Security bugs are reported here via bugzilla

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

On Wed, Apr 13, 2005 at 10:28:54AM -0700, Seth Alan Woolley wrote:
> ----- Forwarded message from sm-security-owner AT lists.ibiblio.org -----
> 
> I patched this sucker a few times already (ie -pl3).
> 
> Maybe we need to put a SECURITY file on it that says use at your own 
> risk.

SECURITY files, although well intentioned, can be percieved as insulting
from the package authors. Take care to be diplomatic and stay factual if
you add one, perhaps cite all the previous vulnerabilities so it doesnt
look like a random unbased rant about the security of their tool.

Im sure Im preaching to the choir on this though, just my 2 cents.

-Andrew


-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    | acedit at armory.com        |
|Sorcery Team Lead                         | ftp://t.armory.com/         |
--------------------------------------------------------------------------

Attachment: pgpMohKSPWPO4.pgp
Description: PGP signature