Re: Debian/Ubuntu php_crypt_revamped.patch

[Michael Gilbert <mgilbert () debian org>]

On Fri, May 4, 2012 at 2:18 PM, Daniel Kahn Gillmor wrote:
> On 05/04/2012 01:35 PM, Solar Designer wrote:
> > The purpose [is] to notify Ubuntu and others of the Debian bug
> > that they may need to fix in Debian-derived distros, and to suggest that
> > the patch be dropped from future versions.
>
> If your goal is to get the patch dropped from Debian and Debian-derived
> distributions, the most reliable way to do that is to file a bug against
> the Debian php packages explaining your reasons for that.

Security issue reporters are usually not held responsible for
reporting the issues that they find to every affected distribution
themselves.  That is why common id numbers (CVEs) are important.  They
give us a common reference for every problem.  Then its the job of
those of us representing such distributions to pass the information on
to the appropriate tracking systems within our own focus areas.

Best wishes,
Mike