Re: Removal of rxvt/mrxvt from pkgsrc?

[Greg Troxel <gdt%lexort.com@localhost>]

Tobias Nygren <tnn%NetBSD.org@localhost> writes:

> This has been proposed before and again I will point out that both rxvt
> and mrxvt in pkgsrc has been patched for the linked CVE.
> If we decide to remove packages that have no active upstream then
> many others should be on the chopping block before (m)rxvt.
> This is not an objection from me but a merely a plead for factuality and
> consistency.

As I know tnn@ knows, we have a vulnerability database and I invite
@bsdlisten to inspect it.  Certainly point out if it's off.

Agreed we have old things, and we note in DESCR if they are
unmaintained.  People often choose to run them anyway.

We remove packages when:

  we genuinely believe there are and will be zero users

  we believe there are few users and there is real work/pain caused by
  the continued presence of the packages


We do not remove packages because of "I don't think other people should
run this", unless it's outright malware.

We have 2 people who objected, and no evidence of any pain -- so I think
we're done and it's not getting removed.