Groups > linux.debian.security > #5089 > unrolled thread

Handling of "malware" in Debian

Started by	"W. Martin Borgert" <debacle@debian.org>
First post	2016-11-09 16:00 +0100
Last post	2016-11-09 16:00 +0100
Articles	1 — 1 participant

Back to article view | Back to linux.debian.security

  Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 16:00 +0100

#5089 — Handling of "malware" in Debian

From	"W. Martin Borgert" <debacle@debian.org>
Date	2016-11-09 16:00 +0100
Subject	Handling of "malware" in Debian
Message-ID	<sBCw1-el-3@gated-at.bofh.it>

Hi,

because of the WOT[*] incident, I wonder how Debian should handle
malware packages in favour of our users.

The current scheme is to remove the offending package from stable and
go along. With unattended-upgrades or other automatic upgrade schemes,
such packages would remain on many systems and potentially harm users.

I suggest to handle such cases differently by uploading a new, empty
package (like transitional packages, but without new depends).

What do you think?

Cheers

[*] https://bugs.debian.org/842939

[toc] | [standalone]

csiph-web

Handling of "malware" in Debian

Contents

#5089 — Handling of "malware" in Debian