Re: [SECURITY] [DSA 2134-1] Upcoming changes in advisory format

2010-12-19 Thread Jonathan Corbet
On Sun, 19 Dec 2010 12:18:04 +0100 Moritz Muehlenhoff wrote: > On 2010-12-19, Vagrant Cascadian wrote: > > > will new advisories be in a machine parseable format? > [...] > > We're open for input here. Everyone is invited to send a list of needed > features to t...@security.debian.org. FWIW, D

Re: [SECURITY] [DSA 2134-1] Upcoming changes in advisory format

2010-12-19 Thread Michael Gilbert
On Sat, 18 Dec 2010 16:47:47 -0800 Vagrant Cascadian wrote: > will it include a list of affected binary packages (in addition to source > packages)? Just as a point of reference, you can use the debsecan package (or the security-tracker site [0]) right now to determine whether various package ver

Re: [SECURITY] [DSA 2134-1] Upcoming changes in advisory format

2010-12-19 Thread Moritz Muehlenhoff
On 2010-12-19, Vagrant Cascadian wrote: > On Sat, Dec 18, 2010 at 01:08:07PM +0100, Moritz Muehlenhoff wrote: >> Traditionally Debian security advisories have included MD5 check sums >> of the updated packages. This was introduced at a time when apt didn't >> exist yet and BIND was at version 4. >

Re: [SECURITY] [DSA 2134-1] Upcoming changes in advisory format

2010-12-19 Thread Martin Zobel-Helas
Hi, On Sat Dec 18, 2010 at 16:47:47 -0800, Vagrant Cascadian wrote: > On Sat, Dec 18, 2010 at 01:08:07PM +0100, Moritz Muehlenhoff wrote: > > Traditionally Debian security advisories have included MD5 check sums > > of the updated packages. This was introduced at a time when apt didn't > > exist

Re: [SECURITY] [DSA 2134-1] Upcoming changes in advisory format

2010-12-18 Thread Vagrant Cascadian
On Sat, Dec 18, 2010 at 01:08:07PM +0100, Moritz Muehlenhoff wrote: > Traditionally Debian security advisories have included MD5 check sums > of the updated packages. This was introduced at a time when apt didn't > exist yet and BIND was at version 4. > > Since apt cryptographically enforces the i