Quoting Marcus Meissner :

We are sorry for any inconvience caused. We try to have the best quality for security updates, but unfortunately due to sheer mass of updates sometimes mistakes slip through our Quality Assurance.

We have been and will be constantly improving our processes to avoid such mistakes in the future and are committed to provide the best service possible.

Now I'm *REALLY* annoyed. This is suse-security, not your press release forum. This sort of market-speak drivel only makes you look incompetent. Save the "constantly improving our processes" and "commited to provide the best service" for the suits. We're sysadmins here. We want results. If you want us to cut you some slack, give us real information. Most of us are really laid back people. Talk to us like professionals and we'll give you every chance. Just don't give us marketing drivel.

Quoting Marcus Meissner :

Ok, translated I want to say:

"Yes, we fucked up. We try harder not to fuck up in the future." :)

is this satisfyingly techy enough ? :)

Fixed spamassassin updates are going out as I am writing this mail.

*MUCH* better! Speak to us like human beings and we'll be on your side every time...

Hi, to add my 2 cents to the discussion about bad update-quality - I'm also not satisfied the way it works in the last months. And as it is a fact, that there where many problems especially with kernel-updates in the last time it'd be a good idea for suse to not uninstall the old kernel and delete it's config but to add the new kernel as default and leave the old one as fallback on the system. It's not that we can't help ourselfs if spamassasin or tripwire are broken, but updating a kernel on a remote SuSE-system these days requires some delight in risk. Greetings, Ralf

Mike, I just installed the newest kernel in my SuSE professional 8.0 so, I tried to see if the last kernel was there... These are the results: Superman:~ # uname -a Linux Superman 2.4.21-231-default #1 Mon Jun 28 15:39:34 UTC 2004 i686 i686 i386 GNU/Linux Superman:~ # cd /boot Superman:/boot # ls -lart total 3744 -rw-r--r-- 1 root root 80324 Sep 23 2003 memtest.bin -rw-r--r-- 1 root root 64824 Sep 23 2003 message lrwxrwxrwx 1 root root 1 Apr 8 07:11 boot -> . drwxr-xr-x 2 root root 496 Apr 8 07:22 grub -rw-r--r-- 1 root root 512 Apr 8 07:22 backup_mbr drwxr-xr-x 23 root root 560 Jul 21 11:30 .. -rw-r--r-- 1 root root 52328 Aug 12 10:21 config-2.4.21-243-default -rw-r--r-- 1 root root 134396 Aug 12 10:22 Kerntypes-2.4.21-243-default -rw-r--r-- 1 root root 630824 Aug 12 10:26 System.map-2.4.21-243-default -rw-r--r-- 1 root root 1187139 Aug 12 10:26 vmlinuz-2.4.21-243-default -rw-r--r-- 1 root root 1411413 Aug 12 11:02 vmlinux-2.4.21-243-default.gz lrwxrwxrwx 1 root root 26 Aug 18 14:09 vmlinuz -> vmlinuz-2.4.21-243-default -rw-r--r-- 1 root root 250592 Aug 18 14:09 initrd-2.4.21-243-default lrwxrwxrwx 1 root root 25 Aug 18 14:09 initrd -> initrd-2.4.21-243-default drwxr-xr-x 3 root root 520 Aug 18 14:09 . Superman:/boot # rpm -qa | grep -i kernel kernel-source-2.4.21-243 kernel-docs-2.4.21-99 It seems to me as if the last kernel upgrade (2.4.21-243) successfully uninstalled the kernel version I am currently running (2.4.21-231). Notice that since all the notices about problems with the new kernel, I have not rebooted yet... Am I missing something? Best regards, Erick Sanz

-----Original Message----- From: Mike Rose [mailto:mr349@cam.ac.uk] Sent: Wednesday, August 25, 2004 10:40 AM To: Ralf Ronneburger Cc: suse-security@suse.com Subject: Re: [suse-security] Bad quality of updates from SuSE ftp server

When using: rpm -ivh kernel-whatever.rpm

you get: ls -l /boot/*previous* lrwxrwxrwx 1 root root 27 Aug 5 09:59 /boot/initrd.previous -> ./initrd-2.6.5-7.75-default lrwxrwxrwx 1 root root 28 Aug 5 09:59 /boot/vmlinuz.previous -> ./vmlinuz-2.6.5-7.75-default

If you are using grub then a simple bit of editing of /boot/grub/menu.lst something like this: " # color white/blue black/light-gray default 0 timeout 10

title Linux kernel (hd0,0)/boot/vmlinuz root=/dev/hda1 vga=0x317 splash=silent acpi=off desktop resume=/ dev/hda2 showopts initrd (hd0,0)/boot/initrd

title Previous Kernel kernel (hd0,0)/boot/vmlinuz.previous root=/dev/hda1 vga=0x317 splash=silent acpi=off desktop resume=/dev/hda2 showopts initrd (hd0,0)/boot/initrd.previous

title No ACPI, APM, DMA or resume kernel (hd0,0)/boot/vmlinuz root=/dev/hda1 showopts ide=nodma apm=off acpi=off vga=normal no resume nosmp noapic maxcpus=0 3 initrd (hd0,0)/boot/initrd "

and you now have the previous kernel available.

Mike Rose TCM & Biological Physics Computer Officer University of Cambridge http://www.bio.phy.cam.ac.uk/ http://www.tcm.phy.cam.ac.uk/

On Wed, 25 Aug 2004, Ralf Ronneburger wrote:

...

Hi,

to add my 2 cents to the discussion about bad update-quality - I'm also not satisfied the way it works in the last months. And as it is a fact, that there where many problems especially with kernel-updates in the last time it'd be a good idea for suse to not uninstall the old kernel and delete it's config but to add the new kernel as default and leave the old one as fallback on the system. It's not that we can't help ourselfs if spamassasin or tripwire are broken, but updating a kernel on a remote SuSE-system these days requires some delight in risk.

Greetings,

Ralf

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

Mike, I installed via YaST... It sounds like I should download and install by hand... Is that correct? Best regards, Erick Sanz

-----Original Message----- From: Mike Rose [mailto:mr349@cam.ac.uk] Sent: Wednesday, August 25, 2004 11:02 AM To: Sanz family Cc: Ralf Ronneburger; suse-security@suse.com Subject: RE: [suse-security] Bad quality of updates from SuSE ftp server

I'm using Suse9.1, so maybe things have changed??

How did you install your new kernel??

Mike Rose TCM & Biological Physics Computer Officer University of Cambridge http://www.bio.phy.cam.ac.uk/ http://www.tcm.phy.cam.ac.uk/

On Wed, 25 Aug 2004, Sanz family wrote:

...

Mike,

I just installed the newest kernel in my SuSE professional 8.0 so, I tried to see if the last kernel was there...

These are the results:

Superman:~ # uname -a Linux Superman 2.4.21-231-default #1 Mon Jun 28 15:39:34 UTC

...

i386 GNU/Linux Superman:~ # cd /boot Superman:/boot # ls -lart total 3744 -rw-r--r-- 1 root root 80324 Sep 23 2003 memtest.bin -rw-r--r-- 1 root root 64824 Sep 23 2003 message lrwxrwxrwx 1 root root 1 Apr 8 07:11 boot -> . drwxr-xr-x 2 root root 496 Apr 8 07:22 grub -rw-r--r-- 1 root root 512 Apr 8 07:22 backup_mbr drwxr-xr-x 23 root root 560 Jul 21 11:30 .. -rw-r--r-- 1 root root 52328 Aug 12 10:21 config-2.4.21-243-default -rw-r--r-- 1 root root 134396 Aug 12 10:22 Kerntypes-2.4.21-243-default -rw-r--r-- 1 root root 630824 Aug 12 10:26 System.map-2.4.21-243-default -rw-r--r-- 1 root root 1187139 Aug 12 10:26 vmlinuz-2.4.21-243-default -rw-r--r-- 1 root root 1411413 Aug 12 11:02 vmlinux-2.4.21-243-default.gz lrwxrwxrwx 1 root root 26 Aug 18 14:09 vmlinuz -> vmlinuz-2.4.21-243-default -rw-r--r-- 1 root root 250592 Aug 18 14:09 initrd-2.4.21-243-default lrwxrwxrwx 1 root root 25 Aug 18 14:09 initrd -> initrd-2.4.21-243-default drwxr-xr-x 3 root root 520 Aug 18 14:09 . Superman:/boot # rpm -qa | grep -i kernel kernel-source-2.4.21-243 kernel-docs-2.4.21-99

It seems to me as if the last kernel upgrade (2.4.21-243) successfully uninstalled the kernel version I am currently running (2.4.21-231).

Notice that since all the notices about problems with the new kernel, I have not rebooted yet...

Am I missing something?

Best regards, Erick Sanz

...

-----Original Message----- From: Mike Rose [mailto:mr349@cam.ac.uk] Sent: Wednesday, August 25, 2004 10:40 AM To: Ralf Ronneburger Cc: suse-security@suse.com Subject: Re: [suse-security] Bad quality of updates from SuSE ftp server

When using: rpm -ivh kernel-whatever.rpm

you get: ls -l /boot/*previous* lrwxrwxrwx 1 root root 27 Aug 5 09:59 /boot/initrd.previous -> ./initrd-2.6.5-7.75-default lrwxrwxrwx 1 root root 28 Aug 5 09:59 /boot/vmlinuz.previous -> ./vmlinuz-2.6.5-7.75-default

If you are using grub then a simple bit of editing of /boot/grub/menu.lst something like this: " # color white/blue black/light-gray default 0 timeout 10

title Linux kernel (hd0,0)/boot/vmlinuz root=/dev/hda1 vga=0x317 splash=silent acpi=off desktop resume=/ dev/hda2 showopts initrd (hd0,0)/boot/initrd

title Previous Kernel kernel (hd0,0)/boot/vmlinuz.previous root=/dev/hda1 vga=0x317 splash=silent acpi=off desktop resume=/dev/hda2 showopts initrd (hd0,0)/boot/initrd.previous

title No ACPI, APM, DMA or resume kernel (hd0,0)/boot/vmlinuz root=/dev/hda1 showopts ide=nodma apm=off acpi=off vga=normal no resume nosmp noapic maxcpus=0 3 initrd (hd0,0)/boot/initrd "

and you now have the previous kernel available.

Mike Rose TCM & Biological Physics Computer Officer University of Cambridge http://www.bio.phy.cam.ac.uk/ http://www.tcm.phy.cam.ac.uk/

On Wed, 25 Aug 2004, Ralf Ronneburger wrote:

...

Hi,

to add my 2 cents to the discussion about bad update-quality - I'm also not satisfied the way it works in the last months. And as it is a fact, that there where many problems especially with kernel-updates in the last time it'd be a good idea for suse to not uninstall the

2004 i686 i686 old kernel

...

...

...

and delete it's config but to add the new kernel as default and leave the old one as fallback on the system. It's not that we can't help ourselfs if spamassasin or tripwire are broken, but updating a kernel on a remote SuSE-system these days requires some delight in risk.

Greetings,

Ralf

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

Am Mittwoch, 25. August 2004 17:39 schrieb Mike Rose:

When using: rpm -ivh kernel-whatever.rpm

but obviously thats not the way YOU installs a kernel update.

you get: ls -l /boot/*previous* lrwxrwxrwx 1 root root 27 Aug 5 09:59 /boot/initrd.previous -> ./initrd-2.6.5-7.75-default lrwxrwxrwx 1 root root 28 Aug 5 09:59 /boot/vmlinuz.previous -> ./vmlinuz-2.6.5-7.75-default

because I installed the latest kernel updates by you and i dont have any .previous files in /boot. bye, MH

Quoting Mathias Homann :

Am Mittwoch, 25. August 2004 17:39 schrieb Mike Rose:

...

When using: rpm -ivh kernel-whatever.rpm

but obviously thats not the way YOU installs a kernel update.

I believe the difference lies in: rpm -ivh kernel-foo.i586.rpm and rpm -Uvh kernel-foo.i586.rpm YaST/YOU/fou4s all use the "upgrade" path. The "install" path moves the old kernel to "previous", unless I'm mistaken. Perhaps this is a perfect thing for the SuSE guys to change in YaST/YOU: Make kernel upgrade use the "install" type path, or perhaps find some way to give the option? Maybe just make a note about it in the install patch messages to give the user an informed option to quit out of YOU and type it in manually? The "install" path is great for the vast majority of systems today, but can cause problems on smaller systems, as our wonderful linux kernel weighs in at nearly 65 megabytes, and the corresponding sources at 243mb. My laptop wouldn't like to keep too many copies of that size lying about...

Philippe Vogel wrote:

suse@rio.vg wrote:

...

Quoting Mathias Homann :

...

Am Mittwoch, 25. August 2004 17:39 schrieb Mike Rose:

...

When using: rpm -ivh kernel-whatever.rpm

but obviously thats not the way YOU installs a kernel update.

I believe the difference lies in:

rpm -ivh kernel-foo.i586.rpm

and

rpm -Uvh kernel-foo.i586.rpm

YaST/YOU/fou4s all use the "upgrade" path. The "install" path moves the old kernel to "previous", unless I'm mistaken.

Perhaps this is a perfect thing for the SuSE guys to change in YaST/YOU: Make kernel upgrade use the "install" type path, or perhaps find some way to give the option? Maybe just make a note about it in the install patch messages to give the user an informed option to quit out of YOU and type it in manually?

The "install" path is great for the vast majority of systems today, but can cause problems on smaller systems, as our wonderful linux kernel weighs in at nearly 65 megabytes, and the corresponding sources at 243mb. My laptop wouldn't like to keep too many copies of that size lying about...

I had same things as well. Even once I had to rebuild rpm database because of a corrupted rpm-database file during a broken update via YOU.

Since I don't read any mails from Roman Drathmüller there lays the problem. While he mentained the list there where some smaller problems but not this dau looking updatepolicy since the last months.

If you not try to fix this I will swith to some better mentained distributions (gentoo or debian which have longer uptimes than SuSE ever had). Afaik a lot more investigation is needed before giving an update to the public that doesn't seem work at all.

What I don't do the last times is to use automated YOU instead I chose the updates I want to install - especially on kernel and other important updates.

With this policy you make yourself a bad name in the community and don't lose it until you think over to change this bad policy. Even for novell it can't be a good thing to lose customers (even if they think only corporate customers are the right customers, but with linux you can't think like this because it is a community driven OS!).

Best reguards

Philippe

P.S.: Until this issues aren't fixed I a) don't use You or b) use different self compiled software which in fact works better and more reliable (look at gentoo!).

Mike Rose wrote:

I agree. User configurable options for yast and YOU to specify install or upgrade for at least kernel rpms would be nice. Could be an option for the installer when a user chooses the auto updates bit - they they choose install or uprade for kernel, with a wee bit of explanation to give them a clue what the difference is.

YaST cannot handle multiple installed RPMs of the same name, it only sees the most recent one. That probably won't change anytime soon. If you don't want YOU to automatically update the kernel just set the patch (not the package!) to 'taboo'. YOU preserves the list of taboo patches between runs by storing it in /var/lib/YaST2/you/settings. cu Ludwig -- (o_ Ludwig Nussel //\ SUSE LINUX AG, Development V_/_ http://www.suse.de/

Hi Oliver, Olivier Mueller wrote:

and for my "little" problem (retail suse 9.1 working fine on a dell PE

600SC with megaraid (perC), updated suse 9.1 not working anymore), do you have an idea, or should I just stick to the "unsafe" kernel?

what type of PERC-Raid-controller do you have? I have 2 production-systems with SuSE 9.0 and 9.1, too, so I'd be interested if I should keep my hands off that update or if I could give it a try. Did anybody get the new 9.1 kernel running on a PERC-controller? Greetings, Ralf

Marcus Meissner wrote:

On Wed, Aug 25, 2004 at 10:45:25AM -0400, suse@rio.vg wrote:

...

Quoting Marcus Meissner :

...

We are sorry for any inconvience caused. We try to have the best quality for security updates, but unfortunately due to sheer mass of updates sometimes mistakes slip through our Quality Assurance.

did I get you right: You said that just because there is that much to be done your QA is not able to do the job the way it should?

...

...

We have been and will be constantly improving our processes to avoid such mistakes in the future and are committed to provide the best service possible.

The interesting point for the public is: How will SuSE try to realise that? I thought you were already committed to provide the best service possible. Kick asses of the people in your QA? Or get more people working on the issues such that the work *can* handle the 'sheer mass' of updates? Review your processes again and again instead of working on the problem itself?

...

Now I'm *REALLY* annoyed. This is suse-security, not your press release forum.

Seems it *is* the press release forum.

...

This sort of market-speak drivel only makes you look incompetent.

Much more than that drivel, the bad quality doesn't only make SuSE *look* incompetent, it seems that they in fact are - at least the QA.

Ok, translated I want to say:

"Yes, we fucked up. We try harder not to fuck up in the future." :)

I will take this as an official statement from SuSE w.r.t the problems that arose. Thank you. And in the future, if things get worse, all we will hear is that SuSE is fucked up again. Sounds nice.

is this satisfyingly techy enough ? :)

It's what we all knew. *But:* No declaration of intent will substitute a working solution.

Fixed spamassassin updates are going out as I am writing this mail.

... GTi

On Thu, 26 Aug 2004, John Andersen wrote:

On Thursday 26 August 2004 12:09 am, list@nolog.org wrote:

...

...

...

...

We are sorry for any inconvience caused. We try to have the best quality for security updates, but unfortunately due to sheer mass of updates sometimes mistakes slip through our Quality Assurance.

did I get you right: You said that just because there is that much to be done your QA is not able to do the job the way it should?

Yes, I think that's exactly what he said. What's so hard to understand about that?

Oh to be so over paid and under worked that the press of business never bothers you - you never fall behind, always ahead of the curve and have all code tested, triple checked, regression tested, integrated, and all in two days flat.

What he said. SuSE have apologised and grovelled. The wolves can take a break from their howling, all you're doing now is repeating what's been said before. And it's getting boring. SuSE made a couple of errors. It's not their first, it won't be their last, them being human and all. They'll have a look at what they did and try to do better. That's as good as can be expected and demanded. Bjørn -- Bjørn Tore Sund Phone: (+47) 555-84894 Stupidity is like a System administrator Fax: (+47) 555-89672 fractal; universal and Math. Department Mobile: (+47) 918 68075 infinitely repetitive. University of Bergen VIP: 81724 Support: system@mi.uib.no Contact: teknisk@mi.uib.no Direct: bjornts@mi.uib.no

...

...

This sort of market-speak drivel only makes you look incompetent.

Much more than that drivel, the bad quality doesn't only make SuSE *look* incompetent, it seems that they in fact are - at least the QA.

...

Ok, translated I want to say:

"Yes, we fucked up. We try harder not to fuck up in the future." :)

I will take this as an official statement from SuSE w.r.t the problems that arose. Thank you.

And in the future, if things get worse, all we will hear is that SuSE is fucked up again. Sounds nice.

For Christ's sake, stop bawling at the tech! It's not his fault. He explained the situation the professional way, then again the blunt way. Now he's getting on with his job as quickly as he can. If you want to spit your venom at someone, point it at the boss. The techs clearly need more resources - more people, faster machines, whatever - in order to cope with the issues they have to deal with. You increasing the pressure with your ranting isn't going to help.