[Mageia-sysadm] [forums-discuss] Re: updating sysadmin privileges in forum config

[Marja van Waes]

On 26/03/12 18:47, Wolfgang Bornath wrote:
> 2012/3/26 Wolfgang Bornath<molch.b at googlemail.com>:
>> 2012/3/26 Wolfgang Bornath<molch.b at googlemail.com>:
>>> 2012/3/26 Marja van Waes<marja11 at xs4all.nl>:
>>>> Sorry, but I miss the knowledge you have. You have knowledge about missed
>>>> phpBB security issues that affect our forum, please report them and link to
>>>> the relevant phpBB bug fixes or attach the relevant changelogs.
>>> Anyhow I will see what I can do.
>> Just to give you an idea: there are around 150 bug fixes between the
>> version used by Mageia and the latest stable version, not counting
>> feature enhancements, new features, tasks nor subtasks::
>> http://www.phpbb.com/support/documents.php?mode=changelog&version=3
>>
>> I'm searching for a list of security related fixes but I think bug
>> fixes are already a good motivation to upgrade.
> Ok, I checked. Last security related fix was before 3.0.8 - seeing the
> sheer number of bug fixes and the general recommendation of the phpbb
> team to update because of security built an "update-friendly" habit
> here. But all the more than 150 bug fixes are just that: bug fixes.
> So, to say it in a provoking way: no need for updates = case closed.
>
Wel, it helps if people file a bug report when they suffer from those 
"normal" bugs. We don't vote for bugs in our bugzilla, but the more 
users report a bug, the more chance it gets fixed.

But even then nothing is guaranteed, because the people who fix bugs , 
push upgrades, etc. here are human beings, with limited time, 
capabilities, and so on, even security fixes sometimes don't get done 
fast, in spite of everyone doing his best.

We have a bug report (#40) about an upgrade that would fix several bugs, 
including several security fixes, some of the last were already 
mentioned in the report in august last year by the upstream maintainer.

Having the report there helps as a reminder and I'm sure upgrading will 
be done, but the report also shows that it is good to have limited 
expectations about how fast we are.

Thanks a lot, wobo, for telling that there are no security issues in our 
forum :)

Cheers,
Marja