main inclusion report

[Fabio Massimo Di Nitto]

Binary package hint: snort

See https://wiki.ubuntu.com/MainInclusionReportSnort

I am against including this package into main but i need to file the report as I was asked too. IMHO this package requires too much maintaince and it's not mature enough to hit main.

Fabio

[Matthias Klose (doko)]

ubuntu-security: is this package maintainable by the security team?

[Matthias Klose (doko)]

new upstream 2.8.0.1 available (Nov 2007)

[Kees Cook (kees)]

Given that the Debian package has finally caught up with upstream, this is much easier to maintain from a security perspective. The snort devs are quick to respond to issues.

[Kees Cook (kees)]

That said, maintaining it for LTS may prove challenging, given how many binary parsers it contains. Unless there is a strong need for it to be in main, I would rather it stay in universe.

[Matthias Klose (doko)]

> Given that the Debian package has finally caught up with upstream,
> this is much easier to maintain from a security perspective.

so you do have a preference for the 2.7.0 version? In that case we should the current version from debian, including fixes for the lsb init functions (independent of main inclusion).

In the case of promotion, a mir for libprelude is missing, plus the gs-common b-dep has to be replaced.

[Nick Barcet (nijaba)]

I will not fight over snort to be in main if it is a real pain to maintain it from a security perspective, but just want to note that
- it is a maintained package in RHEL5
- and I do think that IDS is quite a usefull feature for security conscious admins...

That said, I'll let the security team decide what is more appropriate for it.

[Martin Pitt (pitti)]

By Kees' comment 3 I am rejecting this, at least for LTS.