https://forums.hyperbola.info/viewtopic … 8101#p8101

topic

I was not trying to mix minetest and radare2 from a patching point, but for this first part I saw

so minetest developers may not backport security fixes to old releases.

Than about this first part I saw

in the SECURITY.md file.

So I though for this first part of the topic that the Hyperbola community also looks for packages that get upstream backport patch help.

And if upstream the developers did not have "interest to work together for older versions" for those downstream for backports than it may be removed.

I did see a minetest patch may not have helped as there may have been or still are "several other vulnerabilities" but I was mostly seeing how Hyperbola developers handled an upstream package, like minetest, that did not backport security fixes to old releases, as it looked like radare2 had a similar policy about backports.

https://wiki.hyperbola.info/doku.php?id … philosophy

For the second part of this topic I did not know there was a "CURRENT" thread about radare2 to post at. Nor did I wish to make more work for anyone.

But if any one on the forum also had more information about radare2 or the CVE things than a community/anyone_on_this_forum could also post a fix, or idea about what to do about radare2 here.

As there may also be many people who use the forum who also could help find or make a solution that could be acceptable to both the Hyperbola's main team as well as others. So everyone may find a solution that works best for them, as well as hopefully others as well. Be it a patch, fork, or removal, or something else.

https://wiki.hyperbola.info/doku.php?id … y_software

I did not yet look that much for a solution as I did not use this program much. I think I only tested this with the graphical radare2 once, and that was some time ago. I think the name was radare2-cutter, though I do not know.

Nor did I know what the community/anyone thought to do in this case. So this topic was made to see what anyone thought was the best policy/thing_to_do.

If there is a better place to post ways_forward/community_policy discussions about packages/policies I could use that.

Maybe the IRC channel could have been better, though a forum post could help in-case many people do not login at the same time. As clear communication between all involved in anything can help, though I do not wish to send too much text, as that could fill a "chat log" or forum.

https://wiki.hyperbola.info/doku.php?id … c_channels

Maybe a distributed communication thing could help, though I see

https://forums.hyperbola.info/viewtopic … 8063#p8063

and I may also think that "a specialized forum and smaller communities" could help.

So that is why I thought the forum was a nice place to post it at.

Thank you, throgh, for the information about that there are more minetest problems. Though I mostly was looking about any Hyperbola policy of what to do about updates/upstream problems with any program, as the community may have had/has ideas about how to handle that, to also help out the main developers.

I also do not know much yet about how to fix/fork minetest to remove it's vulnerabilities. Or where to find out more information about those vulnerabilities, as those may not yet be listed at https://cve.mitre.org/cgi-bin/cvekey.cg … d=minetest

Or a fix for radare2, but the community may have known and also could help the main developers.

So I can see removing a package with known vulnerabilities can help security. Till the community thinks of a solution that everyone may like.

Also thank you for the information about radare2.

This post is partly to say thank you for the information about radare2.

I just reported quickly at the other post to not ignore any issue I may have found, as the community may have found a way forward, even if I did not yet.

The main reason for this post is for the community to post about "community-oriented and -driven software" as well as typing about the best way for the community can help/support_each_other make software "from the community for the community" and for the community to type about the best way for the community to communicate with the community.

Maybe a community made program to communicate with the community will be the first think typed about by the community, to keep comunications open.

Though the community can also use the forum.

Warning: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages: error:14007086:SSL routines:CONNECT_CR_CERT:certificate verify failed in /srv/http/flyspray/vendor/swiftmailer/swiftmailer/lib/classes/Swift/Transport/StreamBuffer.php on line 94 Completely unexpected exception: Unable to connect with TLS encryption
This should never happend, please inform Flyspray Developers

By that I mean there is a switch to turn it on.

So, how can i add DuckDuckGo or Google to my search engines?