4 ms·

Suppose for a minute that it is legitimately impossible to have a secure screensaver older than 6 months. Like, we live in a universe where either we can have

Suppose for a minute that it is legitimately impossible to have a secure screensaver older than 6 months. Like, we live in a universe where either we can have secure screensavers, or we can have Debian stable, but not both. What we have in this situation is an engineer–as far as I can tell, an engineer on the short list of "world experts in lockscreen security"–who earnestly believes that our universe operates in exactly this way. What is a reasonable thing to do–short of warning end users, which apparently is immature in your mind–to prevent what he believes, as a subject matter expert, to be a major and ongoing security vulnerability waiting to happen? Should he have released under a non-DFSG license so as to prevent Debian from packaging the software at all? Or should he have politely written to the Debian maintainer asking for its removal from Debian? Should he have gotten into the Debian politics and lobbied for the "special exceptions" that iceweasel etc. enjoy to get frequent updates? Should he have taken it upon himself to backport security fixes to Debian, RHEL, etc? I sympathize with the OS package maintainers, but I sympathize more with someone who found himself trapped between his commitment to software freedom and his commitment to keeping his users secure.

vacri 11y ago
> found himself trapped between his commitment to software freedom and his commitment to keeping his users secure. It's more about the spam for already-fixed features than the love of keeping users secure. jwz also isn't exactly fair in his characterisations in the article. Things like "taking advantage of a creator's work, ignoring their wishes, and giving nothing back in return." when the explicit problem is that they're giving back, just not in the right manner. That's just the way jwz rolls, though... It would be wrong for debian to remove the warning, though, since it's there specifically for debian users; they're not 'collateral damage' from an unrelated change or similar.
- drewcrawford 11y ago
  > It's more about the spam for already-fixed features than the love of keeping users secure. I realize this is the reason presented in the comment, but after I dug into his statements elsewhere, I developed a different picture. Anyway, there's no law that says a comment must present every argument why the code exists. To step back a minute, I seem to be seeing the same facts very differently. Where some see an immature attempt to annoy users, I see a demonstration that Debian is unable to spot a bug when it has a 50-line comment above it complaining that Debian doesn't fix bugs. To me, the very existence of this situation itself is a powerful argument against Debian stable as a working concept. Most of the time a bug is introduced it does not announce itself with a preamble. How the hell did this make it all the way to stable?
  - vacri 11y ago
    > I see a demonstration that Debian is unable to spot a bug when it has a 50-line comment above it That's also an unfair characterisation, especially since the original report starts out recognising that exact comment. Debian stable is there for a reason - not everyone is in a position where they can have the latest'n'greatest rolling distro. Security is not the only thing that's of interest to users; stability is of interest as well. I see people using rolling distros that get caught up by this bug or that bug, and they can fix it because they're technically-minded, but not everyone can do that. This xscreensaver issue is an edge case that gets caught in the cracks. I'm sure jwz is also well aware of why debian stable does what it does, but as the recipient of the bugspam, he can probably be forgiven for being less than charitable about deb-stable.
    - drewcrawford 11y ago
      > That's also an unfair characterisation What specifically is unfair about it? Is it false? > especially since the original report starts out recognising that exact comment. I must be missing the part where a postmortem of this feature getting into stable was conducted and lessons were learned. Can you link me? > Debian stable is there for a reason - not everyone is in a position where they can have the latest'n'greatest rolling distro. Yeah, and that's why I run Debian stable. But in light of a visible lapse I'm concerned about invisible ones lurking on my systems.
      - vacri 11y ago
        Suddenly "unable to spot a bug" has transmogrified into requiring a post-mortem and lessons for the future learned? That's some pretty hefty goalpost moving.
  - ashitlerferad 11y ago
    Are there any distributions that audit all source code incoming from either maintainers or upstreams? Are there many software projects that have full peer review of every single commit? Are there many software projects that have more than one developer?

vacri 11y ago

> found himself trapped between his commitment to software freedom and his commitment to keeping his users secure. It's more about the spam for already-fixed features than the love of keeping users secure. jwz also isn't exactly fair in his characterisations in the article. Things like "taking advantage of a creator's work, ignoring their wishes, and giving nothing back in return." when the explicit problem is that they're giving back, just not in the right manner. That's just the way jwz rolls, though... It would be wrong for debian to remove the warning, though, since it's there specifically for debian users; they're not 'collateral damage' from an unrelated change or similar.

drewcrawford 11y ago
> It's more about the spam for already-fixed features than the love of keeping users secure. I realize this is the reason presented in the comment, but after I dug into his statements elsewhere, I developed a different picture. Anyway, there's no law that says a comment must present every argument why the code exists. To step back a minute, I seem to be seeing the same facts very differently. Where some see an immature attempt to annoy users, I see a demonstration that Debian is unable to spot a bug when it has a 50-line comment above it complaining that Debian doesn't fix bugs. To me, the very existence of this situation itself is a powerful argument against Debian stable as a working concept. Most of the time a bug is introduced it does not announce itself with a preamble. How the hell did this make it all the way to stable?
- vacri 11y ago
  > I see a demonstration that Debian is unable to spot a bug when it has a 50-line comment above it That's also an unfair characterisation, especially since the original report starts out recognising that exact comment. Debian stable is there for a reason - not everyone is in a position where they can have the latest'n'greatest rolling distro. Security is not the only thing that's of interest to users; stability is of interest as well. I see people using rolling distros that get caught up by this bug or that bug, and they can fix it because they're technically-minded, but not everyone can do that. This xscreensaver issue is an edge case that gets caught in the cracks. I'm sure jwz is also well aware of why debian stable does what it does, but as the recipient of the bugspam, he can probably be forgiven for being less than charitable about deb-stable.
  - drewcrawford 11y ago
    > That's also an unfair characterisation What specifically is unfair about it? Is it false? > especially since the original report starts out recognising that exact comment. I must be missing the part where a postmortem of this feature getting into stable was conducted and lessons were learned. Can you link me? > Debian stable is there for a reason - not everyone is in a position where they can have the latest'n'greatest rolling distro. Yeah, and that's why I run Debian stable. But in light of a visible lapse I'm concerned about invisible ones lurking on my systems.
    - vacri 11y ago
      Suddenly "unable to spot a bug" has transmogrified into requiring a post-mortem and lessons for the future learned? That's some pretty hefty goalpost moving.
- ashitlerferad 11y ago
  Are there any distributions that audit all source code incoming from either maintainers or upstreams? Are there many software projects that have full peer review of every single commit? Are there many software projects that have more than one developer?