Re: [Security-Discuss] Firefox Backport Request to 10.1

On 16-May-05, at 5:16 PM, Dieter Schütze wrote:

>> The clamav thread.  When did that start?  Yesterday?  Today?  Good
>> Lord man, we're not super heros here that can turn back the clock or
>> work at the speed of light.  You whine about an older version in
>> clamav less than 24 hours ago and you expect the update to be out
>> already?  I think you need a reality check.
>>
>
> Sorry !!!
> It is not my job to look about very important patches.

Huh?

> clamav 0.84 with this important patches are out since 29th of April.
> And now we have clamav 0.85

Right, and 0.83 came with LE2005 and no one told me (ie. the  
maintainer) that an update for clamav was required.  So it hasn't  
been updated.  Unless the maintainer tells me an update is required  
(be it functional or bugfix), or unless there is a security problem  
with it, I won't know about it.

The last clamav update we put out was in January, and that was based  
on the maintainer's request (it was 0.81).  I wasn't aware there is a  
security hole in clamav prior to 0.85.  Is there?  Do you have a CVE  
name handy, because I sure don't.  You're just looking for the  
"latest and greatest", no?

> I am buying the Distribution packages and now you want i do the  
> work for
> you ?

Yes, please.  Could you build the packages for me?

Seriously... what have I asked you to do?  Other than providing a CVE  
name (just now) I haven't asked you for squat.  What are you talking  
about doing the work for you?

> I think you need a reality check.

Huh?  We must be in two different worlds.  I'm stuck here in the real  
world, and you're traipsing off in fantasy land.

Seriously man... nothing you've said so far makes *any* sense.

> If that the way of mandriva to be gone around with customers ?
> I think no, or ?

I don't get you at all.

Could you maybe rephrase that last one?  I understood what you were  
talking about (more or less) in the rest of your message (although I  
think you're out to lunch), but this I didn't get at all.

>> LE2005 a community version and not for production?  I think you
>> misread the press release.  LE2005 is fully supported for the same
>> length of time that 10.1 is.  LE2005 is functionally the equivalent
>> of 10.2.  LE2005 is an official product being sold by MandrivaStore.
>> LE2005 is called "Limited Edition" not because it's some crap we
>> decided to pass the time with but because it will have limited
>> *distribution* meaning boxed sets will not be sold in stores.
>>
>>
> If it so ? Then is the fault with clamav much harder that i think.
> Because in the main tree are clamav 0.83 and no updates.

You lost me.

Oh, wait.  I get it.  You think we have to bring every single piece  
of software we ship to the latest version when it comes out, right?   
That's what it sounds like to me.  Dandy idea.  Let's get on that.

Oh.  Wait.  It's called cooker and it's existed for years.

> PS: I do not think that am good basis for me at my customers  
> mandriva to
> be introduced

Ummm... lost me again.

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}