Hi Fedora-Security folks:
We in Fedora Legacy have been having severe manpower shortages in getting work done for security issues relating to Fedora Core releases that have been turned over to our care. Basically, no new packages that fix security issues have been released by Fedora Legacy since late July.
http://www.redhat.com/archives/fedora-legacy-announce/2006-July/date.html http://www.redhat.com/archives/fedora-legacy-announce/2006-August/date.html http://www.redhat.com/archives/fedora-legacy-announce/2006-September/date.ht... http://www.redhat.com/archives/fedora-legacy-announce/2006-October/date.html
-- those pretty much tell the story.
Also, a 3+-month-old Legacy status report here http://fedoraproject.org/wiki/Legacy/Status.
A fellow contributor says that, essentially, Fedora Legacy is providing a false sense of security to people who point their yum at our repositories. If that is the case ... ?!
We need help! Any suggestions/advice on how/where we can get help getting our work done?
Thanks in advance!
Warm regards, David Eisenstein
We need help! Any suggestions/advice on how/where we can get help getting our work done?
Would limiting the scope of errata support help stop Legacy being overwhelmed with updates?
In my opinion if Legacy was a project that fixed only security issues rated severity critical (plus say kernel privilege escalation issues), it would still be providing an important level of protection to users whilst limiting the amount of work. For example for Enterprise Linux 4 we issued about 20 updates a year that would fall into this category. http://www.redhat.com/security/updates/classification/
In fact this is something we've started to do for Red Hat products; the Red Hat Application Stack product comes with two years of full support, followed by a year of security support for critical severity issues only.
Mark
On Monday 09 October 2006 03:53, Mark J Cox wrote:
Would limiting the scope of errata support help stop Legacy being overwhelmed with updates?
In my opinion if Legacy was a project that fixed only security issues rated severity critical (plus say kernel privilege escalation issues), it would still be providing an important level of protection to users whilst limiting the amount of work. For example for Enterprise Linux 4 we issued about 20 updates a year that would fall into this category. http://www.redhat.com/security/updates/classification/
I think this might be acceptable. We're still in a major hole wrt RHL7.3/RHL9 and FC3/4 that we'd have to dig our way out of, even if we limited it to Critical severity stuff, and this is where we need some initial help to dig our way out to a manegable workflow.
security@lists.fedoraproject.org