfs Message-ID: <20110905180214.GS17489@deviant.kiev.zoral.com.ua> In-Reply-To: <CADLo838bxRPmJS-qzRF9wzGseKr6CoxoXEWb0rmcYDfhK_ZLQg@mail.gmail.com> References: <CADLo838g=r3C4pHVteObPYrA6VxB7%2B4banaEXeVrPwGD7MDAtg@mail.gmail.com> <CADLo83_A%2BOh%2Bi4ZFQ=KnZyvBk0h2pf%2BbJnjhYHm=5UyacjE3cA@mail.gmail.com> <4E6503C2.5080002@aldan.algebra.com> <CADLo838bxRPmJS-qzRF9wzGseKr6CoxoXEWb0rmcYDfhK_ZLQg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--ivmgg8na18OWkKOs Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Sep 05, 2011 at 06:32:00PM +0100, Chris Rees wrote: > On 5 Sep 2011 18:15, "Mikhail T." <mi+thun@aldan.algebra.com> wrote: > > > > On -10.01.-28163 14:59, Chris Rees wrote: > >>> > >>> I've had to deprecate sysutils/cfs -- there's a confirmed issue with > >>> failing locks [1] which has been open for two years with no fix. > >>> > >> > >> Whoops, also missed a CVE -- buffer overflows can cause a DoS. > >> Expiration date altered to 1 month accordingly. > > > > > > Is this the only vulnerability you are talking about? > >> > >> http://www.debian.org/security/2006/dsa-1138 > > > > Does not seem hard to fix at all... Listing all of the fatal problems > would be helpful... > >> > >> -mi >=20 > If it's not that hard to fix then do it. If you're not going to fix it, w= hy > are you even commenting? >=20 > More noise. Stop whining and do something about it. No, it is not a noise. First, note that an issue in the local deamon can be only utilized by local users. As a consequence, there is a huge set of machines for which the cited issue is simply irrelevant. For the analogous issues that are irrelevant for 90% of the port users, look at the vulnerabilities listed for the quake ports. Second, I personally consider the crusade to remove old but compiling and working (*) ports as a damage both to the project functionality and to the project reputation. * Working exactly because users report bugs in the software, otherwise they would not be able to describe corner cases that break. >=20 > I saw a port that is: >=20 > - broken > - vulnerable > - unmaintained > - dead upstream > - has been removed by other distributions >=20 > I don't use it, you don't use it, why do you care? See above. This is the sort of rethoric that I find damaging. The only point that I buy from the list is 'had been removed by other distributions'. Everything else is relative, and since _you_ are not the user of the package, did not even tried to use it, and obviously not estimated the risks and brokeness of the package right (as shown by two episodes, once with the NLM, second with the vulnerability), I consider the removal as frivolous and damaging. It only continues the trend, I agree. --ivmgg8na18OWkKOs Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (FreeBSD) iEYEARECAAYFAk5lDqYACgkQC3+MBN1Mb4jxkgCfdeAxycAZh/QRZzfkgVoi3tdS w6oAoNeWrvA1dWEEmwCLRvFbEIJ00ECB =SJ0F -----END PGP SIGNATURE----- --ivmgg8na18OWkKOs--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110905180214.GS17489>