Re: YUM security issues...

2008-07-25 Thread Josh Bressers
On 21 July 2008, Josh Bressers wrote: On 19 July 2008, Justin Cappos wrote: By the way, did you remove the ability for mirror admins to select a subnet where they'll serve all of the traffic? We're particularly concerned about this issue in the short term. We took our mirror down

WP MU Help

2008-07-25 Thread Jonathan Roberts
Hi all, I've come here before talking about getting a news.fp.o site set up and running, and we've had a test instance up in the past with Lyceum but we decided to move in the direction of MU. Bret McMillan has been working very hard on this over the past several months and has now got a test

Re: YUM security issues...

2008-07-25 Thread Mike McGrath
On Fri, 25 Jul 2008, Mike McGrath wrote: On Fri, 25 Jul 2008, Josh Bressers wrote: On 21 July 2008, Josh Bressers wrote: On 19 July 2008, Justin Cappos wrote: By the way, did you remove the ability for mirror admins to select a subnet where they'll serve all of the traffic?

Re: YUM security issues...

2008-07-25 Thread Jesse Keating
On Fri, 2008-07-25 at 10:37 -0500, Mike McGrath wrote: AFAIK, this service is still in place and working fine. Though I am a little confused about the question. It sounds like you'd like to direct all subnet traffic to a specific mirror. But you're also saying you took your mirror down.

Re: YUM security issues...

2008-07-25 Thread Josh Bressers
On 25 July 2008, Mike McGrath wrote: On Fri, 25 Jul 2008, Mike McGrath wrote: On Fri, 25 Jul 2008, Josh Bressers wrote: On 21 July 2008, Josh Bressers wrote: On 19 July 2008, Justin Cappos wrote: By the way, did you remove the ability for mirror admins to select a

Re: YUM security issues...

2008-07-25 Thread Matt Domsch
On Fri, Jul 25, 2008 at 10:43:59AM -0500, Mike McGrath wrote: On Fri, 25 Jul 2008, Jesse Keating wrote: On Fri, 2008-07-25 at 10:37 -0500, Mike McGrath wrote: AFAIK, this service is still in place and working fine. Though I am a little confused about the question. It sounds like

Re: YUM security issues...

2008-07-25 Thread Mike McGrath
On Fri, 25 Jul 2008, Matt Domsch wrote: On Fri, Jul 25, 2008 at 10:43:59AM -0500, Mike McGrath wrote: On Fri, 25 Jul 2008, Jesse Keating wrote: On Fri, 2008-07-25 at 10:37 -0500, Mike McGrath wrote: AFAIK, this service is still in place and working fine. Though I am a

Re: YUM security issues...

2008-07-25 Thread Matt Domsch
On Fri, Jul 25, 2008 at 12:46:15PM -0400, Josh Bressers wrote: On 25 July 2008, Matt Domsch wrote: Yes, this is a known challenge with subnet delegation in MirrorManager. We're trusting package signing (and soon, repodata signing) to prevent rogue mirrors from issuing unsigned data. In

Re: YUM security issues...

2008-07-25 Thread Josh Bressers
On 25 July 2008, Matt Domsch wrote: On Fri, Jul 25, 2008 at 12:46:15PM -0400, Josh Bressers wrote: On 25 July 2008, Matt Domsch wrote: Yes, this is a known challenge with subnet delegation in MirrorManager. We're trusting package signing (and soon, repodata signing) to prevent

Public demo of amber and eventual production instance

2008-07-25 Thread Robin Norwood
Hi, So sometime next week I'd like to link to the publictest10.fedoraproject.org/amber site and ask for feedback. In the meantime I'm going to install the latest changes on it, and load it up with all the data from F9. Just a heads-up, and a humble request not to break things (like the FAS

Re: YUM security issues...

2008-07-25 Thread Justin Samuel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Domsch wrote: On Fri, Jul 25, 2008 at 12:46:15PM -0400, Josh Bressers wrote: On 25 July 2008, Matt Domsch wrote: Yes, this is a known challenge with subnet delegation in MirrorManager. We're trusting package signing (and soon, repodata

RE: YUM security issues...

2008-07-25 Thread Matt_Domsch
Fedora 7 definitely behaves differently than Fedora 8 and 9. The behavior I describe began with F8. For F7 and earlier, the yum policy would chose any random mirror from the returned list, so having many mirrors on the list, some of which are unreachable from inside an organization, would be

Re: YUM security issues...

2008-07-25 Thread Josh Bressers
On 25 July 2008, Matt Domsch wrote: On Fri, Jul 25, 2008 at 01:52:26PM -0400, Josh Bressers wrote: That's a lot of IPs though. Can I request multiple /16s, or only one? As many as you like. And recall, such changes are made using your FAS credentials. Are these ever checked? Does say a

Re: YUM security issues...

2008-07-25 Thread Toshio Kuratomi
Josh Bressers wrote: On 25 July 2008, Matt Domsch wrote: On Fri, Jul 25, 2008 at 01:52:26PM -0400, Josh Bressers wrote: That's a lot of IPs though. Can I request multiple /16s, or only one? As many as you like. And recall, such changes are made using your FAS credentials. Are these ever

Re: YUM security issues...

2008-07-25 Thread seth vidal
On Fri, 2008-07-25 at 18:41 -0700, Toshio Kuratomi wrote: 3) Always get repo data from fedoraproject.org (probably not practical due to resource issues) This is the easiest to implement. It means the small repomd.xml file always comes from our server. But the rest of the metadata can