Re: [Savannah-hackers] Outdated file location for AUCTeX?

[David Kastrup]

Sylvain Beucler <address@hidden> writes:

> On Fri, Aug 20, 2004 at 10:55:15PM +0200, David Kastrup wrote:
> > Hello,
> > 
> > AUCTeX is available at <URL:ftp://www.gnu.org/pub/auctex>.  Yet there
> > are outdated versions from earlier time accessible at
> > <URL:http://ftp.gnu.org/savannah/files/auctex/beta.pkg/>.  It happens
> > that people actually mirror those outdated directories.
> > 
> > What would be a proper procedure to let those directories also point
> > at the normal download area of AUCTeX?
> 
> Sorry for the delay.
> 
> http://ftp.gnu.org/savannah/files/ contains files that were available
> before the crack, and may be compromised. I think they were moved
> there in case a project administrator needed them, before we delete
> them definitely.
> 
> I think it is a good time to do so right now.
> 
> People at ftp.gnu.org (in Cc) should be able to make a symlink to the
> official location then, but I think it would be cleaner if we could
> remove the outdated directory definitively.
> 
> What do you all think?

Since the structure of the old directories does no longer necessarily
conform with the current state of the project, I'd strongly recommend
to remove them from public access.  There should probably be a way for
project managers to access or request them, but they should no longer
be served anonymously by default in my opinion.

For completely stagnant projects, this might be an unpleasant choice,
however.  But providing uncommented access to potentially damaged
files is probably worse.  Maybe just serve a page saying that this
directory contained potentially compromised files, and if anybody
wants to get the unchecked contents, he should explicitly ask the
maintainers for them.

In case a project is known to be going on, it would be nice if a link
were included to the current project page, but that is not mandatory,
I guess.

-- 
David Kastrup, Kriemhildstr. 15, 44793 Bochum