On Thursday, February 13, 2020 1:34:32 PM MST Chris Murphy wrote:
On Thu, Feb 13, 2020 at 12:53 PM David Cantrell
> > Similarly, a package with a medium CVE NEW bugzilla would be orphaned
> > after 4
reminders (after 9-12 weeks), retired at a point if still not
> > CLOSED after 4 months.> >
> > With low severity, that is 6 reminders (after 15-18 weeks), retired at a
> > point if still not CLOSED after 6 months (similarly to the current
> > policy).>
> Where do get bug severity information?
Fedora Workstation WG has an issue "Reconsider updates policy" that
relates to this question.
If there are any security updates, GNOME Software pops up a
notification to install them. This thwarts attempts to avoid nagging
the user, because so many updates contain some sort of security
mitigation. One proposal is to not treat security updates as special,
and still wait until a week has passed for the update.
But the contra argument is, well what if there is an urgent security fix?
The repo metadata, I guess, needs some way of distinguishing urgent vs
non-urgent security updates, so that GNOME Software knows whether to
notify the user accordingly. But is there a reliable way of
distinguishing between urgent and non-urgent security updates? I'd
informally suggest "urgent" is something that should be applied today
or tomorrow. Anything else can wait a week or two.
That's an entirely subjective thing. I'd recommend prompting to install ALL
security updates immediately, but why not just give the user an option for
security updates? This is what Mac and Windows do, and it makes sense because
it's really the user's opinion of security updates that matter on their
John M. Harris, Jr.