Quoting Dossy ([EMAIL PROTECTED]): > Eek. So, if we want to run secure systems, we either have to run > unstable (and all the troubles that comes with) or stable?
The Security Team FAQ addresses this: http://www.debian.org/security/faq#testing Q: How is security handled for testing and unstable? A: The short answer is: it's not. Testing and unstable are rapidly moving targets and the security team does not have the resources needed to properly support those. If you want to have a secure (and stable) server you are strongly encouraged to stay with stable. However, the security secretaries will try to fix problems in testing and unstable after they are fixed in the stable release. The FAQ is your friend. ;-> > I find that "testing" is a good middle ground for a reasonably stable > system but with reasonably up-to-date packages, so that's why I run > it. You can certainly do that. But the burden is on you to read DSAs and take manual action as needed. E.g., if a DSA says some exposed piece of software you elect to run has a vulnerability you care about, you might find it in your interest to do one of the following: 1. Downgrade to the stable branch's version. 2. Install the binary version from the unstable branch[1]. 3. apt-get source the unstable version, then recompile and dpkg -i it. 4. deb-src and hand-patch, as you say. 5. Switch temporarily from the affected package to an equivalent that isn't affected. (Remember, there's lsh, for example.) (The above is for the benefit of list readership at large. I'm certainly not suggesting you personally aren't aware of those options.) [1] Add Package: * Pin: release a=unstable Pin-Priority: 50 to /etc/apt/preferences. Have both testing and unstable lines in /etc/apt/sources.list . Then, after another apt-get update: # apt-get -t unstable install <somepackage> ...will get <somepackage> and any needed dependencies from the unstable branch. (Note that you cannot assume unstable automatically fixes security bugs.) Alternatively, use "=" syntax to fetch a specified package version: apt-get install somepackage=12.17.4-4 Tutorial: http://jaqque.sbih.org/kplug/apt-pinning.html -- Cheers, "I don't like country music, but I don't mean to denigrate Rick Moen those who do. And, for the people who like country music, [EMAIL PROTECTED] denigrate means 'put down'." -- Bob Newhart -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]