Re: [Security-Discuss] Re: [Security Announce] MDKSA-2005:113 - Updated clamav packages fix vulnerability

On Tue, Jul 12, 2005 at 09:42:03AM -0600, Vincent Danen wrote:
> 
> On 12-Jul-05, at 9:13 AM, Simon Oosthoek wrote:
> 
> >Perhaps I'm expecting too much (as I'm sure you'll be happy to  
> >confirm), but
> >I consider support to be sufficient to keep my system unbroken and  
> >secure
> >during the supported period. If the nature of the software, which is
> >determined outside the control of Mandriva, is that newer versions are
> >required to be unbroken and secure, that implies that Mandriva should
> >provide these newer versions during the support period. Of course,  
> >that's
> >just my personal opinion...
> 
> The package is patched.  What's broken and insecure?  The security  
> hole is closed.  clamav works.  I fail to see your point.

As Oden pointed out, clamav 0.81 complains about lack of functionality due
to being too old. To the average sysadmin, that would scream "broken". Now
you could take the message away, or you could try to fix the real problem,
but then we aparently get into resource problems...
 
> >BTW Vincent, I don't think your employer gets happy from the way  
> >you treat
> >paying customers... As a relative freeloader (I'm only a silver  
> >club member)
> >I know to silently put up with your short fuse, but it's just not a  
> >pretty
> >sight to see you dis a real customer...
> 
> Ummm.. I don't have a short fuse.  Ask my daughter... I'm  
> exceptionally patient.  =)  Unfortunately, my problem isn't that I  
> have a short fuse, it's that I call things as I see them without  
> sugar coating it (ask my wife... this is definitely one "fault" that  
> she probably could do without).  I wasn't "dissing" Bob.  I was  
> making an observation.  Someone either did sucker him into thinking  
> that he would get new versions of software with CS, or he  
> misunderstood what the extended support lifetime is.  That's not  
> "dissing" him.  That's simply saying that someone told him something  
> that wasn't true, or he just didn't understand something that should  
> have been clear enough.  *I* haven't seen any thing that even  
> remotely suggests software will be updated to the latest version in CS.

Ok, I apologise for drawing conclusions too quickly, that's one of my
shortcomings ;-)

As it is though, your responses would actually need constant monitoring to
avoid negative consequences from misunderstanding your intention...

> And my employer is quite happy with me, thankyouverymuch.  In fact,  
> sitting on this list and even replying to these mails is not part of  
> my job and I am not required to be here at all, so, having said, that  
> I'm going above and beyond the call of duty to even read this list,  
> nevermind respond on it.  My employer appreciates that singular  
> dedication; it's unfortunate you do not.

I do appreciate it, I was merely speculating about Mandriva's opinion...

> >And about the other distro's, there never a need to follow a bad  
> >example. If
> >you can think up a better solution, that can help you stand out  
> >from the
> >others, it's not a bad thing to stand out positively in a  crowd!
> 
> Give me the same resources the other distros have and I guarantee you  
> we will stand out from the crowd.  Given the lesser resources at my  
> disposal compared to most other distros, I think we're doing a damn  
> fantastic job.  If I was on par with, say, the SUSE team, what we  
> could accomplish would literally blow your mind.  =)

I'd love to see that! Why doesn't mandriva give you more resources? They've
just incorporated 2 other distros, can't they spare a few resources to
enhance such a vital part of their support? 

> Until then, I have to keep a tight reign on resource expenditure to  
> make sure the best job possible can be accomplished with what I have  
> at my disposal and that is a fine line to walk to keep everyone as  
> happy as possible.

I believe the policy has just been pushed off the fine line, it is no longer
sufficient to provide adequate support. Since this is nothing personal,
if I were you I'd inform upper management that if you don't get some help,
people are going to leave Mandriva due to lack of security support. In my
opinion that is currently not an unrealistic scenario. 

Cheers

/Simon

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________