Re: Retiring lpr and lpd

Steve Kargl <[email protected]> writes:
> Did you miss the "What is the problem? Don't fix what isn't broken."

No, I didn't miss it.  But Slawa and you clearly missed me telling you
_twice_ that it _is_ broken.

> Is there an open CVE that we need to worry about?

There are known bugs, for which I have patches.  It is currently unclear
whether a CVE will be assigned.  While preparing those patches, I
learned that lpd is _an absolute shitshow_.  It runs with elevated
privileges, accepts input from the network without authentication, and
does next to no input validation or bounds checking.  It needs to be
overhauled, replaced, or removed, and this is me giving you _one and a
half years' notice_ to do either of the former before I do the latter.

DES
-- 
Dag-Erling Smørgrav - [email protected]