Re: Licence problem in bundled library

Hi

> Le lundi 12 mars 2012 18:07:58, vous avez =E9crit :
>> - Some distributors would like to link to the expat/XXXlibraries they
>> have anyway in their distro, but for the Windows users it is more
>> comfortable to have the source included in the tree, so I leave it there
>> for now. Distributors can patch their builds easily if they like. They
>> prefer this, because they think they can then replace a broken lib once
>> in the distro and this makes maintenance easier, but they do not account
>> the risk (basically you change then all depending application without
>> any QA or serious test, great...).
>
> It is not replacing a broken lib, just patching it is enough for security.
>
>> Regarding security problems the situation with a "built in" lib is not
>> that bad as well, because as long you do not use an affected part of the
>> library, it just does not matter.
>
> Sorry, I disagree : I understand you don't this is important for a game. =
But
> for a networked application like TORCS, it matters.

TORCS is not yet a networked application:-(

No reason to sorry, multiple viewpoints are useful. I know I compacted =

the argument very much, but I am not in the mood to write a book about =

it. Short:
- I agree, a security fix TRIES just to fix the issue,
- BUT semantically this is impossible, because the calls are in the =

usual languages/API's not formally defined, so the implementation is the =

definition, and if the definition allows a vulnerability it is =

semantically not different from any "normal" functionality.

So this is my purist logic:
-> Security fixes change the semantics of certain calls/inputs, so you =

cannot make guarantees regarding clients.

Of course this works usually "good enough" to be useful for =

toyboxes/desktops, but there have also been prominent screw-ups (where =

fixes really made things worse, clients stopped working, etc., see =

Microsoft Windows, Linux kernel, OpenSSL, ...).

That is the reason why enterprise software packages are usually "self =

contained" to the deepest possible level (own copy of JVM, runtime =

libraries, etc.), the consultants set up your server to match the =

certification, etc., the vendors just guarantee for their products if =

the environment matches. Security patches get there just applied if the =

vendor officially certifies them, this is also a reason why enterprises =

are always a bit behind with their patches/service packs/etc.

> Anyway, let's see if the problem arises also in Debian?

No idea, I do not know which distros contain TORCS. If somebody submits =

a super tiny TORCS patch where one can switch during configure to an =

external expat/whatever I would apply it.

Best regards

Bernhard

---------------------------------------------------------------------------=
---
Try before you buy =3D See our experts in action!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-dev2