python security announcements

[Jean-Philippe Ouellet]

To any who may care, I've opened an issue in the Python bug tracker in
the hopes that we might have a guaranteed way of being made aware of
security issues in Python before Qubes users get owned by them.

See here: https://bugs.python.org/issue31953

My hope is that a guarantee of receiving such news means Qubes has a
higher change of making a timely QSB and "update dom0 ASAP!"
announcement if the time ever comes. Many of us follow news in the
security world anyway and might hear of such a potential issue
regardless, but still...

Regards,
Jean-Philippe

[Yuraeitha]

Please correct me if I'm wrong, but python security issues should only apply for the Qubes Admin, right? and the Qubes Admin only has internet access, if you opt-in to it, correct?
These things are good to know as well, and it doesn't seem to be documented anywhere easy to find yet, albeit I've seen it briefly discussed here and there, but nothing conclusive.

I do not like the idea of having extra attack surface to worry about when I personally do not need the Qubes Admin on my personal machine. Albeit I do think Qubes Admin is an awesome addition to Qubes, as long as it's possible to opt-in or opt-out, and all the security issues that follows goes with it in or out accordingly.