The problem is you can't count on an open-source package coming out with that kind of regularity. It's also common for open-source packages to be hopelessly broken in new releases; a lot of us wait until a release has gone through a few minor revisions before making the decision to deploy it. Adding expirations would remove system administrators' discretion to do upgrades when they see fit, based on their reliability requirements and how serious any vulnerabilities in the old package are in the environment they're running the softare.

I'd certainly remove any time-bomb code from open-source software I decided to deploy on my servers.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/72/11605#11605