On Wednesday, July 06, 2016 11:13:55 PM Andrew Savchenko wrote: > On Wed, 06 Jul 2016 20:23:46 +0900 Aaron Bauman wrote: .....
> Please understand me correctly: I'm not blaming you or security > team for this or that issue. But it looks like security team indeed > needs to review some policies and approaches to suit needs of > Gentoo users better in both of terms of security and usability, to > find some reasonable compromise between them, which will satisfy > most users. For these very issues it looks like canceling "removal > in 30 days" clause from p.mask action will do the job. +1 on this. Please don't simply tree-clean packages because of security issues. Masking them with a reference to the security issues should be sufficient. Some applications can easily be used safely even with gaping security holes. (A heavily firewalled box or air-gap comes to mind). -- Joost
signature.asc
Description: This is a digitally signed message part.
