Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: Review Request: phpBB - A php Bulletin Board

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191968

------- Additional Comments From paul@city-fan.org 2006-05-16 12:45 EST ------- See also Bug #188410 for discussion on this application.

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: Review Request: phpBB - A php Bulletin Board

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191968

------- Additional Comments From imlinux@gmail.com 2006-05-16 13:36 EST ------- I thought I saw this before. I can't find anything in bugzilla I swear....

Anyway, if it's the general will of Extras to keep this out then I'll close this like the last one. I don't think there's strong enough arguements on either side that says this absolutely should or shouldn't be in extras. My take on it is that if Fedora users want to use it, it would be nice if they used extras where it will always be updated. That's the nice thing about yum and our package management system. They don't have to keep tabs on what phpBB is doing or if a new version has come out in order to have an up to date system. They only have to run "yum update"

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: Review Request: phpBB - A php Bulletin Board

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191968

------- Additional Comments From imlinux@gmail.com 2006-05-16 14:33 EST ------- Sounds good to me. I'll be the first to admit that phpBB has done a lot of harm on the net, but I don't think that it means we shouldn't package it. Lots of people use it (including myself).

Is there a way to have multiple maintainers get notified when a bug gets submitted? As long as the contributors in question make sure to assign the bug to themselves when they start working on it I don't think people would step on eachothers toes much.

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: Review Request: phpBB - A php Bulletin Board

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191968

------- Additional Comments From tibbs@math.uh.edu 2006-05-16 14:42 EST ------- Damn mid-air collisions.....

I don't really understand why Peter gave up on the original review request; phpBB is commonly used and I fully agree with Mike that having automated updates coming from a trusted source should be far better for overall security than requiring every single admin to watch for updates and manually apply them.

I do think that this should be blocked until the current minor issues open on 2.0.20 are closed. (There's a full path disclosure and I think one other issue that I can't recall at the moment.)

My real concern is for the feasibility of doing automated upgrades. I look after a small phpBB setup and while the procedure for me is simple because I don't run any mods, it's never as simple as just replacing the files. How is that going to be handled by the package? If we're going to put this into extras, we can't be afraid to push updates quickly and admins need to trust that those updates will work (else they'll just not update the package at all).

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: Review Request: phpBB - A php Bulletin Board

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191968

------- Additional Comments From tibbs@math.uh.edu 2006-05-16 15:09 EST ------- I don't think that's wise; I can't think of any other instance of a package doing that.

One additional thought is that we can get the big heads together and figure out the proper selinux policies to contain the impact of potential vulnerabilities. (Or is that even reasonable? I'm no selinux expert, but I try not to turn it off at the first sign of trouble.)

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: Review Request: phpBB - A php Bulletin Board

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191968

------- Additional Comments From peter@thecodergeek.com 2006-05-16 17:10 EST ------- Jason: I "gave up" originally because it seemed that it would be better to wait until we could have multiple maintainers for it (at least) so that any security issues could be fixed quickly.

With respect to modifications made by the user, I think that it therefore becomes his or her perogative to keep the phpBB install updated. I see this issue as similar to that of other packages: the user is free to modify it from its original packaging, but only that packaging is supported from the people who maintain it (be it one or more of Red Hat's engineers or others who maintain Extras stuff).

If there is an update script or similar that needs to be run, could we potentially automate this enough to put it into the %post section ok?

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: Review Request: phpBB - A php Bulletin Board

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191968

imlinux@gmail.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution| |NOTABUG

------- Additional Comments From imlinux@gmail.com 2006-11-07 09:25 EST ------- Sorry guys, I am conflicted about this particular package and since I don't use it any more I'm closing it so someone else can take it up if they need to. This will be the second time this package hasn't made it into extras.