Skip site navigation (1) Skip section navigation (2)

Re: Purge obsolete security updates?

From: Magnus Hagander <magnus(at)hagander(dot)net>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: Josh Berkus <josh(at)agliodbs(dot)com>, "w^3" <pgsql-www(at)postgresql(dot)org>
Subject: Re: Purge obsolete security updates?
Date: 2011-02-01 06:37:28
Message-ID: AANLkTi=B-hsXW4s_1z93_w+WwQ9QW0Kbs1ERY+gTSTpT@mail.gmail.com (view raw or flat)
Thread:
Lists: pgsql-www
On Tue, Feb 1, 2011 at 01:08, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> Josh Berkus <josh(at)agliodbs(dot)com> writes:
>> ... currently has security patch information going back to 2004.  I'd
>> like to cut everything which only applies through version 8.0 as
>> obsolete.  This would mean cutting all notices starting with
>> CVE-2006-0678.
>
>> Further, I'd like to make a general policy that we cut security
>> information from this page a year after the last referenced version goes
>> EOL (e.g. we'd delete CVE-2006-5542 this November).
>
> -1 on both.  The fact that we're not releasing new updates for old
> versions is miles away from suppressing information about them.
> Furthermore, having those notices up there might help to spur people to
> update off those versions, which is what we really want.  If we remove
> all the old notices it is likely to leave the impression "hey, 7.4 is
> much more bug-free than the newer versions, so I should stay on it".
>
> If anything, I'd like to see us *add* the older versions to the newer
> notices when relevant.  We want people to realize that these holes exist
> and are unfixed in old branches, not think they're secure.

Agreed. However, moving them to a separate page and put a prominent
note saying "security advisories for no-longer supported releases are
archived here" or something like that seems like a reasonable
compromise.

-- 
 Magnus Hagander
 Me: http://www.hagander.net/
 Work: http://www.redpill-linpro.com/

In response to

Responses

pgsql-www by date

Next:From: Robert HaasDate: 2011-02-01 14:14:56
Subject: Re: Purge obsolete security updates?
Previous:From: Tom LaneDate: 2011-02-01 00:08:30
Subject: Re: Purge obsolete security updates?

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group