Allan McRae, an Arch Linux developer and pacman maintainer, writes about packaging, toolchains, and Arch Linux releases.
HN links his posts on pacman package signing, security issue handling in distributions like Manjaro, and debate over what defines Arch Linux.
But can we still have the CV numbers as well please.
"The security community refers to vulnerabilities by numbers, not names. This does have some advantages, like precision and the ability to Google them and get meaningful results all of the time"
I wish everyone embedded a Dewey Decimal number into their factual pages. Would be ace.
"I saw some kvetching on Twitter to the effect that the logo designer heard about Heartbleed before the distribution maintainers at e.g. Ubuntu and RedHat did."
Updates for Debian and CentOS landed within hours. Would have been nice to have them as we read the page.
Interestingly nothing (apparent) for Manjaro yet. Manjaro is a staged version of Arch which I have installed on a test machine to sample Gnome 3.12 when it lands in the repository a week or so.
[keith@mocha ~]$ openssl version
OpenSSL 1.0.1f 6 Jan 2014
Sort of ties in with
http://allanmcrae.com/2013/01/manjaro-linux-ignoring-security-for-stability/
perhaps. I get the impression that Manjaro (and other similar client OSes) are mainly for end users and not on servers.
Allan McRae (pacman developer) done some good writing about the signing package of Pacman on his blog, in three parts.
- http://allanmcrae.com/2011/08/pacman-package-signing-1-makepkg-and-repo-add/
- http://allanmcrae.com/2011/08/pacman-package-signing-2-pacman-key/
- http://allanmcrae.com/2011/08/pacman-package-signing-3-pacman/
Interesting discussions on it at: http://tinyurl.com/2cepr72 and http://tinyurl.com/25pgqql
More in-depth post at: http://allanmcrae.com/2010/10/big-python-transition-in-arch-linux/
Seems there's not a lot of uproar or cheering on it (though it depends on who's doing the posting.)
Manjaro had a rather… iffy relationship with developing a security mindset in the past: http://allanmcrae.com/2013/10/comparison-of-security-issue-handling/
It appears they're not learning.
Allen McRae had an interesting, relvant post recently- "Are We Removing What Defines Arch Linux?"
http://allanmcrae.com/2012/08/are-we-removing-what-defines-arch-linux/
Package signing is in the works: http://allanmcrae.com/2011/08/pacman-package-signing-3-pacman/