Re: [sage-devel] On backdooring open source projects

[Lorenz Panny]

This also seems like a good time to reiterate an old comment of mine:
https://groups.google.com/g/sage-devel/c/Dq83PiiCAsU/m/RKSpD9_rDQAJ
...pasted below for your convenience.

On Tue, 21 Dec 2021 04:04:31 +0100, Lorenz Panny  wrote:
> On Mon, 20 Dec 2021 14:41:27 +0100, Michael Orlitzky 
> wrote:
> > We already have 214 standard packages. That's 214 pieces of software
> > copy & pasted into the sage releases... and 214 SPKGs that the sage
> > developers need to keep updating, and 214 distro packages that every
> > distro maintainer needs to keep track of as dependencies of the sage
> > package.  
> 
> It's also 214 software packages which might, for all we know, at any
> time be hijacked by The Bad Guys to run arbitrarily malicious code on
> every Sage user's machine.
> 
> This is terrifying.
> 
> (For examples where the modern "import * from internet" mentality has
> led to security disasters, just search for terms like "malicious npm".
> Luckily it seems less bad with pip packages for now, but not for any
> real reason. Every single piece of code we import adds huge security
> questions, because updates to the dependency may be published at any
> time totally invisible to Sage developers and the review process used
> in Sage development. The build scripts will simply pull and run it.)
> 
> We should reduce dependencies, not add more. _Especially_ when it's
> about non-essential convenience libraries.


On Wed, 17 Apr 2024 09:43:28 +0300, Georgi Guninski  wrote:
> If the recent xz backdoor drama didn't induce enough paranoia in you,
> here is a second chance exception:
> 
> https://www.theregister.com/2024/04/16/xz_style_attacks_continue/
> 
> 
> Open sourcerers say suspected xz-style attacks continue to target maintainers
> Social engineering patterns spotted across range of popular projects
> Tue 16 Apr 2024 // 14:07 UTC
> 
> Open source groups are warning the community about a wave of ongoing
> attacks targeting project maintainers similar to those that led to the
> recent attempted backdooring of a core Linux library.
> 
> -- 
> You received this message because you are subscribed to the Google Groups
> "sage-devel" group. To unsubscribe from this group and stop receiving emails
> from it, send an email to sage-devel+unsubscr...@googlegroups.com. To view
> this discussion on the web visit
> https://groups.google.com/d/msgid/sage-devel/CAGUWgD82%3DoROFFxZwrKZG6eB0Kd5GEKW8wrPw_Q4gm8WJjioCA%40mail.gmail.com.

-- 
You received this message because you are subscribed to the Google Groups 
"sage-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to sage-devel+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/sage-devel/20240418160443.79b10a15%40l4.

Re: [sage-devel] Re: VOTE: Revert merged PR with unreviewed dependencies

[David Roe]

On Thu, Apr 18, 2024 at 1:51 PM Matthias Koeppe 
wrote:

> David, none of this explains the misleading use of the word "unreviewed".


I believe that it does.  If there was confusion, hopefully this exchange
can help clarify it for others.
David


> On Thursday, April 18, 2024 at 10:47:36 AM UTC-7 David Roe wrote:
>
>> On Thu, Apr 18, 2024 at 1:43 PM Matthias Koeppe 
>> wrote:
>>
>>> I will first note that the title of this post is misleading.
>>> Everything that was merged has been reviewed -- as noted, many months
>>> ago.
>>>
>>
>> I agree that everything was reviewed.  However review refers not only to
>> the action of giving approval (which was done), but also to the status of
>> the PR as indicated by Positive Review, Needs Review, and Needs Work
>> labels.  This is the standard used by the release management scripts, as
>> well as our community understanding of what it means for a PR to be ready
>> for merging.  Under this definition, #36951 and #36676 did not have
>> positive review at the time that #36964 was merged.
>> David
>>
>> On Thursday, April 18, 2024 at 8:54:26 AM UTC-7 David Roe wrote:
>>>
 Hi all,
 Sage has had a review process for over 15 years, but a combination of
 recent changes has led to the merging of a PR into sage-10.4.beta3 of a
 change (#36964 ) that I
 believe should not (yet) have been merged.  In #37796
  I created a PR to revert
 the change, which was opposed by the author of the original change.  After 
 some
 voting
 
 using the disputed PR policy
 ,
 Matthias has asked
 
 for a vote on sage-devel about this reversion, in accordance with the
 section that "This process is intended as a lower-intensity method for
 resolving disagreements, and full votes on sage-devel override the process
 described below."  I am therefore asking you to vote (+1 means merge
 #37796  in order to
 revert #36964 ).

 First, here are the relevant parts of the history of this particular
 change:

 - #36964  was created on
 December 25 by Matthias, positively reviewed
 
 by Kwankyu on Decemebr 27, disputed, received enough votes
 
 to get a positive review on April 7, and was merged
 
 by Volker on April 12.  It had dependencies: #37667,
 #36951
 , and #36676
 .  While #37667
  had positive review and
 was already been merged, the other two were still disputed: they had
 received an initial positive review but others objected and discussion was
 ongoing.

 - #37667  is not disputed.

 - #36951  was created on
 December 23 by Matthias, positively reviewed
 
 by Kwankyu on January 1, disputed, received enough votes
 
 (3-1) to change to positive review on April 7, had a clarification to bring
 back to (3-2) and remove positive review, then was included in the merge of
 #36964 . On April 13,
 John Palmieri voted in favor
 ,
 so the current vote stands at 4-2, enough for the 2-1 threshold in order to
 get positive review under the disputed voting process.

 - #36676  was created on
 November 8 by Matthias, positively reviewed
 
 by John Palmieri on November 15, and then disputed.  The most recent count
 was 6-4 in favor
 
 (falling short of the 2-1 ratio needed under the disputed voting process);
 since then I voted
 
 in favor, it was included in the merge of #36964
 , and then Martin voted
 

Re: [sage-devel] VOTE: Revert merged PR with unreviewed dependencies

[David Joyner]

On Thu, Apr 18, 2024 at 11:54 AM David Roe  wrote:
>
> Hi all,
> Sage has had a review process for over 15 years, but a combination of recent 
> changes has led to the merging of a PR into sage-10.4.beta3 of a change 
> (#36964) that I believe should not (yet) have been merged.  In #37796 I 
> created a PR to revert the change, which was opposed by the author of the 
> original change.  After some voting using the disputed PR policy, Matthias 
> has asked for a vote on sage-devel about this reversion, in accordance with 
> the section that "This process is intended as a lower-intensity method for 
> resolving disagreements, and full votes on sage-devel override the process 
> described below."  I am therefore asking you to vote (+1 means merge #37796 
> in order to revert #36964).
>

+1


> First, here are the relevant parts of the history of this particular change:
>
> - #36964 was created on December 25 by Matthias, positively reviewed by 
> Kwankyu on Decemebr 27, disputed, received enough votes to get a positive 
> review on April 7, and was merged by Volker on April 12.  It had 
> dependencies: #37667, #36951, and #36676.  While #37667 had positive review 
> and was already been merged, the other two were still disputed: they had 
> received an initial positive review but others objected and discussion was 
> ongoing.
>
> - #37667 is not disputed.
>
> - #36951 was created on December 23 by Matthias, positively reviewed by 
> Kwankyu on January 1, disputed, received enough votes (3-1) to change to 
> positive review on April 7, had a clarification to bring back to (3-2) and 
> remove positive review, then was included in the merge of #36964. On April 
> 13, John Palmieri voted in favor, so the current vote stands at 4-2, enough 
> for the 2-1 threshold in order to get positive review under the disputed 
> voting process.
>
> - #36676 was created on November 8 by Matthias, positively reviewed by John 
> Palmieri on November 15, and then disputed.  The most recent count was 6-4 in 
> favor (falling short of the 2-1 ratio needed under the disputed voting 
> process); since then I voted in favor, it was included in the merge of 
> #36964, and then Martin voted against.
>
>
> At issue is the PR #36676, where discussion was still ongoing when #36964 was 
> merged.  The reversion of this PR proposed is purely for process reasons (I 
> voted in favor of #36676 before all this happened!).  The 5 Sage developers 
> opposed to #36676 deserve to have our processes followed.  What went wrong?
>
> I think what happened resulted from a combination of the new disputed voting 
> process, mismatched expectations around dependencies after the move to 
> github, and Volker's release management scripts.  Several developers 
> privately expressed concern prior to this merge about exactly this outcome, 
> and I reassured them that dependencies would be taken into account.  
> Unfortunately, dependencies are now (unlike in trac) just a text section of 
> the PR comment, and the release scripts only see the label.
>
>
> There are lots of things to discuss around this chain of events.  I ask that 
> everyone keep this thread focused on whether to merge #37796 in order to 
> revert #36964.  Some other topics, and places I suggest for discussing them:
> - Ways to improve or eliminate the disputed voting process: I suggest Dima's 
> recent thread.
> - The merits of #36676: I suggest discussing this either in the comments on 
> that PR, or starting a new sage-devel topic if you have broader changes to 
> raise about sage development.
> - Broader discussion of technical differences or philosophy: start a new 
> thread.
>
> I suggest a deadline of Sunday April 21 at 23:59 US/Pacific for this vote.
>
> Finally, many of these PRs have been plagued by conflict and inappropriate 
> language.  Please, keep comments friendly in this discussion.
> David
>
> --
> You received this message because you are subscribed to the Google Groups 
> "sage-devel" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to sage-devel+unsubscr...@googlegroups.com.
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/sage-devel/CAChs6_%3Dj65YMtx%3DOEX7r5wUcRxr0iCk__0mbqJTKBZB5c_RoBQ%40mail.gmail.com.

-- 
You received this message because you are subscribed to the Google Groups 
"sage-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to sage-devel+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/sage-devel/CAEQuuAUcjvuFMJHbQHB6T1H4_%2BQe0NZWBuqTirsJ3FfQC%2BMG7g%40mail.gmail.com.

Re: [sage-devel] Re: VOTE: Revert merged PR with unreviewed dependencies

[Matthias Koeppe]

David, none of this explains the misleading use of the word "unreviewed".


On Thursday, April 18, 2024 at 10:47:36 AM UTC-7 David Roe wrote:

> On Thu, Apr 18, 2024 at 1:43 PM Matthias Koeppe  
> wrote:
>
>> I will first note that the title of this post is misleading.
>> Everything that was merged has been reviewed -- as noted, many months ago.
>>
>
> I agree that everything was reviewed.  However review refers not only to 
> the action of giving approval (which was done), but also to the status of 
> the PR as indicated by Positive Review, Needs Review, and Needs Work 
> labels.  This is the standard used by the release management scripts, as 
> well as our community understanding of what it means for a PR to be ready 
> for merging.  Under this definition, #36951 and #36676 did not have 
> positive review at the time that #36964 was merged.
> David
>
> On Thursday, April 18, 2024 at 8:54:26 AM UTC-7 David Roe wrote:
>>
>>> Hi all,
>>> Sage has had a review process for over 15 years, but a combination of 
>>> recent changes has led to the merging of a PR into sage-10.4.beta3 of a 
>>> change (#36964 ) that I 
>>> believe should not (yet) have been merged.  In #37796 
>>>  I created a PR to revert 
>>> the change, which was opposed by the author of the original change.  After 
>>> some 
>>> voting 
>>>  
>>> using the disputed PR policy 
>>> , 
>>> Matthias has asked 
>>>  
>>> for a vote on sage-devel about this reversion, in accordance with the 
>>> section that "This process is intended as a lower-intensity method for 
>>> resolving disagreements, and full votes on sage-devel override the process 
>>> described below."  I am therefore asking you to vote (+1 means merge 
>>> #37796  in order to revert 
>>> #36964 ).
>>>
>>> First, here are the relevant parts of the history of this particular 
>>> change:
>>>
>>> - #36964  was created on 
>>> December 25 by Matthias, positively reviewed 
>>>  
>>> by Kwankyu on Decemebr 27, disputed, received enough votes 
>>>  
>>> to get a positive review on April 7, and was merged 
>>>  
>>> by Volker on April 12.  It had dependencies: #37667, 
>>> #36951 
>>> , and #36676 
>>> .  While #37667 
>>>  had positive review and 
>>> was already been merged, the other two were still disputed: they had 
>>> received an initial positive review but others objected and discussion was 
>>> ongoing.
>>>
>>> - #37667  is not disputed.
>>>
>>> - #36951  was created on 
>>> December 23 by Matthias, positively reviewed 
>>>  
>>> by Kwankyu on January 1, disputed, received enough votes 
>>>  
>>> (3-1) to change to positive review on April 7, had a clarification to bring 
>>> back to (3-2) and remove positive review, then was included in the merge of 
>>> #36964 . On April 13, John 
>>> Palmieri voted in favor 
>>> , 
>>> so the current vote stands at 4-2, enough for the 2-1 threshold in order to 
>>> get positive review under the disputed voting process.
>>>
>>> - #36676  was created on 
>>> November 8 by Matthias, positively reviewed 
>>>  
>>> by John Palmieri on November 15, and then disputed.  The most recent count 
>>> was 6-4 in favor 
>>>  
>>> (falling short of the 2-1 ratio needed under the disputed voting process); 
>>> since then I voted 
>>>  
>>> in favor, it was included in the merge of #36964 
>>> , and then Martin voted 
>>> against.
>>>
>>>
>>> At issue is the PR #36676 , 
>>> where discussion was still ongoing when #36964 
>>>  was 

[sage-devel] Re: VOTE: Revert merged PR with unreviewed dependencies

[Matthias Koeppe]

I will first note that the title of this post is misleading.
Everything that was merged has been reviewed -- as noted, many months ago.


On Thursday, April 18, 2024 at 8:54:26 AM UTC-7 David Roe wrote:

> Hi all,
> Sage has had a review process for over 15 years, but a combination of 
> recent changes has led to the merging of a PR into sage-10.4.beta3 of a 
> change (#36964 ) that I 
> believe should not (yet) have been merged.  In #37796 
>  I created a PR to revert 
> the change, which was opposed by the author of the original change.  After 
> some 
> voting 
>  
> using the disputed PR policy 
> , 
> Matthias has asked 
>  for 
> a vote on sage-devel about this reversion, in accordance with the section 
> that "This process is intended as a lower-intensity method for resolving 
> disagreements, and full votes on sage-devel override the process described 
> below."  I am therefore asking you to vote (+1 means merge #37796 
>  in order to revert #36964 
> ).
>
> First, here are the relevant parts of the history of this particular 
> change:
>
> - #36964  was created on 
> December 25 by Matthias, positively reviewed 
>  
> by Kwankyu on Decemebr 27, disputed, received enough votes 
>  to 
> get a positive review on April 7, and was merged 
>  by 
> Volker on April 12.  It had dependencies: #37667, 
> #36951 
> , and #36676 
> .  While #37667 
>  had positive review and was 
> already been merged, the other two were still disputed: they had received 
> an initial positive review but others objected and discussion was ongoing.
>
> - #37667  is not disputed.
>
> - #36951  was created on 
> December 23 by Matthias, positively reviewed 
>  
> by Kwankyu on January 1, disputed, received enough votes 
>  
> (3-1) to change to positive review on April 7, had a clarification to bring 
> back to (3-2) and remove positive review, then was included in the merge of 
> #36964 . On April 13, John 
> Palmieri voted in favor 
> , so 
> the current vote stands at 4-2, enough for the 2-1 threshold in order to 
> get positive review under the disputed voting process.
>
> - #36676  was created on 
> November 8 by Matthias, positively reviewed 
>  by 
> John Palmieri on November 15, and then disputed.  The most recent count was 
> 6-4 
> in favor 
>  
> (falling short of the 2-1 ratio needed under the disputed voting process); 
> since then I voted 
>  in 
> favor, it was included in the merge of #36964 
> , and then Martin voted 
> against.
>
>
> At issue is the PR #36676 , 
> where discussion was still ongoing when #36964 
>  was merged.  The reversion 
> of this PR proposed is purely for process reasons (I voted in favor of 
> #36676  before all this 
> happened!).  The 5 Sage developers opposed to #36676 
>  deserve to have our 
> processes followed.  What went wrong?
>
> I think what happened resulted from a combination of the new disputed 
> voting process, mismatched expectations around dependencies after the move 
> to github, and Volker's release management scripts.  Several developers 
> privately expressed concern prior to this merge about exactly this outcome, 
> and I reassured them that dependencies would be taken into account.  
> Unfortunately, dependencies are now (unlike in trac) just a text section of 
> the PR comment, and the release scripts only see the label.
>
>
> There are lots of 

Re: [sage-devel] Re: VOTE: Revert merged PR with unreviewed dependencies

[David Roe]

On Thu, Apr 18, 2024 at 1:43 PM Matthias Koeppe 
wrote:

> I will first note that the title of this post is misleading.
> Everything that was merged has been reviewed -- as noted, many months ago.
>

I agree that everything was reviewed.  However review refers not only to
the action of giving approval (which was done), but also to the status of
the PR as indicated by Positive Review, Needs Review, and Needs Work
labels.  This is the standard used by the release management scripts, as
well as our community understanding of what it means for a PR to be ready
for merging.  Under this definition, #36951 and #36676 did not have
positive review at the time that #36964 was merged.
David

On Thursday, April 18, 2024 at 8:54:26 AM UTC-7 David Roe wrote:
>
>> Hi all,
>> Sage has had a review process for over 15 years, but a combination of
>> recent changes has led to the merging of a PR into sage-10.4.beta3 of a
>> change (#36964 ) that I
>> believe should not (yet) have been merged.  In #37796
>>  I created a PR to revert
>> the change, which was opposed by the author of the original change.  After 
>> some
>> voting
>> 
>> using the disputed PR policy
>> ,
>> Matthias has asked
>> 
>> for a vote on sage-devel about this reversion, in accordance with the
>> section that "This process is intended as a lower-intensity method for
>> resolving disagreements, and full votes on sage-devel override the process
>> described below."  I am therefore asking you to vote (+1 means merge
>> #37796  in order to revert
>> #36964 ).
>>
>> First, here are the relevant parts of the history of this particular
>> change:
>>
>> - #36964  was created on
>> December 25 by Matthias, positively reviewed
>> 
>> by Kwankyu on Decemebr 27, disputed, received enough votes
>>  to
>> get a positive review on April 7, and was merged
>>  by
>> Volker on April 12.  It had dependencies: #37667,
>> #36951
>> , and #36676
>> .  While #37667
>>  had positive review and
>> was already been merged, the other two were still disputed: they had
>> received an initial positive review but others objected and discussion was
>> ongoing.
>>
>> - #37667  is not disputed.
>>
>> - #36951  was created on
>> December 23 by Matthias, positively reviewed
>> 
>> by Kwankyu on January 1, disputed, received enough votes
>> 
>> (3-1) to change to positive review on April 7, had a clarification to bring
>> back to (3-2) and remove positive review, then was included in the merge of
>> #36964 . On April 13, John
>> Palmieri voted in favor
>> ,
>> so the current vote stands at 4-2, enough for the 2-1 threshold in order to
>> get positive review under the disputed voting process.
>>
>> - #36676  was created on
>> November 8 by Matthias, positively reviewed
>>  by
>> John Palmieri on November 15, and then disputed.  The most recent count was 
>> 6-4
>> in favor
>> 
>> (falling short of the 2-1 ratio needed under the disputed voting process);
>> since then I voted
>>  in
>> favor, it was included in the merge of #36964
>> , and then Martin voted
>> against.
>>
>>
>> At issue is the PR #36676 ,
>> where discussion was still ongoing when #36964
>>  was merged.  The reversion
>> of this PR proposed is purely for process reasons (I voted in favor of
>> #36676  before all this
>> happened!).  The 5 Sage developers opposed to #36676
>>  deserve to have our
>> processes 

[sage-devel] Re: VOTE: Revert merged PR with unreviewed dependencies

['Martin R' via sage-devel]

+1, yes, the unintended merge should be reverted.

Martin

On Thursday 18 April 2024 at 17:54:26 UTC+2 David Roe wrote:

> Hi all,
> Sage has had a review process for over 15 years, but a combination of 
> recent changes has led to the merging of a PR into sage-10.4.beta3 of a 
> change (#36964 ) that I 
> believe should not (yet) have been merged.  In #37796 
>  I created a PR to revert 
> the change, which was opposed by the author of the original change.  After 
> some 
> voting 
>  
> using the disputed PR policy 
> , 
> Matthias has asked 
>  for 
> a vote on sage-devel about this reversion, in accordance with the section 
> that "This process is intended as a lower-intensity method for resolving 
> disagreements, and full votes on sage-devel override the process described 
> below."  I am therefore asking you to vote (+1 means merge #37796 
>  in order to revert #36964 
> ).
>
> First, here are the relevant parts of the history of this particular 
> change:
>
> - #36964  was created on 
> December 25 by Matthias, positively reviewed 
>  
> by Kwankyu on Decemebr 27, disputed, received enough votes 
>  to 
> get a positive review on April 7, and was merged 
>  by 
> Volker on April 12.  It had dependencies: #37667, 
> #36951 
> , and #36676 
> .  While #37667 
>  had positive review and was 
> already been merged, the other two were still disputed: they had received 
> an initial positive review but others objected and discussion was ongoing.
>
> - #37667  is not disputed.
>
> - #36951  was created on 
> December 23 by Matthias, positively reviewed 
>  
> by Kwankyu on January 1, disputed, received enough votes 
>  
> (3-1) to change to positive review on April 7, had a clarification to bring 
> back to (3-2) and remove positive review, then was included in the merge of 
> #36964 . On April 13, John 
> Palmieri voted in favor 
> , so 
> the current vote stands at 4-2, enough for the 2-1 threshold in order to 
> get positive review under the disputed voting process.
>
> - #36676  was created on 
> November 8 by Matthias, positively reviewed 
>  by 
> John Palmieri on November 15, and then disputed.  The most recent count was 
> 6-4 
> in favor 
>  
> (falling short of the 2-1 ratio needed under the disputed voting process); 
> since then I voted 
>  in 
> favor, it was included in the merge of #36964 
> , and then Martin voted 
> against.
>
>
> At issue is the PR #36676 , 
> where discussion was still ongoing when #36964 
>  was merged.  The reversion 
> of this PR proposed is purely for process reasons (I voted in favor of 
> #36676  before all this 
> happened!).  The 5 Sage developers opposed to #36676 
>  deserve to have our 
> processes followed.  What went wrong?
>
> I think what happened resulted from a combination of the new disputed 
> voting process, mismatched expectations around dependencies after the move 
> to github, and Volker's release management scripts.  Several developers 
> privately expressed concern prior to this merge about exactly this outcome, 
> and I reassured them that dependencies would be taken into account.  
> Unfortunately, dependencies are now (unlike in trac) just a text section of 
> the PR comment, and the release scripts only see the label.
>
>
> There are lots of things to discuss around this chain of events.  I ask 
> that everyone keep this 

Re: [sage-devel] VOTE: Revert merged PR with unreviewed dependencies

[Michael Orlitzky]

On Thu, 2024-04-18 at 11:54 -0400, David Roe wrote:
> I am therefore asking you to vote (+1 means merge #37796
>  in order to revert #36964
> ).

+1

-- 
You received this message because you are subscribed to the Google Groups 
"sage-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to sage-devel+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/sage-devel/f000412ee798040a72f7b86cce332529f8121993.camel%40orlitzky.com.

Re: [sage-devel] VOTE: Revert merged PR with unreviewed dependencies

[Dima Pasechnik]

+1 to reverting the wrong merge

On 18 April 2024 16:54:08 BST, David Roe  wrote:
>Hi all,
>Sage has had a review process for over 15 years, but a combination of
>recent changes has led to the merging of a PR into sage-10.4.beta3 of a
>change (#36964 ) that I
>believe should not (yet) have been merged.  In #37796
> I created a PR to revert the
>change, which was opposed by the author of the original change.  After some
>voting 
>using the disputed PR policy
>,
>Matthias has asked
> for a
>vote on sage-devel about this reversion, in accordance with the section
>that "This process is intended as a lower-intensity method for resolving
>disagreements, and full votes on sage-devel override the process described
>below."  I am therefore asking you to vote (+1 means merge #37796
> in order to revert #36964
>).
>
>First, here are the relevant parts of the history of this particular change:
>
>- #36964  was created on
>December 25 by Matthias, positively reviewed
>
>by Kwankyu on Decemebr 27, disputed, received enough votes
> to
>get a positive review on April 7, and was merged
> by
>Volker on April 12.  It had dependencies: #37667,
>#36951
>, and #36676
>.  While #37667
> had positive review and was
>already been merged, the other two were still disputed: they had received
>an initial positive review but others objected and discussion was ongoing.
>
>- #37667  is not disputed.
>
>- #36951  was created on
>December 23 by Matthias, positively reviewed
>
>by Kwankyu on January 1, disputed, received enough votes
> (3-1)
>to change to positive review on April 7, had a clarification to bring back
>to (3-2) and remove positive review, then was included in the merge of
>#36964 . On April 13, John
>Palmieri voted in favor
>, so
>the current vote stands at 4-2, enough for the 2-1 threshold in order to
>get positive review under the disputed voting process.
>
>- #36676  was created on
>November 8 by Matthias, positively reviewed
> by
>John Palmieri on November 15, and then disputed.  The most recent count was 6-4
>in favor
>
>(falling short of the 2-1 ratio needed under the disputed voting process);
>since then I voted
> in
>favor, it was included in the merge of #36964
>, and then Martin voted
>against.
>
>
>At issue is the PR #36676 ,
>where discussion was still ongoing when #36964
> was merged.  The reversion of
>this PR proposed is purely for process reasons (I voted in favor of #36676
> before all this happened!).
>The 5 Sage developers opposed to #36676
> deserve to have our processes
>followed.  What went wrong?
>
>I think what happened resulted from a combination of the new disputed
>voting process, mismatched expectations around dependencies after the move
>to github, and Volker's release management scripts.  Several developers
>privately expressed concern prior to this merge about exactly this outcome,
>and I reassured them that dependencies would be taken into account.
>Unfortunately, dependencies are now (unlike in trac) just a text section of
>the PR comment, and the release scripts only see the label.
>
>
>There are lots of things to discuss around this chain of events.  I ask
>that everyone keep this thread focused on whether to merge #37796
> in order to revert #36964
>.  Some other topics, and
>places I 

[sage-devel] Re: VOTE: Revert merged PR with unreviewed dependencies

[Nils Bruin]

+1 to merge #37796.

-- 
You received this message because you are subscribed to the Google Groups 
"sage-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to sage-devel+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/sage-devel/3390b9f2-ec6d-48eb-870f-4d357103bd32n%40googlegroups.com.

[sage-devel] VOTE: Revert merged PR with unreviewed dependencies

[David Roe]

Hi all,
Sage has had a review process for over 15 years, but a combination of
recent changes has led to the merging of a PR into sage-10.4.beta3 of a
change (#36964 ) that I
believe should not (yet) have been merged.  In #37796
 I created a PR to revert the
change, which was opposed by the author of the original change.  After some
voting 
using the disputed PR policy
,
Matthias has asked
 for a
vote on sage-devel about this reversion, in accordance with the section
that "This process is intended as a lower-intensity method for resolving
disagreements, and full votes on sage-devel override the process described
below."  I am therefore asking you to vote (+1 means merge #37796
 in order to revert #36964
).

First, here are the relevant parts of the history of this particular change:

- #36964  was created on
December 25 by Matthias, positively reviewed

by Kwankyu on Decemebr 27, disputed, received enough votes
 to
get a positive review on April 7, and was merged
 by
Volker on April 12.  It had dependencies: #37667,
#36951
, and #36676
.  While #37667
 had positive review and was
already been merged, the other two were still disputed: they had received
an initial positive review but others objected and discussion was ongoing.

- #37667  is not disputed.

- #36951  was created on
December 23 by Matthias, positively reviewed

by Kwankyu on January 1, disputed, received enough votes
 (3-1)
to change to positive review on April 7, had a clarification to bring back
to (3-2) and remove positive review, then was included in the merge of
#36964 . On April 13, John
Palmieri voted in favor
, so
the current vote stands at 4-2, enough for the 2-1 threshold in order to
get positive review under the disputed voting process.

- #36676  was created on
November 8 by Matthias, positively reviewed
 by
John Palmieri on November 15, and then disputed.  The most recent count was 6-4
in favor

(falling short of the 2-1 ratio needed under the disputed voting process);
since then I voted
 in
favor, it was included in the merge of #36964
, and then Martin voted
against.


At issue is the PR #36676 ,
where discussion was still ongoing when #36964
 was merged.  The reversion of
this PR proposed is purely for process reasons (I voted in favor of #36676
 before all this happened!).
The 5 Sage developers opposed to #36676
 deserve to have our processes
followed.  What went wrong?

I think what happened resulted from a combination of the new disputed
voting process, mismatched expectations around dependencies after the move
to github, and Volker's release management scripts.  Several developers
privately expressed concern prior to this merge about exactly this outcome,
and I reassured them that dependencies would be taken into account.
Unfortunately, dependencies are now (unlike in trac) just a text section of
the PR comment, and the release scripts only see the label.


There are lots of things to discuss around this chain of events.  I ask
that everyone keep this thread focused on whether to merge #37796
 in order to revert #36964
.  Some other topics, and
places I suggest for discussing them:
- Ways to improve or eliminate the disputed voting process: I suggest
Dima's recent thread 

Re: [sage-devel] VOTE: Revert merged PR with unreviewed dependencies

[julian...@fsfe.org]

+1

-- 
You received this message because you are subscribed to the Google Groups 
"sage-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to sage-devel+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/sage-devel/9130e263-f020-4efe-b64b-1d7b0b65b1e3n%40googlegroups.com.

[sage-devel] Urgent and important: Please vote on disputed PR #36964 (next step of the modularization project)

[Matthias Koeppe]

Dear all:

As an alternative to the proposal to back out the 
PR https://github.com/sagemath/sage/pull/36964 whose *disputed dependency 
PR https://github.com/sagemath/sage/pull/36676 which had not reached the 
required 2:1 supermajority *of the dispute-resolution process *(it 
currently only has a simple majority of 7 votes in favor, 5 votes against)* 
--- I am asking for your votes on that dependency PR 
https://github.com/sagemath/sage/pull/36676 to heal the process. This will 
avoid further delays and disruptions.

*What is the modularization project?* The Sage developer community has long 
been aware of the severe problems that the monolithic design of Sage has 
brought. See in particular the lively 2016 sage-devel thread "How we 
develop Sage" (https://groups.google.com/g/ sage-devel/c/29ndCD8z94k) 
initiated by William. In its current incarnation, "modularization project" 
refers to my proposal from May 2020,
- to use modern Python packaging ("PEP 517/518/660") and Python 3's 
"implicit namespace packages" to 
- break the Sage library into separately buildable and installable 
"distribution packages"
- while keeping the structure of the source tree mostly unchanged, 
monolithic, for the convenience of the Sage developer community.
For the project, hundreds of tickets/PRs have been prepared and merged over 
the past 4 years, see the Meta-ticket 
https://github.com/sagemath/sage/issues/29705 for a list.

*Has the Sage community been informed and consulted regarding the 
modularization project? *Yes, in addition to the normal review that all 
tickets/PRs underwent:
- I have given detailed presentations about the project in SageDays 110 
(2020), 112.358 (2022), 120 (2023), 
see https://github.com/sagemath/sage/issues/29705 for links.
- A chapter of the Sage Developer Guide, 
https://doc.sagemath.org/html/en/developer/packaging_sage_library.html#packaging-the-sage-library,
 
provides a detailed description of the design
- I have posted numerous times to sage-devel, most recently the series 
"SageMath modularization project: The five by five" (2023-06). See 
https://github.com/sagemath/sage/issues/29705 for links to all of these.
- Specifically, in the post "Modularization project: V. The blocs" 
(https://groups.google.com/g/sage-devel/c/kiB32zP3xD4/m/GJ0qF7TTAAAJ, 
2023-06), I outlined the design of the pip-installable packages such as 
sagemath-combinat, sagemath-graphs, sagemath-flint, sagemath-plot etc. 
- And in my 2023-11 post 
https://groups.google.com/g/sage-devel/c/kiB32zP3xD4/m/GJ0qF7TTAAAJ in the 
same thread, I asked: 
> Ready for review: A restructuring of our "all.py" files along these 
dependencies in https://github.com/sagemath/sage/pull/36676. This is an 
opportunity to review the contents of the proposed distributions 
implemented in Mega-PR https://github.com/sagemath/sage/pull/35095 (~50 
kLOC changes, not open for review). As 
https://github.com/sagemath/sage/pull/36676 rewrites all "all.py" files, it 
is also an opportunity for a deliberate coding style decision for these 
files. I welcome all constructive discussions in the PR.

*What does the PR https://github.com/sagemath/sage/pull/36676 do? *Per its 
title, "Restructure sage.*.all for modularization, replace relative by 
absolute imports". The PR is "mostly harmless": There are no user-visible 
changes; it's just a bunch of imports that are moved around. It includes no 
policy change of any kind; it only executes a design that was previously 
reviewed and carefully documented in separate PRs. Nothing permanent or 
irreversible is done here. The new files provide the top-level namespaces 
needed for doctesting modularized installations of Sage.

*Has it been reviewed?* Yes, David Coudert and John Palmieri did a detailed 
review. This was completed on November 15, 2023 --- over 5 months ago.

*How did this PR become "disputed"?* Back in November, one commenter 
floated an (untested) alternative design 
(https://github.com/sagemath/sage/pull/36676#pullrequestreview-1726079717); 
I explained 
in https://github.com/sagemath/sage/pull/36676#issuecomment-1806873154 why 
it's not suitable. Commenter demanded that the previously reviewed and 
documented design is reopened for discussion, 
https://github.com/sagemath/sage/pull/36676#issuecomment-1863667919. 

*What are the concerns that have been made known during the voting process 
for this PR (March/April 2024)?* I will not attempt to paraphrase, but here 
are links to some posts so that you can find the discussion.
- Gonzalo Tornaria 
https://github.com/sagemath/sage/pull/36676#issuecomment-2048350399, 
https://github.com/sagemath/sage/pull/36676#issuecomment-2048848093
- Michael 
Orlitzky https://github.com/sagemath/sage/pull/36676#issuecomment-2048600337
- Martin Rubey 
https://github.com/sagemath/sage/pull/36676#issuecomment-2050427818

*How to vote: *By posting a comment on the PR 
https://github.com/sagemath/sage/pull/36676.

Matthias

-- 
You received this message because you 

Re: [sage-devel] VOTE: Revert merged PR with unreviewed dependencies

[G. M.-S.]

-1

If something has been done that should be undone, I very much trust Volker
to take care of it when he can, without the need for endless time-consuming
discussions and votes.

Best,

Guillermo

On Thu, 18 Apr 2024 at 17:54, David Roe  wrote:

> Hi all,
> Sage has had a review process for over 15 years, but a combination of
> recent changes has led to the merging of a PR into sage-10.4.beta3 of a
> change (#36964 ) that I
> believe should not (yet) have been merged.  In #37796
>  I created a PR to revert
> the change, which was opposed by the author of the original change.  After 
> some
> voting
> 
> using the disputed PR policy
> ,
> Matthias has asked
>  for
> a vote on sage-devel about this reversion, in accordance with the section
> that "This process is intended as a lower-intensity method for resolving
> disagreements, and full votes on sage-devel override the process described
> below."  I am therefore asking you to vote (+1 means merge #37796
>  in order to revert #36964
> ).
>
> First, here are the relevant parts of the history of this particular
> change:
>
> - #36964  was created on
> December 25 by Matthias, positively reviewed
> 
> by Kwankyu on Decemebr 27, disputed, received enough votes
>  to
> get a positive review on April 7, and was merged
>  by
> Volker on April 12.  It had dependencies: #37667,
> #36951
> , and #36676
> .  While #37667
>  had positive review and was
> already been merged, the other two were still disputed: they had received
> an initial positive review but others objected and discussion was ongoing.
>
> - #37667  is not disputed.
>
> - #36951  was created on
> December 23 by Matthias, positively reviewed
> 
> by Kwankyu on January 1, disputed, received enough votes
> 
> (3-1) to change to positive review on April 7, had a clarification to bring
> back to (3-2) and remove positive review, then was included in the merge of
> #36964 . On April 13, John
> Palmieri voted in favor
> , so
> the current vote stands at 4-2, enough for the 2-1 threshold in order to
> get positive review under the disputed voting process.
>
> - #36676  was created on
> November 8 by Matthias, positively reviewed
>  by
> John Palmieri on November 15, and then disputed.  The most recent count was 
> 6-4
> in favor
> 
> (falling short of the 2-1 ratio needed under the disputed voting process);
> since then I voted
>  in
> favor, it was included in the merge of #36964
> , and then Martin voted
> against.
>
> At issue is the PR #36676 ,
> where discussion was still ongoing when #36964
>  was merged.  The reversion
> of this PR proposed is purely for process reasons (I voted in favor of
> #36676  before all this
> happened!).  The 5 Sage developers opposed to #36676
>  deserve to have our
> processes followed.  What went wrong?
>
> I think what happened resulted from a combination of the new disputed
> voting process, mismatched expectations around dependencies after the move
> to github, and Volker's release management scripts.  Several developers
> privately expressed concern prior to this merge about exactly this outcome,
> and I reassured them that dependencies would be taken into account.
> Unfortunately, dependencies are now (unlike in trac) just a text section of
> the PR comment, and the release scripts only see the label.
>
> There are lots of things to discuss around this 

[sage-devel] sagemath-10.4 beta3

[Henri Girard]

I can't build it any more : ubuntu 24.04 ryzen 9 9700x 24 threads

It used to build to version beta 1 but since no way  !

I build it on manajaro

I build it on wsl2

any help ?

--
You received this message because you are subscribed to the Google Groups 
"sage-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to sage-devel+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/sage-devel/11e88767-fbbf-4e9a-8d20-5e3f5279e633%40gmail.com.

Re: [sage-devel] Re: VOTE: Revert merged PR with unreviewed dependencies

[Marc Culler]

On Thursday, April 18, 2024 at 12:47:36 PM UTC-5 David Roe wrote:

On Thu, Apr 18, 2024 at 1:43 PM Matthias Koeppe wrote:

I will first note that the title of this post is misleading.
Everything that was merged has been reviewed -- as noted, many months ago.


I agree that everything was reviewed. 


And that is why I vote -1 on reverting the merge.

- Marc

-- 
You received this message because you are subscribed to the Google Groups 
"sage-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to sage-devel+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/sage-devel/b14df2d2-bfea-4cbb-afd4-706ad925e739n%40googlegroups.com.

Re: [sage-devel] Urgent and important: Please vote on disputed PR #36964 (next step of the modularization project)

[Dima Pasechnik]

Another attempt at derailing the ongoing vote, not unexpected.

Besides, Matthias must be really the greatest democrat of all - 1st he blocks a 
part of electorate from voting at the designated venue, and then invite 
everyone to vote there.

I urge everyone to ignore this alternative vote - to protest against this 
offensive behaviour.

Dima

On 18 April 2024 22:18:37 BST, Matthias Koeppe  wrote:
>Dear all:
>
>As an alternative to the proposal to back out the 
>PR https://github.com/sagemath/sage/pull/36964 whose *disputed dependency 
>PR https://github.com/sagemath/sage/pull/36676 which had not reached the 
>required 2:1 supermajority *of the dispute-resolution process *(it 
>currently only has a simple majority of 7 votes in favor, 5 votes against)* 
>--- I am asking for your votes on that dependency PR 
>https://github.com/sagemath/sage/pull/36676 to heal the process. This will 
>avoid further delays and disruptions.
>
>*What is the modularization project?* The Sage developer community has long 
>been aware of the severe problems that the monolithic design of Sage has 
>brought. See in particular the lively 2016 sage-devel thread "How we 
>develop Sage" (https://groups.google.com/g/ sage-devel/c/29ndCD8z94k) 
>initiated by William. In its current incarnation, "modularization project" 
>refers to my proposal from May 2020,
>- to use modern Python packaging ("PEP 517/518/660") and Python 3's 
>"implicit namespace packages" to 
>- break the Sage library into separately buildable and installable 
>"distribution packages"
>- while keeping the structure of the source tree mostly unchanged, 
>monolithic, for the convenience of the Sage developer community.
>For the project, hundreds of tickets/PRs have been prepared and merged over 
>the past 4 years, see the Meta-ticket 
>https://github.com/sagemath/sage/issues/29705 for a list.
>
>*Has the Sage community been informed and consulted regarding the 
>modularization project? *Yes, in addition to the normal review that all 
>tickets/PRs underwent:
>- I have given detailed presentations about the project in SageDays 110 
>(2020), 112.358 (2022), 120 (2023), 
>see https://github.com/sagemath/sage/issues/29705 for links.
>- A chapter of the Sage Developer Guide, 
>https://doc.sagemath.org/html/en/developer/packaging_sage_library.html#packaging-the-sage-library,
> 
>provides a detailed description of the design
>- I have posted numerous times to sage-devel, most recently the series 
>"SageMath modularization project: The five by five" (2023-06). See 
>https://github.com/sagemath/sage/issues/29705 for links to all of these.
>- Specifically, in the post "Modularization project: V. The blocs" 
>(https://groups.google.com/g/sage-devel/c/kiB32zP3xD4/m/GJ0qF7TTAAAJ, 
>2023-06), I outlined the design of the pip-installable packages such as 
>sagemath-combinat, sagemath-graphs, sagemath-flint, sagemath-plot etc. 
>- And in my 2023-11 post 
>https://groups.google.com/g/sage-devel/c/kiB32zP3xD4/m/GJ0qF7TTAAAJ in the 
>same thread, I asked: 
>> Ready for review: A restructuring of our "all.py" files along these 
>dependencies in https://github.com/sagemath/sage/pull/36676. This is an 
>opportunity to review the contents of the proposed distributions 
>implemented in Mega-PR https://github.com/sagemath/sage/pull/35095 (~50 
>kLOC changes, not open for review). As 
>https://github.com/sagemath/sage/pull/36676 rewrites all "all.py" files, it 
>is also an opportunity for a deliberate coding style decision for these 
>files. I welcome all constructive discussions in the PR.
>
>*What does the PR https://github.com/sagemath/sage/pull/36676 do? *Per its 
>title, "Restructure sage.*.all for modularization, replace relative by 
>absolute imports". The PR is "mostly harmless": There are no user-visible 
>changes; it's just a bunch of imports that are moved around. It includes no 
>policy change of any kind; it only executes a design that was previously 
>reviewed and carefully documented in separate PRs. Nothing permanent or 
>irreversible is done here. The new files provide the top-level namespaces 
>needed for doctesting modularized installations of Sage.
>
>*Has it been reviewed?* Yes, David Coudert and John Palmieri did a detailed 
>review. This was completed on November 15, 2023 --- over 5 months ago.
>
>*How did this PR become "disputed"?* Back in November, one commenter 
>floated an (untested) alternative design 
>(https://github.com/sagemath/sage/pull/36676#pullrequestreview-1726079717); 
>I explained 
>in https://github.com/sagemath/sage/pull/36676#issuecomment-1806873154 why 
>it's not suitable. Commenter demanded that the previously reviewed and 
>documented design is reopened for discussion, 
>https://github.com/sagemath/sage/pull/36676#issuecomment-1863667919. 
>
>*What are the concerns that have been made known during the voting process 
>for this PR (March/April 2024)?* I will not attempt to paraphrase, but here 
>are links to some posts so that you can find the 

Re: [sage-devel] Re: VOTE: Revert merged PR with unreviewed dependencies

[Kwankyu Lee]

-1 to be in sync with my vote in #37796.

On Friday, April 19, 2024 at 5:35:57 AM UTC+9 Marc Culler wrote:

>
>
> On Thursday, April 18, 2024 at 12:47:36 PM UTC-5 David Roe wrote:
>
> On Thu, Apr 18, 2024 at 1:43 PM Matthias Koeppe wrote:
>
> I will first note that the title of this post is misleading.
> Everything that was merged has been reviewed -- as noted, many months ago.
>
>
> I agree that everything was reviewed. 
>
>
> And that is why I vote -1 on reverting the merge.
>
> - Marc
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"sage-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to sage-devel+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/sage-devel/4fc94cac-c462-4a96-ae9f-be7be57c9fe8n%40googlegroups.com.

[sage-devel] Re: sagemath-10.4 beta3

[Henri Girard]

Sorry I forget error message

r 
/home/pi/sage/local/var/lib/sage/venv-python3.12/var/lib/sage/scripts/cypari/spkg-requirements.txt 
(line 1))
[cypari-2.1.5] [spkg-pipinst] Requirement already satisfied: 
cysignals>=1.7 in 
/home/pi/sage/local/var/lib/sage/venv-python3.12/lib/python3.12/site-packages 
(from cypari2@ 
file:///home/pi/sage/local/var/lib/sage/venv-python3.12/var/lib/sage/wheels/cypari2-2.1.5-cp312-cp312-linux_x86_64.whl->-r 
/home/pi/sage/local/var/lib/sage/venv-python3.12/var/lib/sage/scripts/cypari/spkg-requirements.txt 
(line 1)) (1.11.4)

[cypari-2.1.5] [spkg-pipinst] Installing collected packages: cypari2
[cypari-2.1.5] [spkg-pipinst] Successfully installed cypari2-2.1.5
[cypari-2.1.5] [spkg-pipinst] cat: ./spkg-pipinst.time: No such file or 
directory
[cypari-2.1.5] Deleting build directory 
/home/pi/sage/local/var/lib/sage/venv-python3.12/var/tmp/sage/build/cypari-2.1.5

[cypari-2.1.5] Finished installing cypari-2.1.5
[cypari-2.1.5] cat: /home/pi/sage/logs/pkgs/cypari-2.1.5.time: Aucun 
fichier ou dossier de ce nom

make[2]: *** [Makefile:3052 : all-build] Erreur 2
make[2] : on quitte le répertoire « /home/pi/sage/build/make »
***
Error building Sage.

The following package(s) may have failed to build (not necessarily
during this run of 'make all-build'):

* package: numpy-1.26.3
  last build time: avril 19 05:08
  log file:    /home/pi/sage/logs/pkgs/numpy-1.26.3.log

It is safe to delete any log files and build directories, but they
contain information that is helpful for debugging build problems.
WARNING: If you now run 'make' again, the build directory of the
same version of the package will, by default, be deleted. Set the
environment variable SAGE_KEEP_BUILT_SPKGS=yes to prevent this.

cat: logs/install.time: Aucun fichier ou dossier de ce nom
make[1]: *** [Makefile:40 : all-build] Erreur 1
make[1] : on quitte le répertoire « /home/pi/sage »
make: *** [Makefile:16 : build] Erreur 2
pi@pc:~/sa

Le 19/04/2024 à 05:16, Henri Girard a écrit :

I can't build it any more : ubuntu 24.04 ryzen 9 9700x 24 threads

It used to build to version beta 1 but since no way  !

I build it on manajaro

I build it on wsl2

any help ?



--
You received this message because you are subscribed to the Google Groups 
"sage-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to sage-devel+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/sage-devel/b32a9d43-a647-4edb-905a-753841d3a176%40gmail.com.

[sage-devel] Re: SingularError in rational_parameterization

[Antonio Rojas]

Works fine with system singular 4.3.2.p16 too, so this may be a bug in that 
particular Singular version.

El jueves, 18 de abril de 2024 a las 6:02:53 UTC+2, Kwankyu Lee escribió:

> No problem with Singular 4.3.2 included in sage (on mac).

-- 
You received this message because you are subscribed to the Google Groups 
"sage-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to sage-devel+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/sage-devel/cbab6f2e-f42c-4e97-a650-6089bb44a865n%40googlegroups.com.