Message-ID: <4897ACC9.8030701@byu.net>
Date: Mon, 04 Aug 2008 19:28:41 -0600
From: Eric Blake <ebb9@byu.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.16) Gecko/20080708 Thunderbird/2.0.0.16 Mnenhy/0.7.5.666
MIME-Version: 1.0
To: cygwin@cygwin.com
Subject: Re: Setup version
References: <4897678C.9010106@cappella.us>
In-Reply-To: <4897678C.9010106@cappella.us>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

According to Mike Cappella on 8/4/2008 2:33 PM:
| With the recent CVE security announcement regarding setup.exe:
|
|    http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3323
|
| I'm wondering if perhaps it make sense to include the version number of
| setup.exe on the main Cygwin web page?  It is currently seems to require
| downloading setup.exe and running it to determine the version number.

On the other hand, the above vulnerability can only occur if you click
beyond the screen displaying the version number, so there isn't really any
harm in running setup.exe to determine whether it is new enough to avoid
that particular bug.

- --
Don't work too hard, make some time for fun as well!

Eric Blake             ebb9@byu.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkiXrMkACgkQ84KuGfSFAYDLtACgl3Uu1DOlwdtdRxrvmcngELT3
IBEAn1F2RLKNyZzVs5hZ+WCd9vuxOkDK
=JTzx
-----END PGP SIGNATURE-----

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/