Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5088 > unrolled thread

Re: Handling of "malware" in Debian

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Handling of "malware" in Debian Paul Wise <pabs@debian.org> - 2016-11-09 16:00 +0100
    Re: Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 16:20 +0100
      Re: Handling of "malware" in Debian Holger Levsen <holger@layer-acht.org> - 2016-11-09 17:10 +0100
        Re: Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 17:40 +0100
          Re: Handling of "malware" in Debian Holger Levsen <holger@layer-acht.org> - 2016-11-09 17:50 +0100
            Re: Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 19:20 +0100
              Re: Handling of "malware" in Debian Holger Levsen <holger@layer-acht.org> - 2016-11-09 19:50 +0100
                Re: Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 20:40 +0100
        Re: [Pkg-mozext-maintainers] Handling of "malware" in Debian Ximin Luo <infinity0@debian.org> - 2016-11-09 21:10 +0100
          Re: [Pkg-mozext-maintainers] Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 21:20 +0100
            Re: [Pkg-mozext-maintainers] Handling of "malware" in Debian Ximin Luo <infinity0@debian.org> - 2016-11-10 00:10 +0100
      Re: Handling of "malware" in Debian Paul Wise <pabs@debian.org> - 2016-11-10 02:50 +0100
        Re: Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-10 11:20 +0100
    Re: Handling of "malware" in Debian Vladislav Kurz <vladislav.kurz@webstep.net> - 2016-11-09 16:30 +0100

#5088 — Re: Handling of "malware" in Debian

On Wed, Nov 9, 2016 at 10:54 PM, W. Martin Borgert wrote:

> What do you think?

A new empty package would be better than just removing it but the user
would not get any notification about why the functionality is gone nor
any information about the privacy violations they were subject to.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [next] | [standalone]

#5090

Quoting Paul Wise <pabs@debian.org>:
> A new empty package would be better than just removing it but the user
> would not get any notification about why the functionality is gone nor
> any information about the privacy violations they were subject to.

Would NEWS.Debian be sufficient?

[toc] | [prev] | [next] | [standalone]

#5092

[Multipart message — attachments visible in raw view] — view raw

On Wed, Nov 09, 2016 at 04:17:58PM +0100, W. Martin Borgert wrote:
> Would NEWS.Debian be sufficient?

I think so. And I also think this should be done.

and, who's gonna file the RM bug for unstable?


-- 
cheers,
	Holger

[toc] | [prev] | [next] | [standalone]

#5093

Quoting Holger Levsen <holger@layer-acht.org>:
> I think so. And I also think this should be done.
>
> and, who's gonna file the RM bug for unstable?

I would RM for buster, because users of stretch might already be affected.

[toc] | [prev] | [next] | [standalone]

#5094

[Multipart message — attachments visible in raw view] — view raw

On Wed, Nov 09, 2016 at 05:35:20PM +0100, W. Martin Borgert wrote:
> Quoting Holger Levsen <holger@layer-acht.org>:
> >I think so. And I also think this should be done.
> >and, who's gonna file the RM bug for unstable?
> I would RM for buster, because users of stretch might already be affected.

thats not how it works. You file an RM bug for a package in unstable
against ftp.d.o now, and then this RM will propagate to stretch. A RM
for stable needs to be requested via about against release.do.

buster on the other hand doesn't exist until we have released stretch.


-- 
cheers,
	Holger

[toc] | [prev] | [next] | [standalone]

#5095

Quoting Holger Levsen <holger@layer-acht.org>:
> On Wed, Nov 09, 2016 at 05:35:20PM +0100, W. Martin Borgert wrote:
>> Quoting Holger Levsen <holger@layer-acht.org>:
>> >I think so. And I also think this should be done.
>> >and, who's gonna file the RM bug for unstable?
>> I would RM for buster, because users of stretch might already be affected.
>
> thats not how it works. You file an RM bug for a package in unstable
> against ftp.d.o now, and then this RM will propagate to stretch. A RM
> for stable needs to be requested via about against release.do.

If users of testing or unstable have the malware installed now and
the package gets removed from the archive, users are left with the
malware, right?

That's why I thought about uploading an empty package to unstable,
it should be released with stretch, but can be safely removed later.

(Same for stable, only that for testing it is even more urgent,
because I believe that the malware function has been introduced
after releasing jessie.)

[toc] | [prev] | [next] | [standalone]

#5096

[Multipart message — attachments visible in raw view] — view raw

On Wed, Nov 09, 2016 at 07:14:45PM +0100, W. Martin Borgert wrote:
> If users of testing or unstable have the malware installed now and
> the package gets removed from the archive, users are left with the
> malware, right?

yes
 
> That's why I thought about uploading an empty package to unstable,

yes, of course.

> it should be released with stretch, but can be safely removed later.

i'm not sure about the releasing with stretch part. Maybe it would be
better to have the updated, empty package in stretch in 5plusX days and
then remove it before the release, say on January 1st.


-- 
cheers,
	Holger

[toc] | [prev] | [next] | [standalone]

#5097

Quoting Holger Levsen <holger@layer-acht.org>:
> i'm not sure about the releasing with stretch part. Maybe it would be
> better to have the updated, empty package in stretch in 5plusX days and
> then remove it before the release, say on January 1st.

Ah, OK. Understood. Well, maybe As Short As Possible before the release,
during DC17 :~)

[toc] | [prev] | [next] | [standalone]

#5098 — Re: [Pkg-mozext-maintainers] Handling of "malware" in Debian

Holger Levsen:
> On Wed, Nov 09, 2016 at 04:17:58PM +0100, W. Martin Borgert wrote:
>> Would NEWS.Debian be sufficient?
> 
> I think so. And I also think this should be done.
> 
> and, who's gonna file the RM bug for unstable?
> 

Context for the new list you added, please?


-- 
GPG: ed25519/56034877E1F87C35
GPG: rsa4096/1318EFAC5FBBDBCE
https://github.com/infinity0/pubkeys.git

[toc] | [prev] | [next] | [standalone]

#5099 — Re: [Pkg-mozext-maintainers] Handling of "malware" in Debian

On 2016-11-09 19:34, Ximin Luo wrote:
> Context for the new list you added, please?

#842939

Is it OK, if I do the upload? I'm in the team, but David Prévot
did previous uploads.

Cheers

[toc] | [prev] | [next] | [standalone]

#5100 — Re: [Pkg-mozext-maintainers] Handling of "malware" in Debian

W. Martin Borgert:
> On 2016-11-09 19:34, Ximin Luo wrote:
>> Context for the new list you added, please?
> 
> #842939
> 
> Is it OK, if I do the upload? I'm in the team, but David Prévot
> did previous uploads.
> 

Yes, go ahead and do the upload, it's what team maintenance is for :) You can `dch --team` or add "* Team upload." as the first entry so lintian doesn't complain.

X

-- 
GPG: ed25519/56034877E1F87C35
GPG: rsa4096/1318EFAC5FBBDBCE
https://github.com/infinity0/pubkeys.git

[toc] | [prev] | [next] | [standalone]

#5101

[Multipart message — attachments visible in raw view] — view raw

On Wed, 2016-11-09 at 16:17 +0100, W. Martin Borgert wrote:

> Would NEWS.Debian be sufficient?

My intuition says that there are users who don't have apt-listchanges
installed or don't read the NEWS files. The most likely place folks
will see the notification is in the UI of the malware package itself.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#5108

On 2016-11-10 09:45, Paul Wise wrote:
> My intuition says that there are users who don't have apt-listchanges
> installed or don't read the NEWS files. The most likely place folks
> will see the notification is in the UI of the malware package itself.

This is true. OTOH, if the WOT UI is gone, users will either not
care (good) or ask themselves where it is gone and can still
check the package (good, too). It's not, that the user or root
would have to perform any action.

[toc] | [prev] | [next] | [standalone]

#5091

On 11/09/16 15:59, Paul Wise wrote:
> On Wed, Nov 9, 2016 at 10:54 PM, W. Martin Borgert wrote:
> 
>> What do you think?
> 
> A new empty package would be better than just removing it but the user
> would not get any notification about why the functionality is gone nor
> any information about the privacy violations they were subject to.
> 
User info could be provided in NEWS.Debian - to be shown via
apt-listchanges. Which I hope is mailed if someone uses unattended upgrades.

-- 
Best regards
        Vladislav Kurz

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web