Networking change causes distribution headaches [LWN.net]

Networking change causes distribution headaches

Posted Oct 29, 2008 15:40 UTC (Wed) by nevyn (subscriber, #33129)
In reply to: Networking change causes distribution headaches by jspaleta
Parent article: Networking change causes distribution headaches

For whatever security implications the chosen quickfix has for Ubuntu users, hopefully Ubuntu will be able to put out a release day update to all users of 8.10 that addresses the issue which fixes the issue properly.

Understandably you're thinking of rpm here and not dpkg, because dpkg has no was to do "installonly" type packages the kernel has the version in the name ... thus. there's no good way to say in procps "Requires: kernel >= 2.6.27-2". They might hack it by having a dep. from the fixed kernel on the newer procps, or they might release a procps later and assume noone will install that and use the GA kernel ... but they might just leave timestamps off for 8.10.

Personally it seems like they made a poor choice, but as you point out there are other more fundamental problems ... so this one is not high on the list, IMO.

(Log in to post comments)

Networking change causes distribution headaches

Posted Oct 29, 2008 17:06 UTC (Wed) by jspaleta (subscriber, #50639) [Link]

I'm not going to pretend that I have expert knowledge with regard to dpkg.

I can only assume that the Ubuntu release team thought this through and have the ability to push an update out that reverts the quick fix when a proper fix is available and tested.

If there are security implications for turning timestamping off, then intrepid Intrepid users should probably impress on the Ubuntu devs the importance of turning timestamping on as an update as soon as possible to limit exposure...in the appropriate Ubuntu communications channel.

I'm not going to falsely stand myself up as a network security expert and make a judgement on the validity of the security concern. Even if the security implications are a valid concern, I think its reasonable for Ubuntu to use the option of having a release day update available instead of having to restart their release process to incorporate the upstream fix. As long as a release day update addresses the security implications by turning timestamping back on and integrates the proper kernel patch for the routing regression, the exposure is mitigated to the level of any security issue which requires a post release update.

-jef