Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4387 > unrolled thread

Re: [SECURITY] [DSA 3389-1] elasticsearch end-of-life

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3389-1] elasticsearch end-of-life Vincent Bernat <bernat@debian.org> - 2015-11-02 00:10 +0100
    Re: [SECURITY] [DSA 3389-1] elasticsearch end-of-life Rhonda D'Vine <rhonda@deb.at> - 2015-11-02 10:00 +0100
    Re: [SECURITY] [DSA 3389-1] elasticsearch end-of-life Moritz Mühlenhoff <jmm@inutil.org> - 2015-11-02 20:10 +0100
      Re: [SECURITY] [DSA 3389-1] elasticsearch end-of-life Ansgar Burchardt <ansgar@debian.org> - 2015-11-03 09:40 +0100
        Re: [SECURITY] [DSA 3389-1] elasticsearch end-of-life Moritz Mühlenhoff <jmm@inutil.org> - 2015-11-04 18:40 +0100
      Re: [SECURITY] [DSA 3389-1] elasticsearch end-of-life Vincent Bernat <bernat@debian.org> - 2015-11-04 00:00 +0100
        Re: [SECURITY] [DSA 3389-1] elasticsearch end-of-life Moritz Mühlenhoff <jmm@inutil.org> - 2015-11-04 18:40 +0100

#4387 — Re: [SECURITY] [DSA 3389-1] elasticsearch end-of-life

[Multipart message — attachments visible in raw view] — view raw

 ❦  1 novembre 2015 23:22 +0100, Moritz Muehlenhoff <jmm@debian.org> :

> Security support for elasticsearch in jessie is hereby discontinued. The
> project no longer releases information on fixed security issues which
> allow backporting them to released versions of Debian and actively
> discourages from doing so.
>
> elasticsearch will also be removed from Debian stretch (the next stable
> Debian release), but will continue to remain in unstable and available
> in jessie-backports.

There are many tradeoffs recently with projects that do not want to
provide a sensible security track for stable releases:

 - always package the latest release (Chromium)
 - always package the latest release of an upstream stable branch (MySQL)
 - always package the latest release through backports (without using testing)

I suppose that the first two options are to be negotiated with the
release team. Is the last option open to any package or does it need to
be negotiated with the FTP masters?
-- 
Make input easy to prepare and output self-explanatory.
            - The Elements of Programming Style (Kernighan & Plauger)

[toc] | [next] | [standalone]

#4390

* Vincent Bernat <bernat@debian.org> [2015-11-02 00:01:11 CET]:
>  ❦  1 novembre 2015 23:22 +0100, Moritz Muehlenhoff <jmm@debian.org> :
> > Security support for elasticsearch in jessie is hereby discontinued. The
> > project no longer releases information on fixed security issues which
> > allow backporting them to released versions of Debian and actively
> > discourages from doing so.
> >
> > elasticsearch will also be removed from Debian stretch (the next stable
> > Debian release), but will continue to remain in unstable and available
> > in jessie-backports.
> 
> There are many tradeoffs recently with projects that do not want to
> provide a sensible security track for stable releases:
> 
>  - always package the latest release (Chromium)
>  - always package the latest release of an upstream stable branch (MySQL)
>  - always package the latest release through backports (without using testing)
> 
> I suppose that the first two options are to be negotiated with the
> release team. Is the last option open to any package or does it need to
> be negotiated with the FTP masters?

 With my backports team hat on: The last option isn't really open, this
was a vast misunderstanding from the discussion that Moritz had with me
privately (instead of going through the backports team mail address).
I'm sorry that this left the impression that it is an option.


 In my personal opinion (i.e., without any hat on), a package that isn't
targeted for a stable release shouldn't even be uploaded to unstable.
Packages uploaded to unstable are meant to be targeted at the next
stable release and (again, personally) I consider this a bit of an abuse
to have it there "just for the sake of it".  We have the experimental
pocket for stuff that isn't targetted at the next stable release for
trying out things.[1]


 So long,
Rhonda
[1]  Yes, I'm very well aware that I'm argumenting here against myself
     with respect to wesnoth development releases; guess we'll follow
     that pattern in the future.
-- 
Fühlst du dich mutlos, fass endlich Mut, los      |
Fühlst du dich hilflos, geh raus und hilf, los    | Wir sind Helden
Fühlst du dich machtlos, geh raus und mach, los   | 23.55: Alles auf Anfang
Fühlst du dich haltlos, such Halt und lass los    |

[toc] | [prev] | [next] | [standalone]

#4392

Vincent Bernat <bernat@debian.org> wrote:
> There are many tradeoffs recently with projects that do not want to
> provide a sensible security track for stable releases:
>
>  - always package the latest release (Chromium)

For chromium and iceweasel the vast amount of security issues doesn't leave
much other options.

elasticsearch isn't that category, they simply have chosen to be secretive
from now on and I don't see why we should cater to uncooperative upstreams
with special handling.

Hopefully we'll have PPAs/bikesheds soon, that seems like a proper candidate
for cases like that.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#4397

Moritz Mühlenhoff <jmm@inutil.org> writes:
> Vincent Bernat <bernat@debian.org> wrote:
>> There are many tradeoffs recently with projects that do not want to
>> provide a sensible security track for stable releases:
>>
>>  - always package the latest release (Chromium)
>
> For chromium and iceweasel the vast amount of security issues doesn't leave
> much other options.
>
> elasticsearch isn't that category, they simply have chosen to be secretive
> from now on and I don't see why we should cater to uncooperative upstreams
> with special handling.
>
> Hopefully we'll have PPAs/bikesheds soon, that seems like a proper candidate
> for cases like that.

That's in the end just pretending the problem doesn't exist? What is the
practical difference for users between blindly[1] updating a package in
stable and moving it to a PPA?

I'm really not a fan of moving stuff out of the official release and
pushing users to use extra repositories :-/

Ansgar

  [1] As in no extra review by the release/security team as otherwise
      there is a difference in the amount of work needed.

[toc] | [prev] | [next] | [standalone]

#4401

Ansgar Burchardt <ansgar@debian.org> schrieb:
> That's in the end just pretending the problem doesn't exist?

No, from my PoV it's a clear separation between software following our
usual standards (what's in main) and the rest (what's going to
be in PPAs)

> I'm really not a fan of moving stuff out of the official release and
> pushing users to use extra repositories :-/

Complain to elasticsearch upstream, then :-)

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#4400

[Multipart message — attachments visible in raw view] — view raw

 ❦  2 novembre 2015 20:00 +0100, Moritz Mühlenhoff <jmm@inutil.org> :

>> There are many tradeoffs recently with projects that do not want to
>> provide a sensible security track for stable releases:
>>
>>  - always package the latest release (Chromium)
>
> For chromium and iceweasel the vast amount of security issues doesn't leave
> much other options.
>
> elasticsearch isn't that category, they simply have chosen to be secretive
> from now on and I don't see why we should cater to uncooperative upstreams
> with special handling.

So, it's a bit like MySQL and VirtualBox, isn't it? Except they don't
provide any stable branch.

Note that I understand the decision (and I support it). I was just
curious about the direction for the project.
-- 
The secret source of humor is not joy but sorrow; there is no humor in Heaven.
		-- Mark Twain

[toc] | [prev] | [next] | [standalone]

#4402

Vincent Bernat <bernat@debian.org> wrote:
> So, it's a bit like MySQL and VirtualBox, isn't it? Except they don't
> provide any stable branch.

More or less, yes.

Cheers,
        Moritz

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web