Re: Proposal: removing urio(4), Rio 500 MP3 player (1999), and Rio-related packages

[Maxime Villard <max%m00nbsd.net@localhost>]

Le 02/01/2020 à 19:29, Jason Thorpe a écrit :
> > On Jan 2, 2020, at 10:16 AM, coypu%sdf.org@localhost wrote:
> > Hi folks,
> >
> > urio(4) is a driver for Rio 500, an MP3 player released in 1999.
> > It recently received some discussion due to problems detected
> > during maxv's USB-fuzzing.

Well, not exactly, the concerns were around the permissions of /dev/urio,
and following the discussion it turned out that the driver was a good
candidate for nuking.

> Yah, seems like a good candidate for nuking.

Two other drivers were also discussed:

 - uyurex, which is currently disabled, and has been disabled forever. My
   concern in this driver is that it has buffer overflows. The developer
   who imported it is no longer in tnf. This driver is supposed to handle
   exotic body sensor devices apparently sold in Japan around 2008.

 - uscanner, which was brought up by other people for an unrelated reason.
   It was removed from FreeBSD in 2009, from OpenBSD in 2013, and disabled
   in NetBSD in 2016. It has been superseded by ugen+SANE.

I'll let Maya decide whether to formulate proposals for these two
additional drivers.

Maxime