People have mentioned glsa-check. I did look at this briefly before and it
didn't seem useful. I run it just now and the first thing I see is:
# glsa-check -l
WARNING: This tool is completely new and not very tested, so it should not be
used on production systems. It's mainly a test tool for the new GLSA release
and distribution system, it's functionality will later be merged into emerge
and equery.
So I'm supposed to be comfortable running this? There is no man page.
Secondly, I don't see how to save output from it in a way that emerge can handle.
I suppose I could pipe it through some sed expression or perl
to grab the names, but again, why should I invent something
that may eventually break and should be an option officially
built into the OS. However, it looks like the option I'd like to see
will be coming, according to the warning.
True security-only updates would require backporting of security patches.
The concept of a set of builds that are there for security reasons isn't that odd.
I'm not expecting back ports. I am only expecting to get a list of package
names that have been updated since my last "emerge -u security" (or whatever
it could be called) because of security issues, and not merely because the
version is bumped for some other reason. Why? Because it would allow me
to update only stuff that really needs it, not merely to get the bleeding edge
release of the week.
No offence but if you have 3 computers it doesn't sound like a nuclear power station or a credit card company. Someone could use a security risk in Tux Racer to take over my system but who basically can be bothered. The world would not end if they did.
Regarding my want of stable. I don't have to be running a credit card business
or nuclear power plant to desire protection of my system. My work is there,
and my personal communication is there, and I want to preserve and protect it.
I have as much right to that as any user.
Secondly, I take a dim view of users who do not secure their systems and
allow them to become virus/spam/ddos zombies. I don't want my system
to be used for evil purposes just because I was lazy about security.
You could basically go on for ever. Who would maintain these? If it is business critical to you and other people then you could cough up some money for it I suppose.
Does Debian expect users to pay for security only updates? The concept of
the costs involved is false. You already have the information in glsa - its just
a matter of building in the hooks with emerge. The warning I quoted
makes it sound like this is on the way.
Running 'portlog-info --since=xx' after a bunch of emerges simply makes good sense - it should be added to gentoolkit ASAP.
I agree. I'll run it when it is available. Until then, I don't want to add a layer of
complication by starting to rely on something that isn't official and isn't being maintained.
I've been there before.
If this does not work for you, DO NOT USE GENTOO, and do not complain about it.
I don't think Gentoo developers really feel this way.
Why are they asking for email on how Gentoo is being used?
Why did they run a user survey to see how Gentoo is being used and what
requests users have? My criticism is constructive criticism. It can be used
to make Gentoo better.
I said it before, after the user survey: if other distros discovered that only
18% of users have their flavour of Linux deployed in a production role,
I think they would freak out. Reading this as a lack of interest is
the wrong interpretation. It is like Canon saying that only 2% of its
customers use Linux. Perhaps if Canon had driver support for
their printers and scanners then 10% of their customers would
be Linux users - they can't really know until after they have built
the support. Likewise, if Gentoo was lower maintenance, and had
better QA on stable, perhaps the percentage used as production servers
would rocket upward.
) is less than 5 minutes a week.
