Re: Security EOL within Debian Stable

2015-02-07 Thread Holger Levsen
On Samstag, 7. Februar 2015, Jan Wagner wrote: > it would be great if you would open a bug against the > debian-security-support package if there isn't one pending yet. #776904 please mark chromium as unsupported in wheezy signature.asc Description: This is a digitally signed message part.

Re: Security EOL within Debian Stable

2015-02-07 Thread Jan Wagner
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Am 05.02.15 um 23:13 schrieb Stephen Dowdy: > It's been less than a week since 'chromium' support was EOL'd, so > hopefully soon 'debian-security-support' will get that updated > info. it would be great if you would open a bug against the debian-secu

Re: Security EOL within Debian Stable

2015-02-05 Thread Stephen Dowdy
On Wed, Feb 4, 2015 at 6:49 PM, Michael Gilbert wrote: > On Wed, Feb 4, 2015 at 8:09 PM, Stephen Dowdy wrote: >> So, if a user installs said package, but fails to notice any EOL DSA >> on it, the package gets left in place in a potentially VULNERABLE >> state. I.E. if a known exploit comes out, a

Re: Security EOL within Debian Stable

2015-02-04 Thread Michael Gilbert
On Wed, Feb 4, 2015 at 8:09 PM, Stephen Dowdy wrote: > So, if a user installs said package, but fails to notice any EOL DSA > on it, the package gets left in place in a potentially VULNERABLE > state. I.E. if a known exploit comes out, and the package is still > installed, the end-user could get a

Security EOL within Debian Stable

2015-02-04 Thread Stephen Dowdy
(after contemplating a possible 'chromium' thread hijack, i figured this should be a new thread)... I see a definite problem with the way that package security support gets end-of-lifed in Debian-Stable. Not just chromium and other browsers, but the JDK/JRE packages, historically, as well. I'm n