Re: triaging CVE-2016-1503+1504

2016-01-25 Thread Mike Gabriel
HI Guido, On Mo 25 Jan 2016 20:44:34 CET, Guido Günther wrote: Hi, looking at the above CVEs concerning dhcpcd, you wrote # Remove not-affected tags for squeeze. By simple code inspection we # cannot say that the issue is not present in squeeze's / wheezy's version # of dhcpcd. Further action

triaging CVE-2016-1503+1504

2016-01-25 Thread Guido Günther
Hi, looking at the above CVEs concerning dhcpcd, you wrote # Remove not-affected tags for squeeze. By simple code inspection we # cannot say that the issue is not present in squeeze's / wheezy's version # of dhcpcd. Further actions: try exploit, ask upstream, second opinion. did you contact upstr

Re: pound

2016-01-25 Thread Guido Günther
On Mon, Jan 25, 2016 at 09:14:21PM +1100, Brian May wrote: [..snip..] > > Did you check that the new upstream version is backwards compatible in > > terms of usage? > > Yes. It is mostly bug fixes and several new features, such as SNI > support. I did a diff, and compared. That matches what I dif

Re: Packages not supported in wheezy-lts

2016-01-25 Thread Matthias Klose
On 25.01.2016 14:47, Raphael Hertzog wrote: Hello, On Mon, 25 Jan 2016, Raphael Hertzog wrote: But there are still multiple open questions... I have added the most important ones that I remembered in https://wiki.debian.org/LTS/TODO and I seek your help to find a proper answer to those questio

Re: Packages not supported in wheezy-lts

2016-01-25 Thread Raphael Hertzog
Hello, On Mon, 25 Jan 2016, Raphael Hertzog wrote: > But there are still multiple open questions... I have added the most > important ones > that I remembered in https://wiki.debian.org/LTS/TODO and I seek your help > to find a proper answer to those questions: > > - what to do with openjdk-6?

Re: Packages not supported in wheezy-lts

2016-01-25 Thread Jan Ingvoldstad
On 01/25/2016 01:25 PM, Jan Ingvoldstad wrote: It's possible that we can phase out openjdk-*-jre and openjdk-*-jdk, and require that our customers do their development elsewhere, I'll check into that. If so, it should be easy to skip openjdk-6 entirely. Okay, the impact was less severe than I

Re: pound

2016-01-25 Thread Steve McIntyre
On Mon, Jan 25, 2016 at 02:23:39PM +0100, Raphael Hertzog wrote: >On Mon, 25 Jan 2016, Brian May wrote: >> I tried to create an account, but this failed with a generic error; so I >> wondered if I already had an account (I don't think I do), and tried the >> forget password routine. I am wondering

Re: pound

2016-01-25 Thread Raphael Hertzog
On Mon, 25 Jan 2016, Brian May wrote: > I tried to create an account, but this failed with a generic error; so I > wondered if I already had an account (I don't think I do), and tried the > forget password routine. I am wondering if it has detected a security > violation and blocked my IP address.

Re: Packages not supported in wheezy-lts

2016-01-25 Thread Jan Ingvoldstad
On 01/25/2016 12:23 PM, Raphael Hertzog wrote: Hello, Hi! - what to do with openjdk-6? This one's a bit tricky for us, as openjdk-7-jdk and openjdk-7-jre pull in 73 additional packages, compared to openjdk-6-jdk and openjdk-6-jre. There are a bunch of GNOME and MESA packages, as well as

Packages not supported in wheezy-lts

2016-01-25 Thread Raphael Hertzog
Hello, after the first round of discussion in https://lists.debian.org/20151104164243.gb10...@home.ouaza.com and https://lists.debian.org/20151104164436.gc10...@home.ouaza.com I have a first update of debian-security-support for things that won't be supported in wheezy LTS. I pushed this in the p

Re: pound

2016-01-25 Thread Brian May
Raphael Hertzog writes: > Usually this means that you just are not logged in. :) I get this if I go to https://wiki.debian.org/ - there is no option to login. I tried to create an account, but this failed with a generic error; so I wondered if I already had an account (I don't think I do), and

Re: pound

2016-01-25 Thread Raphael Hertzog
On Mon, 25 Jan 2016, Brian May wrote: > So version 2.6-2+deb7u1~deb6u1 or 2.6-2~deb6u1? Yes. > I considered doing this, and adding a new entry to the end of the > changelog, however was worried that this would mean the changelog > wouldn't be in the correct incrementing version order. That's exp

Re: pound

2016-01-25 Thread Brian May
Raphael Hertzog writes: > On Sat, 23 Jan 2016, Brian May wrote: >> * Wasn't sure what to do with the version number - I have to use a lower >> then then wheezy - so I merged the changelog entries for 2.6-* into >> one and named the version 2.6-1+deb6u1 > > The usual way to handle such cases i

Re: pound

2016-01-25 Thread Raphael Hertzog
Hi Brian, On Sat, 23 Jan 2016, Brian May wrote: > * Wasn't sure what to do with the version number - I have to use a lower > then then wheezy - so I merged the changelog entries for 2.6-* into > one and named the version 2.6-1+deb6u1 The usual way to handle such cases is to append ~deb6u1 at