Path: csiph.com!aioe.org!bofh.it!news.nic.it!robomod
From: Diane Trout <diane@ghic.org>
Newsgroups: linux.debian.maint.python
Subject: Re: pycharm package in debian
Date: Wed, 04 Oct 2017 23:20:01 +0200
Message-ID: <uwZfb-39t-1@gated-at.bofh.it>
References: <uwZfb-39t-3@gated-at.bofh.it> <uvp45-44q-3@gated-at.bofh.it> <uvr5U-5m8-7@gated-at.bofh.it> <uvBoB-3Mo-7@gated-at.bofh.it> <uvGRk-7wg-5@gated-at.bofh.it> <uvH10-7A2-11@gated-at.bofh.it> <uvHaF-7E0-9@gated-at.bofh.it> <uvSfN-67y-33@gated-at.bofh.it> <uvUrf-7kL-1@gated-at.bofh.it> <uw4qC-52e-17@gated-at.bofh.it>
X-Original-To: debian-python@lists.debian.org
X-Mailbox-Line: From debian-python-request@lists.debian.org  Wed Oct  4 21:11:21 2017
Old-Return-Path: <diane@ghic.org>
X-Amavis-Spam-Status: No, score=-6.9 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FOURLA=0.1, LDO_WHITELIST=-5] autolearn=ham autolearn_force=no
X-Policyd-Weight: using cached result; rate: -6.1
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.26.0-1
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Mailing-List: <debian-python@lists.debian.org> archive/latest/15298
List-ID: <debian-python.lists.debian.org>
List-URL: <https://lists.debian.org/debian-python/>
List-Archive: https://lists.debian.org/msgid-search/1507151462.11084.16.camel@ghic.org
Approved: robomod@news.nic.it
Lines: 24
Organization: linux.* mail to news gateway
Sender: robomod@news.nic.it
X-Original-Date: Wed, 04 Oct 2017 14:11:02 -0700
X-Original-Message-ID: <1507151462.11084.16.camel@ghic.org>
X-Original-References:  <CABpbYad0e+JPyoU5F2GF5MoVLF+--BwCCahMS-2TKeJJXZ-M-A@mail.gmail.com> <5804be2d-67fa-b7d3-1332-8b362f892b5e@laposte.net> <CAKTje6Gin0iiy1aVOhQwpm_nQ6aW=V7V6ecbgfMwCzDXnurWag@mail.gmail.com> <69cec3b4-0c04-9c9b-961b-a0a65b2d3cb5@gmail.com> <CAKTje6EN1tevPSdgSRcRuB_TevXN2BrV266AM=ei2+Yet=aFaA@mail.gmail.com> <17971bbc-8896-0b60-2d7a-169929a5cb35@gmail.com> <d604a2a6-39f4-30a2-6893-77867df75e05@debian.org> <147e2f97-5453-dadd-79f3-78988b44d478@debian.org> <2bd37ee9-c5af-4aef-3541-7f6a485d6706@debian.org>
Xref: csiph.com linux.debian.maint.python:9916


> > who says that a "lagging behind" package doesn't have any security
> > issues? If
> > the package is lagging behind, how do you know that security
> > updates aren't
> > lagging behind either...
> 
> As this is Debian, I do expect that at least, I can read the security
> tracker to see the current status. For a snap package, I wouldn't
> know
> how to audit it.

I do wish that these third party app systems like conda, snappy or
flatpak would include metadata like AppStream or DOAP.

It would be really convenient to have one tool that could audit a
system for out of date packages, and for our bug reporting tools to be
able to direct users to the responsible party for a third party
installation.

I can see that GNOME software has some visibility into what valve's
steam is doing so it's at least theoretically possible.

Diane