Re: Handling of "malware" in Debian

From	"W. Martin Borgert" <debacle@debian.org>
Newsgroups	linux.debian.security
Subject	Re: Handling of "malware" in Debian
Date	2016-11-09 19:20 +0100
Message-ID	<sBFDA-2qo-21@gated-at.bofh.it> (permalink)
References	(1 earlier) <sBCw2-el-15@gated-at.bofh.it> <sBCPn-Bf-19@gated-at.bofh.it> <sBDBL-18k-21@gated-at.bofh.it> <sBE4N-1kU-11@gated-at.bofh.it> <sBEet-1on-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Quoting Holger Levsen <holger@layer-acht.org>:
> On Wed, Nov 09, 2016 at 05:35:20PM +0100, W. Martin Borgert wrote:
>> Quoting Holger Levsen <holger@layer-acht.org>:
>> >I think so. And I also think this should be done.
>> >and, who's gonna file the RM bug for unstable?
>> I would RM for buster, because users of stretch might already be affected.
>
> thats not how it works. You file an RM bug for a package in unstable
> against ftp.d.o now, and then this RM will propagate to stretch. A RM
> for stable needs to be requested via about against release.do.

If users of testing or unstable have the malware installed now and
the package gets removed from the archive, users are left with the
malware, right?

That's why I thought about uploading an empty package to unstable,
it should be released with stretch, but can be safely removed later.

(Same for stable, only that for testing it is even more urgent,
because I believe that the malware function has been introduced
after releasing jessie.)

Thread

Re: Handling of "malware" in Debian Paul Wise <pabs@debian.org> - 2016-11-09 16:00 +0100
  Re: Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 16:20 +0100
    Re: Handling of "malware" in Debian Holger Levsen <holger@layer-acht.org> - 2016-11-09 17:10 +0100
      Re: Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 17:40 +0100
        Re: Handling of "malware" in Debian Holger Levsen <holger@layer-acht.org> - 2016-11-09 17:50 +0100
          Re: Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 19:20 +0100
            Re: Handling of "malware" in Debian Holger Levsen <holger@layer-acht.org> - 2016-11-09 19:50 +0100
              Re: Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 20:40 +0100
      Re: [Pkg-mozext-maintainers] Handling of "malware" in Debian Ximin Luo <infinity0@debian.org> - 2016-11-09 21:10 +0100
        Re: [Pkg-mozext-maintainers] Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 21:20 +0100
          Re: [Pkg-mozext-maintainers] Handling of "malware" in Debian Ximin Luo <infinity0@debian.org> - 2016-11-10 00:10 +0100
    Re: Handling of "malware" in Debian Paul Wise <pabs@debian.org> - 2016-11-10 02:50 +0100
      Re: Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-10 11:20 +0100
  Re: Handling of "malware" in Debian Vladislav Kurz <vladislav.kurz@webstep.net> - 2016-11-09 16:30 +0100

csiph-web