3 ms·

I am confused about your question. Can you elaborate? Distros usually provide patches for known security holes in their repos. Why would one not hold them respo

I am confused about your question. Can you elaborate? Distros usually provide patches for known security holes in their repos. Why would one not hold them responsible to do so?

edoceo 5y ago
How could Debian be the security gate for literally 1000s of packages? Chromium is a huge beast of code, should Debian maintainers be debugging and coding patches to various packages? I think we can't expect the distro to fix the security issues in everything. It's upstream responsibility to handle their own CVE.
- JonathanBeuys 5y ago
  Upstream has done that already. Google patched those bugs months ago.
  - edoceo 5y ago
    Are we helping Debian get those processed into Bullseye? Or we just barking ideals? We all know FOSS is under staffed and under funded. Perhaps Google should have one FTE for each major distro to help keep that beast of a codebase up to the standard these threads seem to expect. It's a heavy burden to place on Debian - and I don't think it's fair to expect them to have eg Chromium and the 10-hundred other packages perfect. Debian is fscking awesome, they are doing amazing work. Hip Hip Hooray!!
    - SAI_Peregrinus 5y ago
      The burden is entirely Debian's choice. They want to mess around backporting fixes. They could just package upstream's releases, but that would break their choice of stability model. The downsides of that choice of model is nobody's fault but their own.
      - pabs3 5y ago
        Debian just pulls in upstream updates for Chromium, since it is basically impossible to provide the normal patch backport method of security updates for modern web browsers, including Chromium and Firefox.
        SAI_Peregrinus 5y ago
        Yep. It's other packages that they try to maintain backports (forks) on. Browsers are basically sub-OSes, and very difficult to fork.
- fiddlerwoaroof 5y ago
  The whole maintainer model exists in Debian because Debian tries to do its own maintenance on packages, even if the original developers are unwilling to accept the fix back. Chromium and Firefox are sort of monster code bases, though, it’s not surprising to me that distros are reluctant to change it in key ways.
hakre 5y ago
No, software developers and package maintainers do. A distro is where it goes all together and normally under a license. Even licenses are different across packages in a repo, they normally all have a pretty clear wording how much you can hold responsible them for that (hint: no warranty, no fitness for a particular purpose). Read it before use and think first, e.g. how that software comes to life and is managed / maintained. Debian =/= Apple.
- JonathanBeuys 5y ago
  The software developer (Google) patched those bugs months ago. Not sure what that has to do with licenses.
  - hakre 5y ago
    The license states "Provided AS-IS". There is no right to damn the distributor to not make it not available (and as far as this is Chromium not even the project) - just that.

I am confused about your question. Can you elaborate? Distros usually provide patches for known security holes in their repos. Why would one not hold them responsible to do so?

edoceo 5y ago

How could Debian be the security gate for literally 1000s of packages? Chromium is a huge beast of code, should Debian maintainers be debugging and coding patches to various packages? I think we can't expect the distro to fix the security issues in everything. It's upstream responsibility to handle their own CVE.

JonathanBeuys 5y ago
Upstream has done that already. Google patched those bugs months ago.
- edoceo 5y ago
  Are we helping Debian get those processed into Bullseye? Or we just barking ideals? We all know FOSS is under staffed and under funded. Perhaps Google should have one FTE for each major distro to help keep that beast of a codebase up to the standard these threads seem to expect. It's a heavy burden to place on Debian - and I don't think it's fair to expect them to have eg Chromium and the 10-hundred other packages perfect. Debian is fscking awesome, they are doing amazing work. Hip Hip Hooray!!
  - SAI_Peregrinus 5y ago
    The burden is entirely Debian's choice. They want to mess around backporting fixes. They could just package upstream's releases, but that would break their choice of stability model. The downsides of that choice of model is nobody's fault but their own.
    - pabs3 5y ago
      Debian just pulls in upstream updates for Chromium, since it is basically impossible to provide the normal patch backport method of security updates for modern web browsers, including Chromium and Firefox.
      - SAI_Peregrinus 5y ago
        Yep. It's other packages that they try to maintain backports (forks) on. Browsers are basically sub-OSes, and very difficult to fork.
fiddlerwoaroof 5y ago
The whole maintainer model exists in Debian because Debian tries to do its own maintenance on packages, even if the original developers are unwilling to accept the fix back. Chromium and Firefox are sort of monster code bases, though, it’s not surprising to me that distros are reluctant to change it in key ways.

hakre 5y ago

No, software developers and package maintainers do. A distro is where it goes all together and normally under a license. Even licenses are different across packages in a repo, they normally all have a pretty clear wording how much you can hold responsible them for that (hint: no warranty, no fitness for a particular purpose). Read it before use and think first, e.g. how that software comes to life and is managed / maintained. Debian =/= Apple.

JonathanBeuys 5y ago
The software developer (Google) patched those bugs months ago. Not sure what that has to do with licenses.
- hakre 5y ago
  The license states "Provided AS-IS". There is no right to damn the distributor to not make it not available (and as far as this is Chromium not even the project) - just that.