Re: packages and private parts

[kilgallen@eisner.decus.org (Larry Kilgallen)]

In article <32FF4D8D.167EB0E7@innocon.com>, Jeff Carter <carter@innocon.com> writes:
> Robert Dewar wrote:

>> Child packages are much safer. If you have a set of packages from
>> a "great designer", and want to use them, then use them, do NOT
>> use any suspicious non-official children! Remember that a program
>> is only affected by the presence of child packages if it directly
>> or indirectly with's these children.
> 
> How do you know which children are official and which are not? How do
> you know whether a programmer has written and used an unauthorized child
> that is not known to the rest of the system?

You know all of this by whether the child has been entered into the
configuration manager. This is really no different than how you know
whether a particular copy of the parent is official.

For "the configuration manager" you are free to use any method your
organization feels is safe, ranging from a diskette set as write-lock
(or not) up to digital signatures on the sources.

While a programmer might be able to write an unauthorized child
package, she cannot put it into the configuration management
system without following the rules for the particular local
environment.  Those rules might extend from "free-for-all" up
to measuring against coding standards which require some extra
approval for child packages.

Larry Kilgallen