Re: [gentoo-amd64] backups and world updates

[Matt Randolph <mattr@erols.com>]

Roy Wright wrote:

> Most of the time, I just open an konsole and do the
> update.  Occasionally I'll postpone if the update looks
> really large or time consuming.  For major gui components
> like KDE or xorg, I'll exit KDE and emerge from the
> command line over the weekend (ok, probably overly
> cautious, but I was burned once).


I have emerged kde and xorg-x11 from within kde without any problems.  I 
was even emerging firefox while surfing the web.  I probably played some 
Doom III too.

> Occasionally I'll get a blocking condition.  I really think
> twice now before just unblocking via package.keywords.
> I've found that waiting a day or two might result in
> portage handling the unblocking.

Firefox is a good example.  When mozilla-firefox-1.0.5 came out in ~arch 
in response to a GLSA, it hit +arch within the next 24-36 hours, if I 
recall.  I would just "ACCEPT_KEYWORDS='~amd64' emerge -a 
mozilla-firefox" in these situations rather than messing with 
package.keywords.  Then, I'd just keep an eye out for new stable 
packages and emerge them as appropriate.  If you unblock via 
package.keywords you will be resigning yourself to always using a 
testing version, thus exposing yourself to more new bugs than if you 
stayed in stable. 

However, if you simply wait a day or two, you are leaving yourself 
susceptible to exploits for that entire time.  Think about how many 
spams arrive in thunderbird in that amount of time.  It would only take 
one hastily written spam exploiting the right vulnerability and then 
POW!  As unlikely as that may be, I'd rather install security updates 
the very instant I find out about them instead.

-- 
"Pluralitas non est ponenda sine necessitate" - W. of O.

-- 
gentoo-amd64@gentoo.org mailing list