Re: [Security-Discuss] Re: [Security Announce] MDKSA-2004:124 - Updated xorg-x11 packages fix libXpm overflow vulnerabilities

On 5-Nov-04, at 6:32 AM, Anne Wilson wrote:

>>>> Well, Nov 4th is a Thursday in this part of the world anyway :)
>>>
>>> but since they go out overnight (in our time) that inevitably means
>>> Friday install or stay without updates until after the weekend.
>>
>> OK.  Vincent is in charge and decides the timeline.  What would you
>> propose, nothing after Wednesday? We could have held this update back
>> until Monday, which would still leave you without updates until next
>> week.  They were long overdue as it is, and I sort of stuck my foot 
>> in my
>> mouth mentioning the Nov 1 target we were attempting to hit for 10.1
>> updates.
>
> To some extent you can't win whatever you do.  For many packages, 
> something
> going wrong with an update would be an annoyance, but sufferable for a 
> few
> days if necessary.  For others like xorg-x11 it is a real show-stopper 
> for
> most of us.  I'm guessing that not many updates are going to be such a
> problem.  Is it possible to consider which ones could cause such 
> chaos, and
> only put out a late-week update if it is something absolutely vital?
>
> Just thinking aloud, you understand ;-)

Ok, but here's the real issue.  For the most part, we avoid doing 
Friday releases unless it's something either very critical or very 
minimal.  But I base my schedule off of my time in the world and when I 
put an update up Thursday morning, it doesn't get announced till 
Thursday aft because of the mirrors.

So...  here's how I see it, and I think many people will agree with me, 
and those that don't really need to rethink a few things.

Everyone has a choice as to when they install updates.  Not everyone 
require absolute uptime, yet some people do.  The people that do should 
really be testing updates out on a non-production server before they 
apply them.  Yes, you should have some faith that for the most part we 
know what we're doing and trust that we've tested things out, but we're 
only human and with the number of updates that are being pushed through 
the queue, that's a lot of stuff to look at and build/test/etc.

So, considering that everyone has a choice as to when they install 
updates, the question then becomes why would someone who requires 
absolute uptime think of installing an update on a Friday (without 
prior testing) *anyways*?  You can choose not to install it.  So let's 
say you choose not to install it... how is it any different from us 
releasing the update on Monday?  For you who choose, it is no 
different.  Either way, you're installing on Monday.

Now, take someone like Ron who wants to install on Fridays... the 
reason why doesn't matter, just as your reason why you didn't install 
on Friday doesn't matter.  The bottom line is it's your choice.  But, 
by insisting that updates that are ready and waiting to go out be held 
in the queue until Monday, you're depriving some of our other customers 
from their right to install updates on their schedule.  You don't want 
to install... they do.  Who's right?

Well, for you, it doesn't matter.  Don't install it... pretend you 
didn't see it.  Ignore it till Monday.  For you, nothing has changed.  
For the person who wants to do the Friday install, we've tacked on 3 
days for them to wait, and for what?  For the person to whom it 
shouldn't even matter.

Why do you want to deprive them of *their* rights to install updates 
whenever *they* want?

Does that make any sense?  That's how I see it.  You've got a God-given 
mind to determine when you want to install what.  Don't lay it on us to 
justify when you want to install stuff, because then we have to think 
of the guy who only wants to install sfuff on Tuesdays, because that's 
what his schedule allows.  Do we accomodate him and only release on 
Tuesday?  So the people who are able to install Wed/Thurs have to wait 
a whole week while we twiddle our thumbs waiting for a time convenient 
for him?  Stow it!  If he wants to wait till Tues, he can wait till 
Tues... why should everyone else wait?

Come on...  policy or not, this should be common sense.  If you don't 
want to install the update... don't install it!  =)

(And besides... this don't put out updates on Friday thing was never a 
policy... it was a guideline I generally adhered to mostly because I 
realized that for most people it was an inconvenience... this is 
something I have chosen to do, and is not Mandrakesoft policy).

-- 
*Please note gpg keyid FE6F2AFD has been replaced with keyid FEE30AD4*
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}