Handling of "malware" in Debian

From	"W. Martin Borgert" <debacle@debian.org>
Newsgroups	linux.debian.security
Subject	Handling of "malware" in Debian
Date	2016-11-09 16:00 +0100
Message-ID	<sBCw1-el-3@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi,

because of the WOT[*] incident, I wonder how Debian should handle
malware packages in favour of our users.

The current scheme is to remove the offending package from stable and
go along. With unattended-upgrades or other automatic upgrade schemes,
such packages would remain on many systems and potentially harm users.

I suggest to handle such cases differently by uploading a new, empty
package (like transitional packages, but without new depends).

What do you think?

Cheers

[*] https://bugs.debian.org/842939

Back to linux.debian.security | Previous | Next | Find similar | Unroll thread

Thread

Handling of "malware" in Debian "W. Martin Borgert" <debacle@debian.org> - 2016-11-09 16:00 +0100

csiph-web