Secure testing commits - Aug 2012 - r20020 - data

Author: geissert
Date: 2012-08-24 20:14:52 +0000 (Fri, 24 Aug 2012)
New Revision: 20020

Modified:
   data/package-tags
Log:
Update the secteam tags for wheezy


Modified: data/package-tags
==================================================================---
data/package-tags	2012-08-24 16:30:01 UTC (rev 20019)
+++ data/package-tags	2012-08-24 20:14:52 UTC (rev 20020)
@@ -1,39 +1,40 @@
 # In this file we keep the debtags for packages in "main"
 # where special conditions apply
 
-[lenny] kfreebsd-6 <unsupported> (FreeBSD not yet supported)
-[lenny] kfreebsd-7 <unsupported> (FreeBSD not yet supported)
-
-[lenny] sql-ledger <limited-support> (Only supported behind an
authenticated HTTP zone)
+[wheezy] sql-ledger <limited-support> (Only supported behind an
authenticated HTTP zone)
 [squeeze] sql-ledger <limited-support> (Only supported behind an
authenticated HTTP zone)
 
-[lenny] php5 <limited-support> (See README.Debian.security for the PHP
security policy)
+[wheezy] php5 <limited-support> (See README.Debian.security for the PHP
security policy)
 [squeeze] php5 <limited-support> (See README.Debian.security for the PHP
security policy)
 
-[lenny] adns <limited-support> (Stub resolver that should only be used
with trusted recursors)
+[wheezy] adns <limited-support> (Stub resolver that should only be used
with trusted recursors)
 [squeeze] adns <limited-support> (Stub resolver that should only be used
with trusted recursors)
 
-[lenny] ltp <limited-support> (Testsuite, only supported on
non-production non-multiuser systems)
+[wheezy] ltp <limited-support> (Testsuite, only supported on
non-production non-multiuser systems)
 [squeeze] ltp <limited-support> (Testsuite, only supported on
non-production non-multiuser systems)
 
-[lenny] clamav <unsupported> (No signature updates anymore, should be
taken from volatile)
-
 [sid] kompozer <unsupported> (vulnerable to all xulrunner issues, but
intended use is not for untrusted or networked sources)
 [squeeze] kompozer <unsupported> (vulnerable to all xulrunner issues, but
intended use is not for untrusted or networked sources)
+[wheezy] kompozer <unsupported> (vulnerable to all xulrunner issues, but
intended use is not for untrusted or networked sources)
 
-[lenny] ocsinventory-server <limited-support> (Only supported behind an
authenticated HTTP zone)
+[wheezy] ocsinventory-server <limited-support> (Only supported behind an
authenticated HTTP zone)
 [squeeze] ocsinventory-server <limited-support> (Only supported behind an
authenticated HTTP zone)
 
-[lenny] wireshark <limited-support> (Not suitable for network monitoring
/ intrusion detection, DoS issues fixed with low priority through point updates)
+[wheezy] wireshark <limited-support> (Not suitable for network monitoring
/ intrusion detection, DoS issues fixed with low priority through point updates)
 [squeeze] wireshark <limited-support> (Not suitable for network
monitoring / intrusion detection, DoS issues fixed with low priority through
point updates)
 
-[lenny] acidbase <limited-support> (Only supported behind an
authenticated HTTP zone for trusted users)
+[wheezy] acidbase <limited-support> (Only supported behind an
authenticated HTTP zone for trusted users)
 [squeeze] acidbase <limited-support> (Only supported behind an
authenticated HTTP zone for trusted users)
 
-[lenny] glpi <limited-support> (Only supported behind an authenticated
HTTP zone for trusted users)
+[wheezy] glpi <limited-support> (Only supported behind an authenticated
HTTP zone for trusted users)
 [squeeze] glpi <limited-support> (Only supported behind an authenticated
HTTP zone for trusted users)
 
-[lenny] memcached <limited-support> (Attacks that require an attacker to
be able to access the memcached port/sock are not supported, it''s
running as nobody and in a typical setup attackers don''t have access to
this)
+[wheezy] memcached <limited-support> (Attacks that require an attacker to
be able to access the memcached port/sock are not supported, it''s
running as nobody and in a typical setup attackers don''t have access to
this)
 [squeeze] memcached <limited-support> (Attacks that require an attacker
to be able to access the memcached port/sock are not supported, it''s
running as nobody and in a typical setup attackers don''t have access to
this)
 
-[lenny] webkit <unsupported> (very old version with no frontend
that''s not supported upstream, but a few reverse dependencies that make
it impossible to remove)
+[wheezy] webkit <unsupported> (not properly supported upstream, only for
use on trusted content)
+
+[squeeze] libkhtml5 <unsupported> (not properly supported upstream, only
for use on trusted content)
+[wheezy] libkhtml5 <unsupported> (not properly supported upstream, only
for use on trusted content)
+
+[wheezy] libqtwebkit4 <unsupported> (not properly supported upstream,
only for use on trusted content)

On Fri, Aug 24, 2012 at 4:14 PM, Raphael Geissert wrote:
> -[lenny] webkit <unsupported> (very old version with no frontend
that''s not supported upstream, but a few reverse dependencies that make
it impossible to remove)
> +[wheezy] webkit <unsupported> (not properly supported upstream, only
for use on trusted content)
> +
> +[squeeze] libkhtml5 <unsupported> (not properly supported upstream,
only for use on trusted content)
> +[wheezy] libkhtml5 <unsupported> (not properly supported upstream,
only for use on trusted content)
> +
> +[wheezy] libqtwebkit4 <unsupported> (not properly supported
upstream, only for use on trusted content)
I think the vast majority of webkit users have no clue that their
usage should not involve untrusted content.  If we really expect them
not to use the webkit browsers as actual web browsers, then we really
need a very visible way to tell them not to do that (perhaps a very
loud debconf message?).  Also, epiphany, konqueror, midori, etc.
should not be in any of the default tasks (I haven''t checked this yet,
so this may already be the case, but I doubt it).

Best wishes,
Mike

Michael Gilbert wrote:
> I think the vast majority of webkit users have no clue that their
> usage should not involve untrusted content.  If we really expect them
> not to use the webkit browsers as actual web browsers, then we really
> need a very visible way to tell them not to do that (perhaps a very
> loud debconf message?).  Also, epiphany, konqueror, midori, etc.
> should not be in any of the default tasks (I haven''t checked this
yet,
> so this may already be the case, but I doubt it).
The wheezy release notes already mention it. Feel free to attempt to do 
something more visible by discussing it in -devel.

(I think both the gnome and kde tasks pull in epiphany and konqueror, 
respectively. At least a recent install of the gnome desktop did.)

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net