Bug#603450: Is 603450 realy release critical?

2010-12-09 Thread gregor herrmann
On Wed, 08 Dec 2010 08:45:30 +0100, Alexander Reichle-Schmehl wrote: > There's patch floating arround, which has a major regression: It doesn't > work for users of self signed certificates. FWIW: As an offlineimap user I'd be very unhappy if it stopped working with my IMAP server with its self-si

Bug#603450: Is 603450 realy release critical?

2010-12-08 Thread Carsten Hey
* Bastian Blank [2010-12-08 10:37 +0100]: > On Wed, Dec 08, 2010 at 08:45:30AM +0100, Alexander Reichle-Schmehl wrote: > > #603450 is a bug (currently with severity grave, Justification: user > > security hole), as offlineimap does no ssl certificate checking. > > Could you explain why it should be

Bug#603450: Is 603450 realy release critical?

2010-12-08 Thread Alexander Reichle-Schmehl
Hi! Am 08.12.2010 10:37, schrieb Bastian Blank: > #564690 is an old example of the same problem. So is #547092 (which has severity important). And I'm sure if we dig deep enough, we can find others as well. >> There's patch floating arround, which has a major regression: It doesn't >> work fo

Bug#603450: Is 603450 realy release critical?

2010-12-08 Thread Bastian Blank
On Wed, Dec 08, 2010 at 08:45:30AM +0100, Alexander Reichle-Schmehl wrote: > #603450 is a bug (currently with severity grave, Justification: user > security hole), as offlineimap does no ssl certificate checking. Could you explain why it should be acceptable to announce secure operation but ignore

Bug#603450: Is 603450 realy release critical?

2010-12-07 Thread Alexander Reichle-Schmehl
Hi release manager, #603450 is a bug (currently with severity grave, Justification: user security hole), as offlineimap does no ssl certificate checking. While I agree, that this is a really important feature, which should be fixed, I'm wondering, if that really is release critical. There's pa