Re: [Security-Discuss] Re: MDKA-2005:035 - Updated clamav packages provide latest version

On 23-Jul-05, at 11:56 AM, Bob Puff wrote:

> I believe I remember seeing SpamAssassin also updated to the 3.x  
> line for
> 10.1, unfortunately not 10.0.

This was due to the SA team not bothering to share patches.

And 10.0 used SA 2.x and wasn't vulnerable.

> This policy must be causing much more work for poor Vincent, having  
> to track
> down all the security-related patches for a product, and integrate  
> it into the
> source of an older version.  A good example of this is the latest  
> Firefox
> update.  It must be a nightmare trying to make sure that you don't  
> break the
> program in some odd way doing all this patching.

Ummm... no.  This is actually easier.  There is less regression  
issues by patching something than by updating to the latest and  
greatest.

> Allow me to ask this: how unique are the source RPMs to their  
> distribution?
> In other words, is it possible (or could it be possible, with a small
> modification) to take a 10.2 SRPM, rebuild it for a 10.0 machine,  
> and use it?

It depends on the RPM and how the maintainer built the spec.  It  
could very well be possible, but it's not just one package that you  
need to think about it.  You need to think about packages that  
require the rebuilt package, packages that the rebuilt package  
require, etc.  Upgrading versions is a *lot* more work.

> I realize that there are some things that are fixed: libc, X,  
> etc... But there
> are many other programs that I would like to be able to keep up  
> with the
> latest version... examples: postfix, spamassassin, clamav, amavis,  
> maybe Perl.

No.

And this is not up for discussion.  There are very good reasons for  
what we do.

In fact, if things were compiled against clamav (and didn't just use  
it), or if clamav's config drastically changed, or the commandline  
options changed, clamav would *not* have been updated.

-- 
Annvix - Secure Linux Server: http://annvix.org/
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}