[gentoo-dev] Re: New item for sys-kernel/hardened-sources removal

[Duncan <1i5t5.duncan@cox.net>]

Michał Górny posted on Sun, 20 Aug 2017 09:53:54 +0200 as excerpted:

> W dniu nie, 20.08.2017 o godzinie 00∶39 -0500, użytkownik R0b0t1
> napisał:
>> 
>> The discussion is nice but no one has actually touched on the
>> technical merits of removing the packages besides "they are old."

>> So I ask again: On what basis are the hardened sources being removed
>> from the tree?
> 
> Old kernel versions are a natural vulnerability targets. Even if they
> are not vulnerable at the moment, they surely will be soon enough.

This.

Hardened-sources isn't just some generic package, where perhaps masking 
it as vulnerable but leaving it in the tree for those wishing to use it 
for its primary purpose /despite/ vulns, might arguably be justified.

In this case, that "primary purpose" *is* resistance to attack, and 
leaving old and now unsupported versions in the tree when they're 
guaranteed to be increasingly vulnerable to new attacks is simply 
irresponsible, with no logical argument that can be made otherwise, thus 
the removal.

Were it any other package, with any other primary purpose... but it's not.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman