Hi,
On Thu, Mar 02, 2006, Michael Stone wrote:
> gnome depends on rhythmbox, which depends on avahi-daemon, which starts
> up a network daemon. The rhythmbox maintainer does not seem to want to
> reconsider this, as he considers automated network music sharing
> essential to the application. IMO, people who want a gnome desktop
> should not have this service enabled as a side effect. Please remove
> rhythmbox from the gnome dependency list to make it easier for users to
> decide whether they want this functionality.
This is even worse: people will wonder why they didn't get rhythmbox
when they installed GNOME. After fighting against features, you're now
fighting against whole packages.
Here's what I propose:
1/ let some harden-* package conflict with avahi-daemon and pull
"some security" task by default so that security is clearly the
reason of the removal of avahi, and so that as soon as one removes
harden, one might get avahi back (with the clear security risk)
2/ let avahi have a debconf question concerning running by default or
not, defaulting to yes of course (as all daemons), but pre-seedable
for special use cases (a security-related distro for example, or a
network install of a large machine park)
I think installing GNOME was historically an installation of
"client-only" stuff, but that's long gone, for example one can now
start an apache2 process to share files via DAV (guess how will be
advertized?).
You don't want to stop GNOME to want features as simple as
file-sharing.
It's quite natural for people to get a webserver when they install a
webapp such as phppgadmin, yet apache2 does not only listen on lo by
default, it does listen on all interfaces (which is what you'd expect
when installing apache2 of course).
Cheers,
--
Loïc Minier <[EMAIL PROTECTED]>
Current Earth status: NOT DESTROYED
