Rahul Sundaram wrote:
While the review guidelines do make sure that the source code matches upstream¹, that doesn't ensure that upstream doesn't have backdoors, holes, malicious content, etc.That's a totally different question IMO. We at the distribution level can only check whether there is a packaging level attempt at introducing a security hole. Doing a complete security audit of all the code that is being included is not feasible at all at the distribution level. This btw, has nothing to do with RPM or any other packaging method. All distributions work on the principle that upstream projects are responsible at the code level for their own security. We can add things like compiler options and firewalls but that doesn't prevent a upstream security hole from being exploited, whether introduced accidentally or not.
Okay is there any software written specifically for Fedora? KDE gadgets, or such?
If so, then I guess we should monitor it at the distribution level. STF ======================================================================= http://eisenbits.homelinux.net/~stf/ OpenPGP: 9D25 3D89 75F1 DF1D F434 25D7 E87F A1B9 B80F 8062 =======================================================================
Attachment:
signature.asc
Description: OpenPGP digital signature
-- fedora-list mailing list fedora-list@xxxxxxxxxx To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
