Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Tollef Fog Heen
* Steve Kemp [...] | I'm loath to ask the user if it should be setgid in the installer | because that's just needless distraction, but perhaps some global | 'setgidnes' setting could be stored in /etc/games? [...] what's wrong with a low-priority debconf question with a sane default? --

Re: debconf 2005 in Vienna, Austria

2003-08-01 Thread Sven Luther
On Thu, Jul 31, 2003 at 02:15:43PM +0200, Christian Perrier wrote: > Quoting Jonathan Walther ([EMAIL PROTECTED]): > > > 4 hours to get somewhere is just an enjoyable Sunday drive. > > Not on german Autobhanen... :-). And especially if this happens during > the week. But it will be on sunday lat

Re: debconf 2005 in Vienna, Austria

2003-08-01 Thread Sven Luther
On Thu, Jul 31, 2003 at 03:24:22PM +0200, Martin List-Petersen wrote: > Citat Sven Luther <[EMAIL PROTECTED]>: > > > On Thu, Jul 31, 2003 at 10:22:34AM +0200, Oliver Kurth wrote: > > > On Thu, Jul 31, 2003 at 09:48:01AM +0200, Sven Luther wrote: > > > > On Thu, Jul 31, 2003 at 02:29:06AM +0200, Be

Re: debconf 2005 in Vienna, Austria

2003-08-01 Thread Christian Perrier
Quoting Riku Voipio ([EMAIL PROTECTED]): > Trains (atleast the newer ones in finland) have electric sockets, This is still quite rare. For instance, in french trains (TGV and "Teoz", formerly known as "Corail"ie Intercity trains), electric wires are only available in the most recent coaches

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Steve Kemp
On Fri, Aug 01, 2003 at 08:20:08AM +0200, Tollef Fog Heen wrote: > what's wrong with a low-priority debconf question with a sane default? Absolutely nothing at all, but it's a slippery slope, and I thought we were tending towards less interactivity in installations? Steve --

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Michał Politowski
On Thu, 31 Jul 2003 17:30:11 +0300, Richard Braakman wrote: > On Thu, Jul 31, 2003 at 01:17:01PM +0100, Steve Kemp wrote: > > http://www.steve.org.uk/cgi-bin/debian/index.cgi > > If you're just scanning for binaries with s bits set, then you'll > probably miss all the ones that use whatever th

[no subject]

2003-08-01 Thread wsd
debian-devel,您好! 日背单词120是什么意思? 致 礼! wsd [EMAIL PROTECTED]   2003-08-01

Re: debconf 2005 in Vienna, Austria

2003-08-01 Thread martin f krafft
also sprach Sven Luther <[EMAIL PROTECTED]> [2003.08.01.0846 +0200]: > On Thu, Jul 31, 2003 at 03:24:22PM +0200, Martin List-Petersen wrote: > > Citat Sven Luther <[EMAIL PROTECTED]>: > > > On Thu, Jul 31, 2003 at 10:22:34AM +0200, Oliver Kurth wrote: > > > > On Thu, Jul 31, 2003 at 09:48:01AM +020

Re: debconf 2005 in Vienna, Austria

2003-08-01 Thread Martin List-Petersen
Citat Christian Perrier <[EMAIL PROTECTED]>: > Quoting Riku Voipio ([EMAIL PROTECTED]): > > > Trains (atleast the newer ones in finland) have electric sockets, > > > > This is still quite rare. For instance, in french trains (TGV and > "Teoz", formerly known as "Corail"ie Intercity trains)

Re: CUPS should be the default print service in Debian/Sarge

2003-08-01 Thread Luca - De Whiskey's - De Vitis
On Thu, Jul 31, 2003 at 11:35:13AM -0700, Keegan Quinn wrote: > FWIW, I've had very good experiences with the CUPS in unstable, so > I'd not object to this. OTOH, installing it without it being 'default' > is already quite trivial. What would this change entail, exactly? So i had/have either in

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Tollef Fog Heen
* Steve Kemp | On Fri, Aug 01, 2003 at 08:20:08AM +0200, Tollef Fog Heen wrote: | | > what's wrong with a low-priority debconf question with a sane default? | | Absolutely nothing at all, but it's a slippery slope, and I thought | we were tending towards less interactivity in installations?

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matthew Palmer
On Fri, Aug 01, 2003 at 10:08:17AM +0200, Micha? Politowski wrote: > On Thu, 31 Jul 2003 17:30:11 +0300, Richard Braakman wrote: > > On Thu, Jul 31, 2003 at 01:17:01PM +0100, Steve Kemp wrote: > > > http://www.steve.org.uk/cgi-bin/debian/index.cgi > > > > If you're just scanning for binaries wit

Data loss: suggestions for handling

2003-08-01 Thread Matthew Palmer
The latest upstream version of a package I've begun to maintain, IRM, has a problem in that a portion of the data in the system (relating to software and licence assignment) can't be upgraded along with the rest of the database - the schema is totally different. I've thought about it for a while,

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Herbert Xu
Joey Hess <[EMAIL PROTECTED]> wrote: > > I also think it would be a good idea for policy to require all > setuid/gid bit grants to go through this or another list for peer > review, much as pre-depends are supposed to. How about creating a new group for each game? -- Debian GNU/Linux 3.0 is out!

Re: Bug#203498: ITP: decss -- utility for stripping CSS tags from an HTML page.

2003-08-01 Thread Jon Dowland
On Thu, Jul 31, 2003 at 11:21:57AM +0200, Sam Hocevar wrote: > >For instance it fails to remove this construct: > >rel="stylesheet" > href="/foo.css" /> Or rel="alternate stylesheet", and the various combinations that arise from support of non-graphical readers, etc. If this

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Michał Politowski
On Fri, 1 Aug 2003 19:19:10 +1000, Matthew Palmer wrote: [...] > From my investigations, I thought that the intended use of dpkg-statoverride > was by the local administrator, modifying the default suid/sgid and > ownership of the file as set in the package tarball. This is also my understanding.

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Keith Dunwoody
Herbert Xu wrote: Joey Hess <[EMAIL PROTECTED]> wrote: I also think it would be a good idea for policy to require all setuid/gid bit grants to go through this or another list for peer review, much as pre-depends are supposed to. How about creating a new group for each game? Umm... With hundreds, p

Re: debconf 2005 in Vienna, Austria

2003-08-01 Thread Riku Voipio
On Fri, Aug 01, 2003 at 08:32:57AM +0200, Christian Perrier wrote: > This is still quite rare. For instance, in french trains (TGV and > "Teoz", formerly known as "Corail"ie Intercity trains), electric > wires are only available in the most recent coaches and only in 1st > class usually. > Fr

Re: CUPS should be the default print service in Debian/Sarge

2003-08-01 Thread Lars Wirzenius
On pe, 2003-08-01 at 12:32, Luca - De Whiskey's - De Vitis wrote: > It is a good solution for any user level with most common printers/needs, > thus it > should be the default (IMHO). Do we actually need a default print service at all? Mail is much more fundamental, for example, but lots of compu

Re: Data loss: suggestions for handling

2003-08-01 Thread Roland Mas
Matthew Palmer (2003-08-01 19:51:46 +1000) : > The latest upstream version of a package I've begun to maintain, > IRM, has a problem in that a portion of the data in the system > (relating to software and licence assignment) can't be upgraded > along with the rest of the database - the schema is t

Re: CUPS should be the default print service in Debian/Sarge

2003-08-01 Thread Mark Brown
On Fri, Aug 01, 2003 at 02:49:59PM +0300, Lars Wirzenius wrote: > Do we actually need a default print service at all? Mail is much more > fundamental, for example, but lots of computers these days don't have a > printer attached at all. We needn't install a print service by default but if someone

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Cajus Pollmeier
On Donnerstag, 31. Juli 2003 07:24, Pierre THIERRY wrote: > Package: acpid > Version: N/A; reported 2003-07-31 > Severity: serious > Justification: Policy 9.1.1 > > The shell script /etc/acpi/powerbtn.sh should be installed in something > else, like /usr/share/acpid/ or /usr/sbin/. > > -- System In

Re: debconf 2005 in Vienna, Austria

2003-08-01 Thread Josip Rodin
On Fri, Aug 01, 2003 at 02:06:48PM +0300, Riku Voipio wrote: > A quick grep on bahn.de says that ICE-T trains (presumably the most ~ > expensive ones..) have power sockets for every seat. Anyone with > experience on german/austrian railroad? > > > So, IMHO,

Re: debconf 2005 in Vienna, Austria

2003-08-01 Thread Keith Dunwoody
Riku Voipio wrote: On Fri, Aug 01, 2003 at 08:32:57AM +0200, Christian Perrier wrote: This is still quite rare. For instance, in french trains (TGV and "Teoz", formerly known as "Corail"ie Intercity trains), electric wires are only available in the most recent coaches and only in 1st class usua

Bug#203768: RFP: sixpack -- Bibliography and Reference Manager

2003-08-01 Thread Daniel Martins
Package: wnpp Severity: wishlist * Package name: sixpack Version : 0.99 Upstream Author : Apparently Michael Lachmann http://www.santafe.edu/~dirk/ * URL or Web page : http://www.santafe.edu/~dirk/sixpack/ * License : GPL Description : Bibliography and Reference Mana

Re: Data loss: suggestions for handling

2003-08-01 Thread Stephen Frost
* Matthew Palmer ([EMAIL PROTECTED]) wrote: > - dump the old software tables and store the dump somewhere, giving > pointers to the dump in all sorts of useful places. But if I put it > somewhere temporary (/tmp), it might disappear before the admin > realises, and somewher

Ayuda

2003-08-01 Thread Klipodi Anstro
Nesecitaria los driver de la placa de red Cnet Pro200 PCI fast Ethernet Adapter Desde ya muchas graciasInternet GRATIS es Yahoo! Conexión. Usuario: yahoo; contraseña: yahoo Desde Buenos Aires: 4004-1010 Más ciudades: clic aquí.

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Colin Watson
On Fri, Aug 01, 2003 at 02:09:36PM +0200, Cajus Pollmeier wrote: > On Donnerstag, 31. Juli 2003 07:24, Pierre THIERRY wrote: > > Package: acpid > > Version: N/A; reported 2003-07-31 > > Severity: serious > > Justification: Policy 9.1.1 > > > > The shell script /etc/acpi/powerbtn.sh should be instal

Re: Bug#203498: ITP: decss -- utility for stripping CSS tags from

2003-08-01 Thread Evan Prodromou
> "CB" == Christoph Berg <[EMAIL PROTECTED]> writes: CB> If you are both a DD and upstream, why didn't you package it CB> yourself? Good question. Installing Pigdog DeCSS in somebody's Debian system doesn't really meet my goals for the software. The original point was to have mirrors

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread David Z Maze
Cajus Pollmeier <[EMAIL PROTECTED]> writes: > On Donnerstag, 31. Juli 2003 07:24, Pierre THIERRY wrote: >> Severity: serious >> Justification: Policy 9.1.1 ("Debian should obey the FHS"; I don't claim to be an FHS expert, but all it seems to say about /etc is "no binaries", which this doesn't vio

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Pierre THIERRY
> I think at least the RCness of this bug is rather dubious, frankly. If > the script is configuration I don't think the script is meant to be edited... So it should be in /usr/sbin. Quickly, le Moine Fou -- [EMAIL PROTECTED] OpenPGP 0xD9D50D8A pgpjHl0gN4jh5.pgp Description: PGP signature

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Cajus Pollmeier
On Freitag, 1. August 2003 15:31, David Z Maze wrote: > Cajus Pollmeier <[EMAIL PROTECTED]> writes: > > On Donnerstag, 31. Juli 2003 07:24, Pierre THIERRY wrote: > >> Severity: serious > >> Justification: Policy 9.1.1 > > ("Debian should obey the FHS"; I don't claim to be an FHS expert, but > all i

Re: CUPS should be the default print service in Debian/Sarge

2003-08-01 Thread Joey Hess
Keegan Quinn wrote: > FWIW, I've had very good experiences with the CUPS in unstable, so > I'd not object to this. OTOH, installing it without it being 'default' > is already quite trivial. What would this change entail, exactly? Probably making the print server task install it instead of lpr, w

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Thu, Jul 31, 2003 at 12:55:28PM -0400, Joey Hess wrote: > I also think it would be a good idea for policy to require all setuid/gid > bit grants to go through this or another list for peer review, much as > pre-depends are supposed to. I absolutely support this idea. All set[ug]id setups shou

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Matthew Garrett
Pierre THIERRY wrote: >I don't think the script is meant to be edited... So it should be in >/usr/sbin. You think wrong. The user should be able to choose whether the power button triggers shutdown or suspend to disk, for instance. -- Matthew Garrett | [EMAIL PROTECTED]

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Thu, Jul 31, 2003 at 06:37:53PM +0100, Steve Kemp wrote: > On Thu, Jul 31, 2003 at 12:55:28PM -0400, Joey Hess wrote: > > > I'd like to see us move all of our setgid games (except, perhaps, > > nethack) away from using global score files by default. > > I think that should be a good option

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 08:20:08AM +0200, Tollef Fog Heen wrote: > what's wrong with a low-priority debconf question with a sane default? As long as the sane default is the safe default, which is not to be setgid. -- - mdz

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 08:45:16PM +1000, Herbert Xu wrote: > Joey Hess <[EMAIL PROTECTED]> wrote: > > > > I also think it would be a good idea for policy to require all > > setuid/gid bit grants to go through this or another list for peer > > review, much as pre-depends are supposed to. > > How

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Pierre THIERRY
> You think wrong. The user should be able to choose whether the power > button triggers shutdown or suspend to disk, for instance. But one shouldn't have to edit a shell script to do it. It should just be necessary to edit a configuration file. Like modifying the action value to something like /u

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Steve Kemp
On Fri, Aug 01, 2003 at 11:18:53AM -0400, Matt Zimmerman wrote: > > I also think it would be a good idea for policy to require all setuid/gid > > bit grants to go through this or another list for peer review, much as > > pre-depends are supposed to. > > I absolutely support this idea. All set[ug

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Gunnar Wolf
Pierre THIERRY dijo [Fri, Aug 01, 2003 at 03:58:23PM +0200]: > > I think at least the RCness of this bug is rather dubious, frankly. If > > the script is configuration > > I don't think the script is meant to be edited... So it should be in > /usr/sbin. There are many scripts in /etc that are not

Re: Data loss: suggestions for handling

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 07:51:46PM +1000, Matthew Palmer wrote: > The latest upstream version of a package I've begun to maintain, IRM, has a > problem in that a portion of the data in the system (relating to software > and licence assignment) can't be upgraded along with the rest of the > databas

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Gunnar Wolf
David Z Maze dijo [Fri, Aug 01, 2003 at 09:31:40AM -0400]: > Cajus Pollmeier <[EMAIL PROTECTED]> writes: > > > On Donnerstag, 31. Juli 2003 07:24, Pierre THIERRY wrote: > >> Severity: serious > >> Justification: Policy 9.1.1 > > ("Debian should obey the FHS"; I don't claim to be an FHS expert, bu

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Josip Rodin
On Fri, Aug 01, 2003 at 10:32:47AM -0500, Gunnar Wolf wrote: > Ummm... I *did* find something strange, maybe you can give some more > insight on this: > > [EMAIL PROTECTED]:/$ find /etc -type f -perm -755|xargs file|grep ELF > etc/X11/rstart/rstartd.real:ELF 32-bit LSB > e

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Stephen Frost
* Matt Zimmerman ([EMAIL PROTECTED]) wrote: > On Thu, Jul 31, 2003 at 12:55:28PM -0400, Joey Hess wrote: > > I also think it would be a good idea for policy to require all setuid/gid > > bit grants to go through this or another list for peer review, much as > > pre-depends are supposed to. > > I a

Re: Data loss: suggestions for handling

2003-08-01 Thread Matthew Palmer
On Fri, Aug 01, 2003 at 01:59:43PM +0200, Roland Mas wrote: > Matthew Palmer (2003-08-01 19:51:46 +1000) : > > > The latest upstream version of a package I've begun to maintain, > > IRM, has a problem in that a portion of the data in the system > > (relating to software and licence assignment) can

Re: Data loss: suggestions for handling

2003-08-01 Thread Matthew Palmer
On Fri, Aug 01, 2003 at 08:04:09AM -0400, Stephen Frost wrote: > * Matthew Palmer ([EMAIL PROTECTED]) wrote: > > - dump the old software tables and store the dump somewhere, giving > > pointers to the dump in all sorts of useful places. But if I put it > > somewhere temporary (/tmp), i

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Matthias Urlichs
Hi, Matthew Garrett wrote: > The user should be able to choose whether the power > button triggers shutdown or suspend to disk, for instance. While I do agree that this kind of script is best placed in /etc, this kind of choice can be configured by a "normal" /etc/acpid.conf that's read by the sc

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 11:26:57AM -0400, Stephen Frost wrote: > * Matt Zimmerman ([EMAIL PROTECTED]) wrote: > > I absolutely support this idea. All set[ug]id setups should be reviewed > > before they go in the archive, and I volunteer to do the review (though I > > hope that others will help).

[PROPOSAL] Debian Release Plan [was: Re: Future releases of Debian]

2003-08-01 Thread Arnaud Vandyck
Adrian Bunk <[EMAIL PROTECTED]> wrote: [...] > [3] http://www.fs.tum.de/~bunk/Debian/freeze Reading the whole "Future releases of Debian" thread, I thought that the main idea was that Debian need a more 'readable' status for the next stable release. I propose to create a meta-package called

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Joel Baker
On Fri, Aug 01, 2003 at 11:34:11AM +0200, Tollef Fog Heen wrote: > * Steve Kemp > > | On Fri, Aug 01, 2003 at 08:20:08AM +0200, Tollef Fog Heen wrote: > | > | > what's wrong with a low-priority debconf question with a sane default? > | > | Absolutely nothing at all, but it's a slippery slope,

Re: debconf 2005 in Vienna, Austria

2003-08-01 Thread Joel Baker
On Fri, Aug 01, 2003 at 02:06:48PM +0300, Riku Voipio wrote: > > Yes. a debcamp of users would probably blow some fuse :) Speaking as someone who's held an FRA (US Federal Railroad Administration) crew and fireman cert - it's unlikely, unless you do something that would overload a normal house ci

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Thu, Jul 31, 2003 at 05:33:23PM +0100, Steve Kemp wrote: > There's probably a lot to be said for building a chroot installation > and installing each package in turn; but I don't have the time for that > at the moment. I have some basic tools for doing this kind of thing using UML's copy-o

Re: [PROPOSAL] Debian Release Plan [was: Re: Future releases of Debian]

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 07:03:46PM +0200, Arnaud Vandyck wrote: > I propose to create a meta-package called 'release-status-sarge' that > depends on packages (with version number) that we want to see in sarge. I don't think that the most important release goals can be expressed in terms of ve

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Joey Hess
Matt Zimmerman wrote: > On Fri, Aug 01, 2003 at 11:26:57AM -0400, Stephen Frost wrote: > > > * Matt Zimmerman ([EMAIL PROTECTED]) wrote: > > > I absolutely support this idea. All set[ug]id setups should be reviewed > > > before they go in the archive, and I volunteer to do the review (though I >

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Joey Hess
Matt Zimmerman wrote: > Personally, I would lean more towards having a setgid helper which writes to > the game's score file. It is possible to audit such helpers completely in a > short amount of time, and I feel that it would be far better to open > ourselves up to letting users forge their own

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 01:56:50PM -0400, Joey Hess wrote: > I think you can set it up so users cannot forge high scores by just > running such a helper. Make the helper sgid scorewriter, and make the > games setgid scoresetter (these names could be better). Then the helper > would refuse to write

Re: [PROPOSAL] Debian Release Plan

2003-08-01 Thread Arnaud Vandyck
Matt Zimmerman <[EMAIL PROTECTED]> wrote: > On Fri, Aug 01, 2003 at 07:03:46PM +0200, Arnaud Vandyck wrote: > > > I propose to create a meta-package called 'release-status-sarge' > > that depends on packages (with version number) that we want to see > > in sarge. > > I don't think that the

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 01:46:48PM -0400, Joey Hess wrote: > Here's a draft policy proposal. If this looks ok I'll submit it to the > policy group. Thanks for doing this. It looks fine, with the exception of a small typo: > + Since setuid and setgid programs are often a security rick,

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Josip Rodin
On Fri, Aug 01, 2003 at 02:15:26PM -0400, Matt Zimmerman wrote: > it would be trivial to add lintian/linda warnings for this, There's already a warning for set[ug]id in Lintian. -- 2. That which causes joy or happiness.

Re: [PROPOSAL] Debian Release Plan

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 07:50:15PM +0200, Arnaud Vandyck wrote: > Matt Zimmerman <[EMAIL PROTECTED]> wrote: > > I don't think that the most important release goals can be expressed > > in terms of version numbers. For example, RC bug fixes. I don't find > > goals such as "we want version X of

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 08:20:40PM +0200, Josip Rodin wrote: > On Fri, Aug 01, 2003 at 02:15:26PM -0400, Matt Zimmerman wrote: > > it would be trivial to add lintian/linda warnings for this, > > There's already a warning for set[ug]id in Lintian. Ah, ok. But the point was that it will miss many

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Stephen Frost
* Joey Hess ([EMAIL PROTECTED]) wrote: > --- policy.sgml.orig 2003-08-01 13:40:51.0 -0400 > +++ policy.sgml 2003-08-01 13:45:24.0 -0400 > @@ -7104,6 +7104,14 @@ > execute them. > > > + > + Since setuid and setgid programs are often a security

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Adam Heath
On Fri, 1 Aug 2003, Matt Zimmerman wrote: > On Fri, Aug 01, 2003 at 08:20:40PM +0200, Josip Rodin wrote: > > > On Fri, Aug 01, 2003 at 02:15:26PM -0400, Matt Zimmerman wrote: > > > it would be trivial to add lintian/linda warnings for this, > > > > There's already a warning for set[ug]id in Lintia

Re: CUPS should be the default print service in Debian/Sarge

2003-08-01 Thread Marcelo E. Magallon
On Thu, Jul 31, 2003 at 09:44:17AM -0400, Daniel Jacobowitz wrote: > The last time I tried to use CUPS, I found it to be so user friendly > that I couldn't get it to do anything useful. Very pretty, less > functional; and the documentation was entirely inadequate. > > On the other hand, whi

EARN $500 TO $700 PER WEEK DOWNLOADING FREE SOFTWARE!!

2003-08-01 Thread gary fiennes
Make $500 to $700 per week for downloading FREE software!! Dear friend!! We know it sounds too good to be true, but itfs REAL! We pay you hard cash for you to download and install this FREE software and we pay you each month that you continue to use it. Best of all you will only have

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Marco d'Itri
On Aug 01, David Z Maze <[EMAIL PROTECTED]> wrote: >Is this "script that gets run when the console user presses the power >button", and is it obvious that the user could potentially want to >configure it? If so, then it makes sense that it should be a >configuration file, and so by policy 10.

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Manoj Srivastava
On Fri, 1 Aug 2003 11:22:17 -0400, Matt Zimmerman <[EMAIL PROTECTED]> said: > On Fri, Aug 01, 2003 at 08:20:08AM +0200, Tollef Fog Heen wrote: >> what's wrong with a low-priority debconf question with a sane >> default? > As long as the sane default is the safe default, which is not to be > setg

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Manoj Srivastava
On Fri, 1 Aug 2003 13:46:48 -0400, Joey Hess <[EMAIL PROTECTED]> said: > Here's a draft policy proposal. If this looks ok I'll submit it to > the policy group. > Proposal: [DRAFT] require peer review for setuid and setgid program > introduction > Setuid and setgid programs are one of the main c

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 02:15:50PM -0500, Manoj Srivastava wrote: > Only if the game still works -- some games keep not just score > files, but saved games in the common area, and would not work as > expected if they could not write to that area. nethack is the only game which comes to mi

Sheet Music

2003-08-01 Thread Austin S
Could you please send me the sheet music for Dueling Banjos _ MSN 8 with e-mail virus protection service: 2 months FREE* http://join.msn.com/?page=features/virus

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Jim Penny
On Fri, 1 Aug 2003 16:01:03 -0400 Matt Zimmerman <[EMAIL PROTECTED]> wrote: > On Fri, Aug 01, 2003 at 02:15:50PM -0500, Manoj Srivastava wrote: > > > Only if the game still works -- some games keep not just score > > files, but saved games in the common area, and would not work as > > expec

Re: [PROPOSAL] Debian Release Plan

2003-08-01 Thread Arnaud Vandyck
Matt Zimmerman <[EMAIL PROTECTED]> wrote: > On Fri, Aug 01, 2003 at 07:50:15PM +0200, Arnaud Vandyck wrote: [...] > > If there are RC bugs to packages that 'release-status-sarge' depends > > on, it won't go to testing... > > Of course it would, unless it had a versioned dependency that could >

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Bernd Eckenfels
On Fri, Aug 01, 2003 at 01:46:48PM -0400, Joey Hess wrote: > Setuid and setgid programs are one of the main causes of security > holes and DSA's in Debian. Hmm DSA-360: no (daemon) DSA-359: yes (uid root: hardware access) DSA-358: no (kernel) DSA-357: no (daemon) DSA-356: yes (gid ga

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Bernd Eckenfels
On Fri, Aug 01, 2003 at 01:56:50PM -0400, Joey Hess wrote: > I think you can set it up so users cannot forge high scores by just > running such a helper. Make the helper sgid scorewriter, and make the > games setgid scoresetter Umm... you invent a scorewriter for removing the sgui games bit? And t

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 04:13:30PM -0400, Jim Penny wrote: > On Fri, 1 Aug 2003 16:01:03 -0400 Matt Zimmerman <[EMAIL PROTECTED]> wrote: > > nethack is the only game which comes to mind which does this, and I > > think it should probably be changed to keep the saved game in the user's > > home dir

Re: [PROPOSAL] Debian Release Plan

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 10:06:39PM +0200, Arnaud Vandyck wrote: > Matt Zimmerman <[EMAIL PROTECTED]> wrote: > > On Fri, Aug 01, 2003 at 07:50:15PM +0200, Arnaud Vandyck wrote: > [...] > > > If there are RC bugs to packages that 'release-status-sarge' depends > > > on, it won't go to testing... > >

Why doesn't yehia enter testing?

2003-08-01 Thread Andreas Rottmann
I wonder why yehia isn't entering testing. According to [0] it makes qmailmrtg7 uninstallable, but qmailmrtg7 is totally unrelated to yehia, AFAICS. Regards, Andy [0] http://bjorn.haxx.se/debian/testing.pl?package=yehia&expand=1 -- Andreas Rottmann | [EMAIL PROTECTED] | [EMAIL PROT

Re: Why doesn't yehia enter testing?

2003-08-01 Thread Steve Langasek
On Fri, Aug 01, 2003 at 10:40:12PM +0200, Andreas Rottmann wrote: > I wonder why yehia isn't entering testing. According to [0] it makes > qmailmrtg7 uninstallable, but qmailmrtg7 is totally unrelated to > yehia, AFAICS. > Regards, Andy > [0] http://bjorn.haxx.se/debian/testing.pl?package=yehia&

Re: [PROPOSAL] Debian Release Plan

2003-08-01 Thread Arnaud Vandyck
Matt Zimmerman <[EMAIL PROTECTED]> wrote: > On Fri, Aug 01, 2003 at 10:06:39PM +0200, Arnaud Vandyck wrote: > > [...] > > It does not matter to know in which version the bug will be > > fixed. What I want for sarge is emacs21 ( >= 21.2 ) so if every RC > > bugs are closed with 21.3 or 21

Re: Why doesn't yehia enter testing?

2003-08-01 Thread Colin Watson
On Fri, Aug 01, 2003 at 10:40:12PM +0200, Andreas Rottmann wrote: > I wonder why yehia isn't entering testing. According to [0] it makes > qmailmrtg7 uninstallable, but qmailmrtg7 is totally unrelated to > yehia, AFAICS. I've no idea where qmailmrtg7 is coming from, but actually yehia is caught up

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Manoj Srivastava
On Fri, 1 Aug 2003 22:31:16 +0200, Bernd Eckenfels <[EMAIL PROTECTED]> said: > BUT: i realy do think each game MUST offer the non sgid option. We > could have a global question herer: Hmm. Are you willing then to help modify each game to allow this to happen? Some changes are quite exte

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Manoj Srivastava
On Fri, 1 Aug 2003 16:01:03 -0400, Matt Zimmerman <[EMAIL PROTECTED]> said: > On Fri, Aug 01, 2003 at 02:15:50PM -0500, Manoj Srivastava wrote: >> Only if the game still works -- some games keep not just score >> files, but saved games in the common area, and would not work as >> expected if they

Re: [PROPOSAL] Debian Release Plan

2003-08-01 Thread Chris Cheney
On Fri, Aug 01, 2003 at 04:38:37PM -0400, Matt Zimmerman wrote: > On Fri, Aug 01, 2003 at 10:06:39PM +0200, Arnaud Vandyck wrote: > > > Matt Zimmerman <[EMAIL PROTECTED]> wrote: > > > On Fri, Aug 01, 2003 at 07:50:15PM +0200, Arnaud Vandyck wrote: > > [...] > > > > If there are RC bugs to packages

Re: [PROPOSAL] Debian Release Plan [was: Re: Future releases of Debian]

2003-08-01 Thread Bruce Sass
On Fri, 1 Aug 2003, Arnaud Vandyck wrote: > Adrian Bunk <[EMAIL PROTECTED]> wrote: > [...] > > [3] http://www.fs.tum.de/~bunk/Debian/freeze > > Reading the whole "Future releases of Debian" thread, I thought that > the main idea was that Debian need a more 'readable' status for the next > stab

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Bernd Eckenfels
On Fri, Aug 01, 2003 at 03:58:13PM -0500, Manoj Srivastava wrote: > Hmm. Are you willing then to help modify each game to allow > this to happen? Some changes are quite extensive. Hmm.. I am sure the maintainers of the affected packages will ask for help. Greetings Bernd -- (OO) -

Re: [PROPOSAL] Debian Release Plan

2003-08-01 Thread Bruce Sass
On Fri, 1 Aug 2003, Chris Cheney wrote: <...> > Do we even know which packages in sarge have RC bugs? The last time I > looked when you close a bug with an upload to sid it closes it entirely > still. So we don't really have a good idea of how many RC bugs exist in > sarge, only how many are in si

Re: [PROPOSAL] Debian Release Plan

2003-08-01 Thread Colin Watson
On Fri, Aug 01, 2003 at 04:45:42PM -0500, Chris Cheney wrote: > On Fri, Aug 01, 2003 at 04:38:37PM -0400, Matt Zimmerman wrote: > > And what if the version in testing has an RC bug? "release-status-sarge" > > says everything is OK. > > Do we even know which packages in sarge have RC bugs? The las

Re: [PROPOSAL] Debian Release Plan

2003-08-01 Thread Matt Zimmerman
On Fri, Aug 01, 2003 at 04:45:42PM -0500, Chris Cheney wrote: > On Fri, Aug 01, 2003 at 04:38:37PM -0400, Matt Zimmerman wrote: > > And what if the version in testing has an RC bug? "release-status-sarge" > > says everything is OK. > > Do we even know which packages in sarge have RC bugs? The la

Bug#203818: ITP: geeklog -- the ultimate weblog system

2003-08-01 Thread Bruno David Rodrigues
Package: wnpp Version: unavailable; reported 2003-08-01 Severity: wishlist * Package name: geeklog Version : 1.3.8 Upstream Author : Tony Bibbs and geeklog community <[EMAIL PROTECTED]> * URL : http://www.geeklog.net * License : GPLv2 Descr

Re: [PROPOSAL] Debian Release Plan

2003-08-01 Thread Colin Watson
On Fri, Aug 01, 2003 at 04:45:09PM -0600, Bruce Sass wrote: > The BTS needs to adopt a "package pool" like mentality, where bugs > are assigned to a particular version of a package instead of just the > package. Hey, man, we're working on it. -- Colin Watson [EMA

Bug#203820: Incorrect expanding [] glob

2003-08-01 Thread Artur R. Czechowski
Package: bash Version: 2.05b-8.1 Severity: normal Hello When LC_COLLATE is set to pl_PL [] glob does not work correctly: [EMAIL PROTECTED]:/tmp/bash-test$ echo $LC_COLLATE pl_PL [EMAIL PROTECTED]:/tmp/bash-test$ touch a b C c D e F G h [EMAIL PROTECTED]:/tmp/bash-test$ echo [A-Z] b c C D e F G h

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Darren Salt
I demand that Stephen Frost may or may not have written... [snip] > and a consensus reached which approves of the application and it's > needs. ? Almost: s/'// :-) -- | Darren Salt | linux (or ds) at | nr. Ashington, | woody, sarge, | youmustbejoking | Northumberland | RISC OS | demon

Re: Bug#203588: acpid: Shell script has nothing to do in /etc

2003-08-01 Thread Scott James Remnant
On Fri, 2003-08-01 at 14:58, Pierre THIERRY wrote: > > I think at least the RCness of this bug is rather dubious, frankly. If > > the script is configuration > > I don't think the script is meant to be edited... So it should be in > /usr/sbin. > I've edited it, and I'd bet I'm not the only one w

Re: Bug#203818: ITP: geeklog -- the ultimate weblog system

2003-08-01 Thread Scott James Remnant
On Fri, 2003-08-01 at 23:25, Bruno David Rodrigues wrote: > Package: wnpp > Version: unavailable; reported 2003-08-01 > Severity: wishlist > > * Package name: geeklog > Version : 1.3.8 > Upstream Author : Tony Bibbs and geeklog community > <[EMAIL PROTECTED]> >

Re: Bug#203818: ITP: geeklog -- the ultimate weblog system

2003-08-01 Thread Bruno Rodrigues
Scott James Remnant <[EMAIL PROTECTED]> wrote: > [-- text/plain, encoding quoted-printable, charset: ISO-8859-1, 29 lines --] > > On Fri, 2003-08-01 at 23:25, Bruno David Rodrigues wrote: > >> Package: wnpp >> Version: unavailable; reported 2003-08-01 >> Severity: wishlist >> >> * Package name

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Herbert Xu
Matt Zimmerman <[EMAIL PROTECTED]> wrote: > > nethack is the only game which comes to mind which does this, and I think it > should probably be changed to keep the saved game in the user's home > directory. This was clearly done in order to try to prevent cheating, but > again, these days the pla

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Brian T. Sniffen
Herbert Xu <[EMAIL PROTECTED]> writes: > Matt Zimmerman <[EMAIL PROTECTED]> wrote: >> >> nethack is the only game which comes to mind which does this, and I think it >> should probably be changed to keep the saved game in the user's home >> directory. This was clearly done in order to try to pre

Re: Data loss: suggestions for handling

2003-08-01 Thread Matthew Palmer
On Fri, Aug 01, 2003 at 11:36:52AM -0400, Matt Zimmerman wrote: > On Fri, Aug 01, 2003 at 07:51:46PM +1000, Matthew Palmer wrote: > > The latest upstream version of a package I've begun to maintain, IRM, has a > > problem in that a portion of the data in the system (relating to software > > and lic

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-01 Thread Joey Hess
Manoj Srivastava wrote: > This seems like a good practice kind of recommendation, not an > requirement, and as such, may be better suited to be included > in developers reference rather than policy, don't you think? I agree that policy can't force developers to do that, but policy is alrea

  1   2   >