[Workaround.org] Beta version of ISPmail tutorial for Squeeze ready - help me test it

Christoph Haas email at christoph-haas.de
Tue May 17 11:10:29 CEST 2011


On 17.05.2011 09:38, Philip Krasteff wrote:
> Yeah, sure. I know that. But! Sometimes, I check my server for
> vulnerabilities, with services like openvas. Also some major holes
> appear from time to time in the package versions.
 >
> For example, in Lenny (old stable), the apache version was  2.2.9-10,
> which had vulnerabilities and had to upgrade to at least 2.2.15 or
> later. However, a newer apache package 2.2.16 was available in
> lenny-backports. So if one wants to have this fixed, he should either
> install from backports, install from squeeze (testing at the time) or
> upgrade manually the package. This is a security concern... Me
> personally I don't want my server to be hacked because of vulnerable
> packages. That's why imho sometimes backports is a good decision.

Isn't that what security.debian.org is for? Even if the version number 
of a certain application appears to be vulnerable, the package 
maintainers still provide patches for their stable version.

In my opinion the opposite is rather true: if you use backports you 
don't get security updates and your server becomes vulnerable unless you 
provide the security updates yourself. There are people who run 
"testing" on their servers. But they are more likely to be hacked thatn 
servers running on "stable" plus security updates. You'd have to keep an 
eye on your servers daily to avoid that.

I just had to patch 50 Debian servers and I'm very glad that we have 
official security updates. I can't imagine how much time it would have 
been to deal with that myself manually.

Cheers
  Christoph


More information about the Workaround-chitchat mailing list