Re: Our Networking Story

2014-03-07 Thread Soren Hansen
Sorry for sending this to you twice, Bryan, but my first attempt is stuck in
the moderation queue.

2014-03-07 1:18 GMT+05:30 Bryan Quigley bryan.quig...@canonical.com:
 *Network Restart*

 I'd like to start by asking each of you what you think is the correct
 way to restart networking on Ubuntu server?  Feel free to write it
 down and include it in any replies :).

Depends on why you're restarting the network.

If I've just changed an IP address, I'd probably do an ifdown $IFACE;
ifup $IFACE in screen or something. If the changes are more involved
than that, you need to be careful. One scenario I've seen countless
times is this:

1. Install Ubuntu Server on a network with DHCP.
2. Log in afterwards to switch to static IP's.
3. Change /etc/network/interfaces to have the static config.
4. Restart networking (using whichever of the methods you give as
   examples).
5. Verify that their static address is correctly assigned.
6. Come back an hour later and see that it's now using DHCP again.
7. Come to #ubuntu-server and complain.

What most people fail to realise (or consider) is that ifdown reads the
*current* configuration to see what to do. So when you've booted with
DHCP (and thus have a dhcp client running in the background), change
/etc/network/interfaces and run ifdown (directly or by way of
/etc/init.d/networking or whatever), ifdown has no clue that there's a
dhcp client that it needs to worry about. It just deconfigures that
interfaces as it would have any other statically configured interface,
because that's what /etc/network/interfaces says it should do.

When it's ifup'ed again, it gets the right address assigned, but the
dhcp client is still running in the background, waiting to screw up your
network config once the lease is about to expire.

This is a common example, but the same issue applies when you're
adding/removing up/pre-up/down/post-down commands. People usually
remember to make sure that anything you establish during up (or pre-up)
you also tear down in down (or post-down), but if you add or remove
things, you need to remember this caveat when restarting networking.

Depending on how helpful I feel when people ask this on #ubuntu-server,
I either explain this or just tell them to reboot. *shrug*

--
Soren Hansen
Ubuntu Developerhttp://www.ubuntu.com/
OpenStack Developer http://www.openstack.org/

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: SSH and the Ubuntu Server

2010-11-19 Thread Soren Hansen
On 18-11-2010 16:49, Marc Deslauriers wrote: 
 I want the person installing the server to actually make the choice
 to install ssh in order to realize that doing so may have
 consequences. ie: Oh wait, If I install ssh now, I should unplug the
 server from the network and configure ssh properly before hooking it
 back up...

What does configure ssh properly usually entail? Are these some
defaults we can change or offer as follow-on questions if people answer
Yes to this dialog? (Yes, I fully realise that will very likely result
in a net loss in usability on account of more questions asked, just
trying to get something constructive out of this thread)

-- 
Soren Hansen
Ubuntu Developerhttp://www.ubuntu.com/
OpenStack Developer http://www.openstack.org/



signature.asc
Description: OpenPGP digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: man 2 write - clarification

2010-03-18 Thread Soren Hansen
On Wed, Mar 10, 2010 at 12:48:24PM +0200, Daniel Baluta wrote:
 The following phrase taken from man 2 write manual page is confusing:
 POSIX  requires that a read(2) which can be proved to occur after a
 write() has returned returns the new data.

 I think you should you some comas to make a clear statement.
 POSIX  requires that a read(2), which can be proved to occur after a
 write() has returned, returns the new data.  thanks, Daniel.

You may find it clearer to read that way, but I believe it would
incorrect. A comma before a which clause suggests that it does not
/define/ the element to which it refers, but merely /describes/ it. In
this case the which clause adds essential, defining information about
the read(2) call, so I believe adding the comma would be wrong.

I should note that I'm not a native English speaker, nor have I studied
English grammar for well over 10 years. The Intarweb[1] does seem to
support my argument, though.

[1]: A search for comma before which yields a lot of promosing
 references. http://wire.rutgers.edu/p_grammar_comma2.html for one
 looks credible to me.

-- 
Soren Hansen
Ubuntu Developer  wanna-be grammar nazi
http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Bug: python2.5-minimal

2010-03-18 Thread Soren Hansen
On Mon, Mar 15, 2010 at 04:48:55PM +0100, mail2geo...@gmx-topmail.de wrote:
 I have done something wrong using ths list for my bug report, please
 let me know. I can only do better if I know that something is wrong.

This list is not for bug reports. There should be a way for you to file
the bug directly on Launchpad.

I can't quite pinpoint where the problem is. onboard says it works with
the current python version, which in Karmic is 2.6, but for some
reason python-central is attempting to byte-compile onboard for python
2.5. Are you running some sort of hybrid Jaunty/Karmic system or have
you perhaps changed /usr/bin/python to point to python2.5? 

-- 
Soren Hansen
Ubuntu Developer
http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: launchpad bug reports

2009-09-22 Thread Soren Hansen
On Mon, Sep 21, 2009 at 04:43:15PM -0500, Patrick Goetz wrote:
 Am I missing something?  It seems that bug reports in launchpad are 
 categorized by package name but not by distribution.  Wouldn't it make 
 sense to take advantage of the distribution hierarchy in order to make 
 this system easier to work with?
 
 I.e. I'm specifically trying to get some problems with packages in 
 Karmic Koala sorted out and am not interested in scrolling through lists 
 of problems that people had with, say, Postfix, in the 8.04 release.

I don't think it would be very useful to assume that any bug in Hardy
was magically fixed in Intrepid. Hence, dividing bugs by series[1] seems
like a bad plan to me. If a bug is still open, that should mean that it
still exists in the current development release (and likely every
release in between the time when it was recorded and now).  To track
bugs in older series, we use bug tasks.  I tried to find a useful link
on the wiki, but to no avail.  Perhaps someone with stronger wiki-fu og
Google-fu than I can help with that.

[1]: Hardy, Intrepid, Jaunty, Karmic, and Lucid are all series. The
distribution is simply Ubuntu.

-- 
Soren Hansen | 
Lead virtualisation engineer | Ubuntu Server Team
Canonical Ltd.   | http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: freeradius + tls/peap support

2009-08-07 Thread Soren Hansen
On Fri, Aug 07, 2009 at 10:18:41PM +0800, Chan Chung Hang Christopher wrote:
 What is the deal with disabling support for tls/peap and going so far
 as to check for linking to libssl in the rules file to break building
 the package with openssl support?

/usr/share/doc/freeradius/copyright explains it:

Some GPL parts of this software depend on OpenSSL, the combination of
which cannot be distributed in compiled binary form.


The debian/rules snippet is presumably there to ensure that noone
accidentally uploads something to the archive in Debian (from whence
this this change originated) that violates this.

One could argue that we can reasonably safely remove this, because we
always build packages in a clean environment[1], and we have little
benefit from preventing people from building them locally and using them
locally.  They are simply undistributable, so as long as we never have
them in the archive, we're in the clear, no?

[1]: Since all our packages are built on buildd's, whereas Debian uses
binary builds from developers.

-- 
Soren Hansen | 
Lead virtualisation engineer | Ubuntu Server Team
Canonical Ltd.   | http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Properly identifying applications

2009-06-09 Thread Soren Hansen
On Tue, Jun 09, 2009 at 09:50:26AM -0500, Patrick Goetz wrote:
 It makes sense to me that all applications should be identified by
 their name as well as their function in gnome GUI menus.

I disagree. I /love/ the fact that our menu's aren't full of meaningless
names of applications. In fact, Gimp's and f-spot's menu entries annoy
me *a lot*.

 Furthermore, not doing so frequently increases confusion for naive
 users.

You think Evince is more helpful than Document Viewer? How so?

 For example, due to ongoing bugs with the linux acrobat reader
 postscript rendering engine, users frequently come to our office
 because they couldn't print a pdf file.  We tell them to use evince
 instead of acrobat reader.  They look for a program called evince in
 the menus, and can't find anything. 

Couldn't this be easily resolved by you telling them to use Document
Viewer rather than telling them to use Evince?

 No one knows to look for Document Viewer 

If you put yourself in the place of someone who is not used to Linux:
You have a document you want to open (and for some reason you don't just
click on it in Nautilus, but let's ignore that for a little bit).  How
are you supposed to know to look for something called Evince? How is
having that name in the menu going to be helpful?

 Of course the complication in the linux world is the plethora of
 choices which exist for each application type, especially on larger
 networks like ours where users are strongly opinionated about which
 {editor, compiler, pdf viewer, image viewer, browser, etc.} is the
 best one and must be installed.  How to create a manageable user
 experience for the less knowledgeable user in the presence of dozens
 of choices for each task?  I'm not sure what the answer is at the
 moment, but a no-brainer choice is to clearly identify WHAT
 application is being invoked from the menu.

I couldn't disagree more. The no-brainer choice it exactly to NOT show
which application is being invoked. What's important is the task it
performs, not what it's called. If the user needs to know the name of
the application he's using to do something, we're doing something wrong.
To view documents, you use a document viewer. If we change the default
document viewer at some point, the user's experience shouldn't change.
They shouldn't have to know that we've replaced Evince with
FooPDFViewer. They should just keep using Document Viewer and have the
best possible experience.

-- 
Soren Hansen | 
Lead Virtualisation Engineer | Ubuntu Server Team
Canonical Ltd.   | http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Valgrind itself SIGSEGVs on ubuntu x64

2008-10-21 Thread Soren Hansen
On Sun, Oct 05, 2008 at 05:14:24PM +0200, Martin Olsson wrote:
 I also noted that there is no -dbgsym package for valgrind itself
 available in ddebs (there is also no valgrind-dbg)?  I thought that
 every single package had a corresponding -dbgsym in ddebs? 

No, only the ones using debhelper (actually, only the ones using
dh_strip). This is the vast majority of packages, though.  valgrind does
indeed use debhelper, but doesn't call dh_strip. Hence, it doesn't
generate ddeb's.

-- 
Soren Hansen   | 
Virtualisation specialist  | Ubuntu Server Team
Canonical Ltd. | http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Minutes from the Technical Board, 2008-07-15

2008-08-20 Thread Soren Hansen
On Wed, Aug 20, 2008 at 06:43:16AM +0800, Onno Benschop wrote:
 If you recall the google research about hard drive failures you will
 have remembered that SMART is no indication of impending failure.

And if you recall the very same research, you will have remembered that
SMART *does* indicate of impending failure. The conclusion of the study
was that if SMART says that he drive is about to go bust, it's very
likely to be true. However, if SMART says everything is fine, that's not
necessarily true.

-- 
Soren Hansen   | 
Virtualisation specialist  | Ubuntu Server Team
Canonical Ltd. | http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Minutes from the Technical Board, 2008-07-15

2008-08-20 Thread Soren Hansen
On Wed, Aug 20, 2008 at 05:05:25PM +0800, Onno Benschop wrote:
 If you recall the google research about hard drive failures you will
 have remembered that SMART is no indication of impending failure.
 And if you recall the very same research, you will have remembered
 that SMART *does* indicate of impending failure. The conclusion of
 the study was that if SMART says that he drive is about to go bust,
 it's very likely to be true. However, if SMART says everything is
 fine, that's not necessarily true.
 And your last sentence is precisely why I raised my point in the first
 place.
 
 The abstract from the report reads:
 
  [..] we conclude that models based on SMART parameters alone are
 unlikely to be useful for predicting individual drive failures.

The key word is alone. SMART *does* provide an indication of impending
failure. A 99.9% full filesystem is an indication of impending system
failure. However, just because your filesystems are all only 25% full,
that doesn't mean that the building housing your servers is not on fire,
which is another quite sure indication of impending system failure.
Hence, a model based on filesystem fullness alone is not likely to be
useful for predicting individual system failure.

 And that is my point, individual drive failures, that is, those on a
 single machine, which is what we were discussing if I'm not mistaken.

Right. Although, the idea of reporting this data for all of the worlds
Ubuntu systems to give the owners of identical devices an early warning
if others people's are starting to fail is interesting, but an entirely
different discussion.

-- 
Soren Hansen   | 
Virtualisation specialist  | Ubuntu Server Team
Canonical Ltd. | http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: What is terranova?

2008-03-14 Thread Soren Hansen
On Thu, Mar 13, 2008 at 06:05:13PM +, Colin Watson wrote:
  by the way, why do I get this error: id: cannot find name for group
  ID 128
 What are you doing when you encounter this error?

Also, do you still see it? IIRC the live cd you used was from the day
when libc6 was broken, so I wouldn't be suprised if it had quite a few
oddities.

-- 
Soren Hansen
Ubuntu Server Team
http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: libc borked

2008-03-13 Thread Soren Hansen
On Thu, Mar 13, 2008 at 07:14:23AM -0400, Scott Kitterman wrote:
  Cory's comment was a bit intemperate, but I feel your response was
  not at all helpful and that it really minimized Cory's extensive
  contributions to Ubuntu developmen.
 But it's cool for Cory to flame doko because Cory's a developer?
 Interesting.
 No, not cool.  I just didn't like the response.  We all write things
 we shouldn't every now and then.  It doesn't mean we need to have
 random strangers sending us form letters.

Ok, so Cory sends an e-mail to a public mailing list in an intemperate
tone. Todd finds this inapproriate, and shares this feeling with Cory
and the rest of us, in a tone this is the diametrically opposite of
intemperate.  And you decide to tell *Todd* off due to his tone, because
Cory has done more work on Ubuntu than him?

Well, as dholbach so nicely put it, if people are regular contributors
to Ubuntu, they should be setting a good example, so if I were to tell
one of Todd or Cory off, it'd most certainly be Cory. I would have done
so, but Todd did it just fine, IMO, and applying your logic, since I've
been a core-dev longer than you, my opinion is better than yours, right?

-- 
Soren Hansen   | 
Virtualisation specialist  | Ubuntu Server Team
Canonical Ltd. | http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: libc borked

2008-03-13 Thread Soren Hansen
On Thu, Mar 13, 2008 at 07:29:57AM -0400, Cory K. wrote:
 Cory's comment was a bit intemperate, but I feel your response was
 not at all helpful and that it really minimized Cory's extensive
 contributions to Ubuntu developmen.
 But it's cool for Cory to flame doko because Cory's a developer?
 Interesting.
 If you think that was a flame then I would say you're a tad sensitive.

I'm sure you meant it as a helpful and friendly assessment of the
quality of the work of one of our fellow developers../sarcasm

 It comes down to why would a package be uploaded at this stage in the
 cycle that renders systems unbootable?

Remind me: At exactly which stage in the cycle is it appropriate to
wilfully upload things to Ubuntu that renders systems unbootable?

 I could completely see if this were months ago but a day before beta
 freeze? 4 weeks 'till release? I do understand sh*t happens but
 something this major now shouldn't.
 
 I was mad. I'm human. I'm over it. Time to spend the day rebuilding 3
 machines. ;)

It's funny how your being human seems to excuse you from being
pointlessly difficult towards others when they've exercised their
humanity in an unfortunate way.

-- 
Soren Hansen   | 
Virtualisation specialist  | Ubuntu Server Team
Canonical Ltd. | http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Accepted: ubuntu-vm-builder 0.2 (source)

2008-02-22 Thread Soren Hansen
On Fri, Feb 22, 2008 at 12:22:43PM +1100, Sarah Hobbs wrote:
 This is a bugfix release that fixes a few typos (well, several
 instances of the same typo, really), and fixes a call to qemu-img
 that breaks because I added more sanity checks to qemu-img and this
 particular call was bit lacking in the sanity department.
 Even so, where is the bug?  

Line 892 of ubuntu-vm-builder. Oh, you mean bug *report*?

 As far as i'm aware, it still classes under the new MOTU feature
 freeze process, and so should still have a bug, as it's a bug fix
 release.

Oh, this again.. I continue to fail to see the point of me having to do
additional paperwork just because I chose to use native versioning (so
every upload involves an upstream version bump).  Well, at least it'll
bost my LP karma a bit.

 When I saw this earlier, and checked for an appropriate bug, I found
 nothing.  Why?

Because I was more interested in fixing the bug than doing paperwork.

-- 
Soren Hansen
Virtualisation specialist
Ubuntu Server Team
http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Accepted: ubuntu-vm-builder 0.2 (source)

2008-02-21 Thread Soren Hansen
On Fri, Feb 22, 2008 at 12:35:14AM -, Soren Hansen wrote:
* New release.

Sorry, that was a little.. um.. terse :)

This is a bugfix release that fixes a few typos (well, several instances
of the same typo, really), and fixes a call to qemu-img that breaks
because I added more sanity checks to qemu-img and this particular call
was bit lacking in the sanity department.

-- 
Soren Hansen
Virtualisation specialist
Ubuntu Server Team
http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: update-db cron job: solving a long-standing issue

2007-09-15 Thread Soren Hansen
On Sat, Sep 15, 2007 at 04:54:57PM +0200, Milan wrote:
 We can also think (and this is my opinion ;-) ) that the locate
 command is only used by advanced users that now how to install slocate
 in two minutes, and thus that we don't need to install it by default.

I agree with this. Heck, I consider myself a pretty advanced user, and
the number of times I've used locate in my life can be counted on one
hand (with enough fingers to spare to pick my nose and do a bit of
typing). I realise the benifits of it, but I've just never gotten used
to it, and it's really not very easily discoverable. If one were to find
mention of it in a magazine or on IRC or whatever, it /is/ only a quick
apt-get away. IMO, nuke it. IME the utility is never really used, and
the daily(?) updatedb run is annoying and confusing to users who haven't
asked for it.

-- 
Soren Hansen
Ubuntu Server Team
http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Single CD for Server Desktop?

2007-07-30 Thread Soren Hansen
On Mon, Jul 30, 2007 at 04:17:53PM +0100, Eoin Rogers wrote:
 Maybe this could be done by compressing the data on the disc and including
 something to auto-decompress it on the fly, like what happens with Knoppix.
 Or is so much extra software required that even this is impossible?

We already do this. Last I checked the unpacked LiveCD filesystem were a
couple of gigabytes and it's squashed onto a 700MB CD.

-- 
Soren Hansen
Ubuntu Server Team
http://www.ubuntu.com/


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: RFC: alias tar=tar --backup ?

2007-05-17 Thread Soren Hansen
On Thu, May 17, 2007 at 06:03:18PM -0700, Micah Cowan wrote:
  A completely different approach could be that the calls that
  actually write to a file check that the file does not exist. You
  could activate this with a system-wide flag, but I strongly suspect
  that this would be more work than the few words it took for me to
  write the idea.
 The call of which you speak (open()) already does this, unless you
 tell it that you specifically wish to overwrite files (which tar
 does).

That's not quite right.

Usually, you'll just pass the O_CREAT and O_TRUNC flags to open(2) in
order to just open the file (creating it if it doesn't exist already),
while you have to explicitly give it the O_EXCL flag to bail out if the
file already exists. Passing --backup to tar makes it check if it should
make a backup of the file, does so, and then proceeds to open the file
with (O_WRONLY | O_BINARY | O_CREAT | O_TRUNC) unless you pass it '-k',
in which case O_TRUNC is replaced with O_EXCL.

-- 
| Soren Hansen| Linux2Go  | http://Linux2Go.dk/ |
| Seniorkonsulent | Lindholmsvej 42, 2. TH| +45 46 90 26 42 |
| [EMAIL PROTECTED]  | 9400 Norresundby, Denmark | GPG key: E8BDA4E3   |


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Open Port Indicator?

2007-03-20 Thread Soren Hansen
On Tue, Mar 20, 2007 at 08:57:36AM -0400, Peter Whittaker wrote:
   UC3:Fritz is setting up a classroom or other contained
   environment,

   UC4:Barbara is a security researcher setting up a honeypot.
 
  I fail to see why UC[34] would require unauthenticated access.
 In Barbara's case, unauthenticated access is required because she
 *wants* the box to be vulnerable, at least via this vector: She is
 setting up a honeypot, she wants attackers to get in (at least part
 way). Given she's a security researcher, she can probably hack the
 code to do what she wants, so UC4 may be off the table.

It's *so* off the table. We should not make provide any sort of UI for
setting up a honey pot, just like we don't keep vulnerable versions of
e.g. sendmail around. :-)

I see don't particularly object to keeping the option around by way of
gconf. The UI should just not allow it.

-- 
| Soren Hansen| Linux2Go  | http://Linux2Go.dk/ |
| Seniorkonsulent | Lindholmsvej 42, 2. TH| +45 46 90 26 42 |
| [EMAIL PROTECTED]  | 9400 Norresundby, Denmark | GPG key: E8BDA4E3   |


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Open Port Indicator?

2007-03-15 Thread Soren Hansen
On Thu, Mar 15, 2007 at 09:37:03PM +0900, Arwyn Hainsworth wrote:
 On 15/03/07, Soren Hansen [EMAIL PROTECTED] wrote:
 On Thu, Mar 15, 2007 at 10:23:32AM +0900, Arwyn Hainsworth wrote:
  I've always thought that the option of just giving any user access
  without authentication is broken and should be removed. Something
  like what happened to this user was bound to happen sooner or later
  and I can't think up a use case that justifies its presence. Can any
  of you?
  I had a friend once who kept his home PC on so that he could log in
  via remote desktop from work. IMHO that's a perfectly normal use case,
  so it should be possible to log in without local user intervention and
  removing that ability would be a mistake.
 An he can't remember a simple password?
 I think you are misunderstanding my point or I was misunderstanding
 yours.

I asked for a use case where it made sense to allow access without any
form of authentication. Your response was a use case where someone
needed access from the outside to an unmonitored machine. I failed to
understand why said user was dependent on not having to give a password
for that.

 Some form of authentication should be required. It can be either
 password authentication, public/private key authentication, direct
 user intervention or a mixture of 2 or 3 of the above. Providing at
 least one method of authentication is active I see no problem, however
 I do agree that allowing remote connection without any form of
 authentication is a security flaw and should not be possible.

Indeed.

 After checking Preferences-Remote_Desktop it does indeed seem to be
 possible to disable all forms of authentication. Not good.

If noone comes up with a proper use case I'll just hack together a patch
that makes it impossible.

-- 
| Soren Hansen| Linux2Go  | http://Linux2Go.dk/ |
| Seniorkonsulent | Lindholmsvej 42, 2. TH| +45 46 90 26 42 |
| [EMAIL PROTECTED]  | 9400 Norresundby, Denmark | GPG key: E8BDA4E3   |


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Open Port Indicator?

2007-03-14 Thread Soren Hansen
On Wed, Mar 14, 2007 at 03:37:57PM -0600, Conrad Knauer wrote:
 Now, what concerns me is that once you enable Remote Desktop there is
 no Notification Area icon indicating that its active and so it can
 easily be forgotten about.

I've always thought that the option of just giving any user access
without authentication is broken and should be removed. Something like
what happened to this user was bound to happen sooner or later and I
can't think up a use case that justifies its presence. Can any of you?

-- 
| Soren Hansen| Linux2Go  | http://Linux2Go.dk/ |
| Seniorkonsulent | Lindholmsvej 42, 2. TH| +45 46 90 26 42 |
| [EMAIL PROTECTED]  | 9400 Norresundby, Denmark | GPG key: E8BDA4E3   |


signature.asc
Description: Digital signature
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss