From: Bruce Momjian <pgman@candle.pha.pa.us>
Message-Id: <200511251720.jAPHKN412761@candle.pha.pa.us>
Subject: Re: BUG #2052: Federal Agency Tech Hub Refuses to Accept
In-Reply-To: <1132827194.4347.27.camel@localhost.localdomain>
To: Simon Riggs <simon@2ndquadrant.com>
Date: Fri, 25 Nov 2005 12:20:23 -0500 (EST)
CC: Tom Lane <tgl@sss.pgh.pa.us>, Stephen Frost <sfrost@snowman.net>,
	pgsql-hackers@postgresql.org, Ferindo Middleton <fmiddleton@verizon.net>,
	pgsql-bugs@postgresql.org
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII

Simon Riggs wrote:
> On Fri, 2005-11-18 at 09:32 -0500, Tom Lane wrote: 
> > All known CVE problems are resolved in 8.0.4.
> 
> I was unaware of this. I've looked at the release notes and searched the
> archives, but this doesn't seem to be mentioned by CVE number. (The
> vulnerabilities and their resolutions are described, just without direct
> cross reference to their CVE number.)
> 
> Do we have an on-project description of this? If we-as-a-project know
> this, it seems straightforward to write it down.
> 
> It seems like we need a much clearer resource for security admins to
> check our compliance levels. This could be a source of similar
> refusal-to-implement PostgreSQL at other installations, so could almost
> be regarded as an advocacy issue. Other software projects have been
> criticized badly for their security response and info dissemination - I
> don't believe that applies here, but it does indicate the general
> requirement and its priority. i.e. don't just fix the bugs, tell
> everyone you've fixed the bugs.
> 
> Or, at very least, put stronger security warnings onto the releases. (My
> own advice is always to watch for announcements and stay current).

Well, as the original poster mentioned, they were looking for a reason
_not_ to use PostgreSQL, and if that is the goal, you can find a reason,
error numbers or not.

I am not excited about referencing error numbers from someone else.  We
know our errors better than anyone else, so I don't see the point.

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 359-1001
  +  If your life is a hard drive,     |  13 Roberts Road
  +  Christ can be your backup.        |  Newtown Square, Pennsylvania 19073