Re: DSA 438 - bad server time, bad kernel version or information delayed?

2004-02-21 Thread Matt Zimmerman
On Sat, Feb 21, 2004 at 11:09:09AM +0100, Jan L?hr wrote: > Am Samstag, 21. Februar 2004 01:10 schrieb Matt Zimmerman: > .. > > > CERT rarely has anything to do with coordinating disclosure, and there is > > no need to bring them into this discussion at all. The coordination that > > happens is

Re: DSA 438 - bad server time, bad kernel version or information delayed?

2004-02-21 Thread Florian Weimer
Jan Lühr wrote: > Thus, won't be a little more competition between the vendors better for > security at all? What, exactly, is the incentive to release faster (and fewer) security patches than your competition? There is no significant one, I fear, even without vendor-sec coordination. Users ch

Re: DSA 438 - bad server time, bad kernel version or information delayed?

2004-02-21 Thread Matt Zimmerman
On Sat, Feb 21, 2004 at 11:09:09AM +0100, Jan L?hr wrote: > Am Samstag, 21. Februar 2004 01:10 schrieb Matt Zimmerman: > .. > > > CERT rarely has anything to do with coordinating disclosure, and there is > > no need to bring them into this discussion at all. The coordination that > > happens is

Re: DSA 438 - bad server time, bad kernel version or information delayed?

2004-02-21 Thread Florian Weimer
Jan Lühr wrote: > Thus, won't be a little more competition between the vendors better for > security at all? What, exactly, is the incentive to release faster (and fewer) security patches than your competition? There is no significant one, I fear, even without vendor-sec coordination. Users ch

Re: output of last

2004-02-21 Thread Jan Lühr
Greetings,... Am Samstag, 21. Februar 2004 17:11 schrieb s. keeling: > Incoming from Jan Lühr: > > Greetings, > > > > I discovered some strange output of the last command on our Woody > > Terminalserver (for X11). I have already posted it on debian-user-german, > > but I didn't get any answer. (I

Re: output of last

2004-02-21 Thread s. keeling
Incoming from Jan Lühr: > Greetings, > > I discovered some strange output of the last command on our Woody > Terminalserver (for X11). I have already posted it on debian-user-german, but > I didn't get any answer. (I hope you don't mind, if I post it for the english > speaking majority) > Altho

Re: output of last

2004-02-21 Thread Jan Lühr
Greetings,... Am Samstag, 21. Februar 2004 17:11 schrieb s. keeling: > Incoming from Jan Lühr: > > Greetings, > > > > I discovered some strange output of the last command on our Woody > > Terminalserver (for X11). I have already posted it on debian-user-german, > > but I didn't get any answer. (I

Re: output of last

2004-02-21 Thread s. keeling
Incoming from Jan Lühr: > Greetings, > > I discovered some strange output of the last command on our Woody > Terminalserver (for X11). I have already posted it on debian-user-german, but > I didn't get any answer. (I hope you don't mind, if I post it for the english > speaking majority) > Altho

Re: Some clarifications about the Debian-security-HOWTO

2004-02-21 Thread Daniel Kobras
On Sat, Feb 21, 2004 at 09:09:24AM +0100, Adrian 'Dagurashibanipal' von Bidder wrote: > ... and sometimes people forget to leave urgency at 'high' until the fix is > really in testing when they upload a new version. Doesn't make a difference. The testing scripts take into account the maximum urg

Re: Some clarifications about the Debian-security-HOWTO

2004-02-21 Thread Daniel Kobras
On Sat, Feb 21, 2004 at 09:09:24AM +0100, Adrian 'Dagurashibanipal' von Bidder wrote: > ... and sometimes people forget to leave urgency at 'high' until the fix is > really in testing when they upload a new version. Doesn't make a difference. The testing scripts take into account the maximum urge

Re: DSA 438 - bad server time, bad kernel version or information delayed?

2004-02-21 Thread Jan Lühr
Greetings, Am Samstag, 21. Februar 2004 01:10 schrieb Matt Zimmerman: .. > CERT rarely has anything to do with coordinating disclosure, and there is > no need to bring them into this discussion at all. The coordination that > happens is between vendors, like Debian, as peers. > > Those last two

output of last

2004-02-21 Thread Jan Lühr
Greetings, I discovered some strange output of the last command on our Woody Terminalserver (for X11). I have already posted it on debian-user-german, but I didn't get any answer. (I hope you don't mind, if I post it for the english speaking majority) Although I hope it is not security related,

Re: Some clarifications about the Debian-security-HOWTO

2004-02-21 Thread Adrian 'Dagurashibanipal' von Bidder
On Saturday 21 February 2004 01.14, Matt Zimmerman wrote: > On Fri, Feb 20, 2004 at 01:14:43PM +0100, Gian Piero Carrubba wrote: > > Uploads that fix a security hole should have the priority set to high, > > and this should reduce the transition delay to less than a week [1], > > shouldn't it? > >

Re: DSA 438 - bad server time, bad kernel version or information delayed?

2004-02-21 Thread Jan Lühr
Greetings, Am Samstag, 21. Februar 2004 01:10 schrieb Matt Zimmerman: .. > CERT rarely has anything to do with coordinating disclosure, and there is > no need to bring them into this discussion at all. The coordination that > happens is between vendors, like Debian, as peers. > > Those last two

Re: DSA 438 - bad server time, bad kernel version or information delayed?

2004-02-21 Thread Adrian 'Dagurashibanipal' von Bidder
On Saturday 21 February 2004 01.10, Matt Zimmerman wrote: > On Fri, Feb 20, 2004 at 02:34:37PM +0100, Adrian von Bidder wrote: > > I think this is the time where I'd like to see some hard data. Which > > DSA's would possibly have been released differently if such a > > reorganisation would have bee

output of last

2004-02-21 Thread Jan Lühr
Greetings, I discovered some strange output of the last command on our Woody Terminalserver (for X11). I have already posted it on debian-user-german, but I didn't get any answer. (I hope you don't mind, if I post it for the english speaking majority) Although I hope it is not security related,

Re: Some clarifications about the Debian-security-HOWTO

2004-02-21 Thread Adrian 'Dagurashibanipal' von Bidder
On Saturday 21 February 2004 01.14, Matt Zimmerman wrote: > On Fri, Feb 20, 2004 at 01:14:43PM +0100, Gian Piero Carrubba wrote: > > Uploads that fix a security hole should have the priority set to high, > > and this should reduce the transition delay to less than a week [1], > > shouldn't it? > >

Re: DSA 438 - bad server time, bad kernel version or information delayed?

2004-02-21 Thread Adrian 'Dagurashibanipal' von Bidder
On Saturday 21 February 2004 01.10, Matt Zimmerman wrote: > On Fri, Feb 20, 2004 at 02:34:37PM +0100, Adrian von Bidder wrote: > > I think this is the time where I'd like to see some hard data. Which > > DSA's would possibly have been released differently if such a > > reorganisation would have bee