Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-20 Thread Michael Gilbert
On Sun, 20 Feb 2011 08:24:32 +0100 Lucas Nussbaum wrote: > On 19/02/11 at 17:40 -0500, Michael Gilbert wrote: > > On Sat, 19 Feb 2011 21:39:03 + Ben Hutchings wrote: > > > > Hypothesis 1: using an older kernel in testing results in fewer > > > > vulnerabilities > > > > > > > > Criteria: fe

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Lucas Nussbaum
On 19/02/11 at 17:40 -0500, Michael Gilbert wrote: > On Sat, 19 Feb 2011 21:39:03 + Ben Hutchings wrote: > > > Hypothesis 1: using an older kernel in testing results in fewer > > > vulnerabilities > > > > > > Criteria: fewer vulnerabilities in lenny than squeeze during squeeze > > > testin

Re: [Secure-testing-team] [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Bastian Blank
On Sat, Feb 19, 2011 at 04:58:50PM -0500, Michael Gilbert wrote: > On Sat, 19 Feb 2011 22:28:17 +0100 Bastian Blank wrote: > > On Sat, Feb 19, 2011 at 03:55:03PM -0500, Michael Gilbert wrote: > > > Hypothesis 1: using an older kernel in testing results in fewer > > > vulnerabilities > > > Eviden

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Michael Gilbert
On Sat, 19 Feb 2011 21:39:03 + Ben Hutchings wrote: > > Hypothesis 1: using an older kernel in testing results in fewer > > vulnerabilities > > > > Criteria: fewer vulnerabilities in lenny than squeeze during squeeze > > testing cycle > > Evidence: lenny's kernel was vulnerable to 67% of

Re: [Secure-testing-team] [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Michael Gilbert
On Sat, 19 Feb 2011 22:28:17 +0100 Bastian Blank wrote: > On Sat, Feb 19, 2011 at 03:55:03PM -0500, Michael Gilbert wrote: > > Hypothesis 1: using an older kernel in testing results in fewer > > vulnerabilities > > > > Criteria: fewer vulnerabilities in lenny than squeeze during squeeze > > t

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Ben Hutchings
On Sat, 2011-02-19 at 15:55 -0500, Michael Gilbert wrote: > On Sat, 19 Feb 2011 20:30:47 + Ben Hutchings wrote: > > > On Sat, 2011-02-19 at 14:59 -0500, Michael Gilbert wrote: > > > On Sat, 19 Feb 2011 19:32:08 + Ben Hutchings wrote: > > [...] > > > > > Again, if the user is interested in

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Bastian Blank
On Sat, Feb 19, 2011 at 03:55:03PM -0500, Michael Gilbert wrote: > Hypothesis 1: using an older kernel in testing results in fewer > vulnerabilities > > Criteria: fewer vulnerabilities in lenny than squeeze during squeeze > testing cycle > Evidence: lenny's kernel was vulnerable to 67% of th

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Yves-Alexis Perez
On sam., 2011-02-19 at 15:55 -0500, Michael Gilbert wrote: > I can't imagine anyone else being put through such a arduous process > to try an experiment for a couple months. Why does it have to be so > difficult? Because noone else wants Wheezy to be stuck at 2.6.32 when 2.6.37/38 are available.

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Michael Gilbert
On Sat, 19 Feb 2011 20:30:47 + Ben Hutchings wrote: > On Sat, 2011-02-19 at 14:59 -0500, Michael Gilbert wrote: > > On Sat, 19 Feb 2011 19:32:08 + Ben Hutchings wrote: > [...] > > > > Again, if the user is interested in such new developments, they will > > > > need to be willing to learn h

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Michael Gilbert
On Sat, 19 Feb 2011 14:59:27 -0500 Michael Gilbert wrote: > On Sat, 19 Feb 2011 19:32:08 + Ben Hutchings wrote: > > > On Sat, 2011-02-19 at 14:04 -0500, Michael Gilbert wrote: > > > On Sat, 19 Feb 2011 18:48:40 + Ben Hutchings wrote: > > > > > > > On Sat, 2011-02-19 at 13:12 -0500, Micha

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Ben Hutchings
On Sat, 2011-02-19 at 14:59 -0500, Michael Gilbert wrote: > On Sat, 19 Feb 2011 19:32:08 + Ben Hutchings wrote: [...] > > > Again, if the user is interested in such new developments, they will > > > need to be willing to learn how to run an unstable system. > > > > I thought that users interes

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Michael Gilbert
On Sat, 19 Feb 2011 19:32:08 + Ben Hutchings wrote: > On Sat, 2011-02-19 at 14:04 -0500, Michael Gilbert wrote: > > On Sat, 19 Feb 2011 18:48:40 + Ben Hutchings wrote: > > > > > On Sat, 2011-02-19 at 13:12 -0500, Michael Gilbert wrote: > [...] > > > > 2. Improve testing security by reduci

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Ben Hutchings
On Sat, 2011-02-19 at 14:04 -0500, Michael Gilbert wrote: > On Sat, 19 Feb 2011 18:48:40 + Ben Hutchings wrote: > > > On Sat, 2011-02-19 at 13:12 -0500, Michael Gilbert wrote: [...] > > > 2. Improve testing security by reducing the amount of vulnerabilities > > > existent in older kernels (rou

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Michael Gilbert
On Sat, 19 Feb 2011 18:48:40 + Ben Hutchings wrote: > On Sat, 2011-02-19 at 13:12 -0500, Michael Gilbert wrote: > [...] > > Also, this solution isn't just about CUT stability. As I've been > > describing, it is about killing about 2 birds with one stone: > > > > 1. Make testing always instal

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Ben Hutchings
On Sat, 2011-02-19 at 13:12 -0500, Michael Gilbert wrote: [...] > Also, this solution isn't just about CUT stability. As I've been > describing, it is about killing about 2 birds with one stone: > > 1. Make testing always installable by retaining a stable/well-tested > kernel and associated d-i i

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Michael Gilbert
On Sat, 19 Feb 2011 14:09:50 +0100 Raphael Hertzog wrote: > On Fri, 18 Feb 2011, Michael Gilbert wrote: > > This will also help to provide a bit more stability for CUT [0]. Over > > a 1.5-year period (the non-freeze timeframe) roughly 6 new upstream > > kernels will be released, and each new kern

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-19 Thread Raphael Hertzog
On Fri, 18 Feb 2011, Michael Gilbert wrote: > This will also help to provide a bit more stability for CUT [0]. Over > a 1.5-year period (the non-freeze timeframe) roughly 6 new upstream > kernels will be released, and each new kernel comes along with a high > probability of introducing breakage.

Re: [cut-team] For discussion: security support strategy for the wheezy kernel

2011-02-18 Thread Lucas Nussbaum
On 18/02/11 at 17:24 -0500, Michael Gilbert wrote: > On Mon, 7 Feb 2011 22:54:53 -0500 Michael Gilbert wrote: > > On Sun, 6 Feb 2011 21:58:08 -0400, Joey Hess wrote: > > > Michael Gilbert wrote: > > > > Another issue was that a lot of vulnerabilities that were found in that > > > > time frame were