Re: that webmin port

[Michael Knudsen <mk267673@but.auc.dk>]

On Sun, May 05, 2002 at 05:00:11PM +0200, Marc Espie wrote:
> It's not a question whether it's useful for borderline cases where people
> will use it on private nets where everyone is a loving bunny.
> 
> It's a question whether we have an app in our ports tree that is a
> complete security disaster, and that *will* fuck beginners thoroughly.
> 
> So, don't try convincing me webmin is useful. I don't care. I only care
> about its security.  Make it work, persuade me it can be installed
> securely, can be coerced to use ssl and not work in non-ssl mode, 
> to be made to work with apache without needing to install everything setuid, 
> and has no actual holes, and I will keep it in the tree.
> 
> If you can't, tough luck. Down the drain it goes.

That is the right thing to do -- especially for the
majority. Borderline arguments are not interinsting and should not be
considered when evaluating ports.

I _could_ do an audit, but I seem to remember that Webmin is a bunch
of Perl scripts, and I have very little experience with Perl, and less
with security audits of it, so I don't I'd come up with a useful
conclusion.

Besides, Webmin isn't really the BSD way to do things. =)

Michael.
-- 
Rumour is information distilled so finely that it can filter through
anything.
-- (Terry Pratchett, Feet of Clay)