[I haven't subscribed to this list yet, so if you will, please CC me. Else I'll pick up replies via online mail.archives when they become available]
> On Mon, Jan 28, 2002 at 04:27:10PM +0100, Csan (Ja'nos Hola'nyi) wrote: > > "Another advantage of a custom built Linux system is added security. You > > will compile the entire system from source, thus allowing you to audit > > everything, if you wish to do so, and apply all the security patches you > > want or need to apply. > > You don't have to wait for somebody else to provide a new binary package > > that fixes a security hole. Besides, you have no guarantee that the new > > package actually fixes the problem (adequately)." > This is the most serious fallacy. The Debian security team is probably > more thorough than most of the LFS users. There's nothing in my mind that doubt they are. My point still stands: if you download a precompiled package, you don't have much of a guarantee that patches are applied to the source that created those binaries. You'll have to fully trust on that package maintainers word that a patch has been included, unless of course patches offer a way to be queried when compiled into. Some do, so if all debian patches do that nowadays then I'll withdraw my claim for Debian. > Most of the LFS users I've encountered seem to fit this mold: > <Overfiend> "*PANT* *PANT* YEAH BABY!!!! FRESH COMMITS TO CVS!!!!" > *PANT* *PANT* May I ask where you get that idea from? Don't you think you are exaggerating just a little bit here? Like you guys don't get 'happy' when fixes are commited to CVS so the public can try out improved Debian components. -- Gerard Beekmans www.linuxfromscratch.org -*- If Linux doesn't have the solution, you have the wrong problem -*-
