Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4704

Re: [SECURITY] [DSA 3547-1] imagemagick security update

Show all headers | View raw

On Tue, Apr 12, 2016, at 16:47, Peter Palfrader wrote:
> On Tue, 12 Apr 2016, Henrique de Moraes Holschuh wrote:
> 
> > We list several mirrors carrying debian security updates in
> > https://www.debian.org/mirror/list-full
> 
> I think we shouldn't.

Well, we do, regardless of whether we should or shouldn't.

And, unless we add an alternate-security.d.o or do something else to
offer a backup access for those that get a single choice out of geoip,
it is probably best to not hide that information IMO.

> > We don't disclose which mirrors are members of the security.debian.org
> 
> https://anonscm.debian.org/cgit/mirror/dsa-auto-dns.git/tree/zones/security.debian.org.zone
> 
> is the file that the security.d.o zone is generated from.

Thanks. That helps.

> > Alternate access URIs for several of the security.debian.org pool
> > members *do* exist, but that information seems not to be clearly
> > displayed anywhere.
> 
> They do?  Anything we actually tell people to use?

Yes, they do. And no, we don't tell people to use them.

It is not any sort of a secret, but since you guys don't want people who
doesn't know better pointing apt to them, I am not naming them here.

> > A good starting point would be to provide a list of official security
> > mirrors (potential members of the security.debian.org pool) that can be
> > accessed directly when geo-ip is directing an user to a pool member that
> > is stale.
> 
> No.  We derotate mirrors regularly for maintenance work.  We don't want
> users to pick their security.d.o mirror.

Then, maybe we should consider a better way to deal with areas where you
get only one choice out of geoip?

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique de Moraes Holschuh <hmh@debian.org>

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-12 13:40 +0200
  Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-12 14:00 +0200
    Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-13 07:40 +0200
      Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-13 07:50 +0200
        Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-13 08:20 +0200
  Re: [SECURITY] [DSA 3547-1] imagemagick security update Luciano Bello <luciano@debian.org> - 2016-04-12 14:20 +0200
    Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-12 17:10 +0200
      Re: [SECURITY] [DSA 3547-1] imagemagick security update Drake Wilson <drake@dasyatidae.net> - 2016-04-12 17:40 +0200
      Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-12 17:40 +0200
        Re: [SECURITY] [DSA 3547-1] imagemagick security update "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-04-12 19:10 +0200
          Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-12 19:40 +0200
            Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-12 21:20 +0200
              Re: [SECURITY] [DSA 3547-1] imagemagick security update Michael Stone <mstone@debian.org> - 2016-04-12 21:40 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 01:30 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Julien Cristau <jcristau@debian.org> - 2016-04-13 11:00 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 14:50 +0200
              Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-12 21:50 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 02:00 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Michael Stone <mstone@debian.org> - 2016-04-13 04:20 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-13 07:40 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 15:00 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-14 11:10 +0200
          Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-12 19:40 +0200
          Re: [SECURITY] [DSA 3547-1] imagemagick security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-04-13 08:10 +0200
            Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-13 09:00 +0200
              Re: [SECURITY] [DSA 3547-1] imagemagick security update Alexander Neilson <alexander@neilson.net.nz> - 2016-04-13 12:30 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-14 11:20 +0200
              Re: [SECURITY] [DSA 3547-1] imagemagick security update Henrique de Moraes Holschuh <hmh@debian.org> - 2016-04-13 14:50 +0200
              Re: [SECURITY] [DSA 3547-1] imagemagick security update Scott Blaydes <scott@nettek.io> - 2016-04-13 15:10 +0200
                Re: [SECURITY] [DSA 3547-1] imagemagick security update Peter Palfrader <weasel@debian.org> - 2016-04-14 11:20 +0200

csiph-web