[gentoo-dev] Re: [gentoo-security] GLEP #14: security updates based on GLSA

[James Harlow <james@is.never.wrong.nu>]

On Fri, Aug 22, 2003 at 07:19:39PM +0200, Marius Mauch wrote:
> Hi all,
>
> As already discussed here serveral days ago I've written up a GLEP for
> this often requested feature:
>
> http://www.gentoo.org/proj/en/glep/glep-0014.html
>
> Everything in the GLEP is open for discussion, please share your
> questions/comments/concerns with the other people on this list, so
> that
> they can be incorporated. I'll update the GLEP if necessary, so make
> sure you read the latest version before posting.

I think the glep itself is really good, and my python's not good enough
to critique the tool. So this is all about the DTD.

It would be nice if the solution and the command became mandatory, and
the command was formatted so that it could be run with /bin/sh.

It's also my feeling that the exploit element should become an attribute
so it can be checked - for example, if I'm writing a tool to secure a
firewall while I'm on holiday, it would be essential to update remote
holes, but less essential to update local holes.

And lastly and cosmetically, dates are normally represented as a 
day/month/year structure. In the version element, I think that you 
should get rid of the including attribute and extend the range attribute
with greater-or-equal / less-than-or-equal. It's just my feeling that 
this will create more readable xml documents...

> Marius

james.

-- 
When a true genius appears in the world, you may know him by this sign, that the dunces are all in confederacy against him. - Jonathan Swift

--
gentoo-dev@gentoo.org mailing list