Re: Solang or Shotwell vs. F-Spot for Lucid

2009-12-08 Thread Wouter Stomp
On Tue, Dec 8, 2009 at 10:57 AM, Sebastien Bacher seb...@ubuntu.com wrote:

 Did anybody looked at how those other software handle exporting to
 flick, picasa or other web services?


For Shotwell uploading to Flickr and Facebook is planned for 0.4 which
is to be released in December. Picasa is planned for a later version.
Btw. an important feature missing from all available programs is
uploading to online print services.

A list of all planned features is here: http://trac.yorba.org/report/16

An (incomplete) comparison of photo managers is on their wiki:
http://trac.yorba.org/wiki/ShotwellFeatureComparison

Solang also has exporting to webservices on the todo list, but they
also have more extensive plans: acting as a front-end to them, as a
photo manager for both your photos on the desktop and in the cloud.

Cheers,

Wouter

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Keyboard layout change visual feedback. Thoughts?

2009-03-15 Thread Wouter Stomp
On Sun, Mar 15, 2009 at 3:59 AM, Dylan McCall dylanmcc...@gmail.com wrote:
 Here is a cute little bug (and patch) I filed upstream...

 Is it on the right track? Suggestions, etc. would be great :)



It looks good, but I think it should also say how you can change it
back, because if you accidentily hit those keycombination you still
don't have a clue how to get back to the previous situation.

Cheers,

Wouter

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Data loss with trash in intrepid?

2008-10-02 Thread Wouter Stomp
On Thu, Oct 2, 2008 at 1:15 PM, Vincenzo Ciancia [EMAIL PROTECTED] wrote:
 I must have pressed DEL by mistake on my keyboard with the desktop
 focused, and deleted the directory.

Such a thing should not be possible to happen unnoticed. See:

https://bugs.launchpad.net/ubuntu/+source/nautilus/+bug/95853

Cheers,

Wouter

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: F-spot 0.5.0.1 for Intrepid?

2008-09-27 Thread Wouter Stomp
On Sat, Sep 27, 2008 at 4:24 PM, Evan [EMAIL PROTECTED] wrote:
 The current version of F-spot in Intrepid was released back in May. A new
 version was released in the middle of September.

 Is there any hope of seeing this in Intrepid? Should I bother filing a
 freeze exception request for it?


There is already an open bug report about that:
https://bugs.launchpad.net/ubuntu/+source/f-spot/+bug/271895

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Landscape-common installed by default in intrepid?

2008-09-27 Thread Wouter Stomp
Hello,

I was wondering why landscape-common is recommended by ubuntu-desktop
in intrepid? It seems only useful to Canonical clients and even then I
guess they also need to install the landscape-client package? It seems
to include one useful command, landscape-sysinfo, but 918kb seems a
lot for the limited info it provides, none of which isn't also
provided by other utilities included in Ubuntu.

Thanks,

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Bugs for NM 0.7

2008-09-07 Thread Wouter Stomp
On Fri, Sep 5, 2008 at 7:49 PM, Jordan Mantha [EMAIL PROTECTED] wrote:
 On Fri, Sep 5, 2008 at 9:24 AM, Peteris Krisjanis [EMAIL PROTECTED] wrote:
 Btw, a slight offtopic from this message, but does it mean that there
 will be no network-admin from g-s-t in Ibex?

 Would be very sad if that happened.

 It won't be installed by default. However, it is still in the archive
 in the gnome-network-admin package. NM 0.7 seems to have gotten to the
 place where it has basically all the same features so having 2 tools
 to do the same thing becomes an issue. I was really against removing
 the g-s-t network admin tool, but after using and testing NM 0.7 in
 Intrepid for a while I think it'll be a good move for users.

 -Jordan

Please replace this with something to configure the networkmanager
system wide configuration. Networkmanager has had this ability for a
while, and both fedora and opensuse support, but as far as I know
Ubuntu doesn't.

Wouter

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Bugs marked incomplete

2008-09-01 Thread Wouter Stomp
Hello,

Bugs that are marked incomplete and subsequently get a reply from the
original reporter often stay in the incomplete status. This means they
automatically get closed even though the needed info was provided. I
think it would be a good idea to automatically change the status to
new once a new comment is made on an incomplete bug.

Wouter

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Bugs marked incomplete

2008-09-01 Thread Wouter Stomp
On Mon, Sep 1, 2008 at 11:44 PM, Bryce Harrington [EMAIL PROTECTED] wrote:
 First, afaik automatic-expiration is not enabled for Ubuntu.  It tracks
 when bugs will expire but doesn't close them without human action.


Ok, so what does expiring mean then?

 So... I think this isn't a problem.  If you could show a (recent)
 example where something in Ubuntu got expired this way, that'd be worth
 knowing about.


No I don't :-) (although if I remember right it did happen to some of
my bugs a while ago) I guess I misunderstood the expiring concept.
Thanks for explaining.

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Ubuntu boot speed fall in Hardy

2008-05-11 Thread Wouter Stomp
On Sat, May 10, 2008 at 12:43 PM, Sam Tygier [EMAIL PROTECTED] wrote:

  Intrepid seems to me like a good time to include the prefetching work that 
 was done in 2007 summer of code. and maybe preload as well (more for 
 application load time than boot time), if the two can work together.


Quoting one of the last comments from the brainstorm idea:


Hello everyone.
I am the author of Google Summer of Code 2007 prefetching for Ubuntu.

I did not get any feedback on prefetch project mailing list (or any
other way), so I thought it is not used, and did not have motivation
to further work on it. And then I have come across this site :)

I will soon be working on adapting my prefetching solution to K/Ubuntu
8.10, so I need as much information about performance, problems,
regressions, etc. as possible.

Please send comments about prefetching to mailing list
[EMAIL PROTECTED] (no subscription necessary, just send
e-mail) or report bugs on Launchpad project
(https://launchpad.net/prefetch/).

TIA

Krzysztof Lichota


-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: hardy release freeze, coming soon to an archive near you

2008-04-09 Thread Wouter Stomp
On Tue, Apr 8, 2008 at 5:32 AM, Steve Langasek
[EMAIL PROTECTED] wrote:

  The list of release-critical bugs is tracked here:

   https://launchpad.net/ubuntu/+milestone/ubuntu-8.04

  Additional bugs that are considered targets of opportunity for the release
  are found at:

   https://bugs.launchpad.net/ubuntu/hardy/+bugs

  If there are other bugs that you believe are important to fix before the
  release which are not yet listed on the above pages, please get in touch
  with me or another member of the release team.

Hello Steve,

I think the following bug needs to be considered release-critical:

https://bugs.edge.launchpad.net/ubuntu/+source/apturl/+bug/203538

This is about apturl, a really cool feature that was added just one or
two releases ago, does not work at all in firefox 3 in hardy. It would
be a shame to leave a feature that was recently successfully
introduced completely broken. Additionally websites which provide apt:
links would have to tell people to look which version of ubuntu they
are running to see if they are able to use the links. I hope this can
be added to the list.

Cheers,

Wouter

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: [Policykit] No possibilty to unlock the save option in Gedit while trying to modify xorg.conf

2008-03-26 Thread Wouter Stomp
Gedit should notice you when you open a file with it that you can't
write to. Preferably in a nonintrusive way, like those yellow bars
that are shown for some other messages at top of the window.

On Mon, Mar 24, 2008 at 12:14 PM, thibaut bethune
[EMAIL PROTECTED] wrote:
 Policykit is there to avoid the user to get a dialog box that would
  say that can't be done without offering a workaround (if i'm not
  mistaken)

  well i've run Nautilus, and i've opened in Gedit etc/X11/xorg.conf
  i've made some changes in it and pressed the save button (which was
  active) and i've gotten an error message

  I think that :
  either the save button should not be active (at less)
  either the user should have the possibilty to give the password to be
  able to save the file (that would be perfect to me)

  --
  Ubuntu-devel-discuss mailing list
  Ubuntu-devel-discuss@lists.ubuntu.com
  Modify settings or unsubscribe at: 
 https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Automatically sync new packages until feature freeze

2008-01-19 Thread Wouter Stomp
Hello,

Currently the automatic import of new packages from debian stops at
the debianimportfreeze, which is very early in the release schedule.
After that, sync requests have to be filed and acknowledged, which is
a lot of unneccessary work I think and causes packages for which no
requests are filed not to be in ubuntu, while they could have been.
Would it be possible to automatically sync new packages in debian
unstable until featurefreeze (or even later)?

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Automatically sync new packages until feature freeze

2008-01-19 Thread Wouter Stomp
On Jan 19, 2008 9:13 PM, Wouter Stomp [EMAIL PROTECTED] wrote:
 Currently the automatic import of new packages from debian stops at
 the debianimportfreeze,

A small clarification: by new I mean new as in not previously in the
archives, not newer versions.

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Proposal: include Brasero by default

2008-01-15 Thread Wouter Stomp
On Jan 15, 2008 12:33 AM, Sebastien Bacher [EMAIL PROTECTED] wrote:
  I would not consider features like inhibiting Gnome Power Manager from
  suspending while burning niche, that is something that should just
  work.

 That's rather a small bug and likely easy to fix, the software just need
 to send a signal over dbus


No matter how easy it is to fix, that is irrelevant when it isn't
done. There has been an open bug report on that for 18 months.

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Proposal: include Brasero by default

2008-01-15 Thread Wouter Stomp
On Jan 15, 2008 12:39 PM, Sebastien Bacher [EMAIL PROTECTED] wrote:

 And next time you find a bug in brasero not fixed yet you will advice
 switching to yet another software?

No of course not. This is only one of the many issues mentioned
earlier. Have you read my first email? Besides that, development of
brasero is very active, with bugs like these getting fixed very fast.

 That's not really a constructive comment.

Why?

 The bug has no duplicate,

The amount of duplicates doesn't say anything. This bug is not likely
to occur often, but when it happens, you have wasted a cd or dvd. This
is just something basic that applications should get right.

 no comment since it has been opened

Plenty of comments in the upstream bug report.
http://bugzilla.gnome.org/show_bug.cgi?id=344949

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: gThumb

2008-01-15 Thread Wouter Stomp
On Jan 15, 2008 5:59 AM, Bryan Quigley [EMAIL PROTECTED] wrote:
 I was wondering what the reasoning was to get rid of gThumb in the default
 install (ubuntu desktop package).  Is their an application that has been
 added to help people organize home movies that I missed?

To reduce duplication. F-spot is included to organize your photos (not
movies, but I don't think gthumb does that either?).

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Main inclusion for transmission, vinagre and cheese

2008-01-15 Thread Wouter Stomp
Hello,

After it was decided that ubuntu would ship transmission and vinagre
in hardy, these were directly moved from universe to main. Cheese is
also new in main. I couldn't find main inclusion reports for these
packages. Even though it is already decided to go with these programs,
shouldn't these programs go through the usual main inclusion process
first?

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Proposal: include Brasero by default

2008-01-14 Thread Wouter Stomp
On Jan 6, 2008 4:16 PM, Wouter Stomp [EMAIL PROTECTED] wrote:
 Hello all,

 I would like to propose including Brasero in the default Ubuntu
 installation.

For anyone interested: the desktop team has decided to include
brasero, replacing serpentine, in the default installation. N-c-b will
still be shipped.

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Proposal: include Brasero by default

2008-01-14 Thread Wouter Stomp
On Jan 14, 2008 7:07 PM, Joel Bryan Juliano [EMAIL PROTECTED] wrote:

 If burning files is much concerned, using Nautilus CD Burner is the
 easiest way for both advanced
 and new users.

Brasero is just as easy, did you try it (especially the latest
version, 0.7)? Anyway, n-c-b is still included for now.

 To clear up some preconceptions, Nautilus:

 1. does asks the user to blank non-empty CD-RW  DVD-RW's upon writing.

Yes, but it cannot blank cd's withouth writing to them.

 2. burns CUE files via right-clicking it and choosing Write to Disk.

Yes, as I wrote in my first email, serpentine does not support cue
files, n-c-b does.

 I think any other features is a niche, and/or can be done manually.

I would not consider features like inhibiting Gnome Power Manager from
suspending while burning niche, that is something that should just
work.

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Proposal: include Brasero by default

2008-01-09 Thread Wouter Stomp
On Jan 6, 2008 4:16 PM, Wouter Stomp [EMAIL PROTECTED] wrote:
 Hello all,

 I would like to propose including Brasero in the default Ubuntu
 installation.

Who takes the final decision on things like this? Or should this be
posted elsewhere?

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Proposal: include Brasero by default

2008-01-07 Thread Wouter Stomp
On Jan 7, 2008 5:50 PM, Mario Vukelic [EMAIL PROTECTED] wrote:

 AFAICT from the Brasero GUI, it does not create Video DVDs that any
 standalone-player can play, just data DVDs  (DeVeDe or similar is needed
 for Video DVDs)


No, but it is on the developers todo list:
http://live.gnome.org/Brasero

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Proposal: include Brasero by default

2008-01-06 Thread Wouter Stomp
Hello all,

I would like to propose including Brasero in the default Ubuntu
installation. Brasero is an application to burn CD/DVD's for the Gnome
Desktop. It is designed to be as simple as possible and has some
unique features to enable users to create their discs easily and
quickly. Brasero is actively being developed and is maintained in
Ubuntu by one of its developers, Luis Medinas.

Currently Ubuntu relies on nautilus-cd-burner and serpentine for
cd/dvd burning. Both are nice and simple programs, but both N-c-b and
serpentine have several limitations that Brasero does not have which
are listed below:

Nautilus cd burner:
- Lack of multisession support!
- Does not inhibit Gnome Power Manager from suspending while burning
- Doesn't do on the fly burning (dvd to dvd or disk to dvd), severly
limiting burning possibilities when low on disk space (a situation in
which you might want to move files to cd/dvd)
- Does not show the amount of space left
- Does not show the progress while burning
- Has no option to verify burned cd
- Can't copy/write video DVDs
- Has no option to erase cdrw's withouth burning new content to them

Serpentine:
- Doesn't do on the fly writing (mp3/ogg to wav conversion)
- Doesn't detect the size of the inserted disc
- Has several open bugs on program crashes, both on launchpad and in
gnome bugzilla
- Lacks audio track preview
- Doesn't support cue files

Additionally, Brasero has features such as automatic filtering for
unwanted files, beagle file search (tracker support planned) and
saving/loading of projects, allowing them to be burned later.

It would be good to provide users one common interface to burn cd's.
Brasero is already in the main repository and installed and tested by
many users, so it should not be a problem to include it on the cd. Of
the other distro's, opensuse already ships it. Therefore, I would like
to propose including it by default in Hardy.

Cheers,

Wouter

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Bug(s) that should be fixed for release

2007-10-05 Thread Wouter Stomp
On 10/4/07, Brian Murray [EMAIL PROTECTED] wrote:

 Bugs that have a milestone for the development release can be found at:

 https://launchpad.net/ubuntu/+milestone/ubuntu-7.10-rc


Is it possible to nominate bugs for that list somehow?

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Graphical installer for the alternate CD?

2007-09-27 Thread Wouter Stomp
On 9/26/07, Michael R. Head [EMAIL PROTECTED] wrote:
 On Tue, 2007-09-25 at 05:13 +0800, Joel Bryan Juliano wrote:
 
 
  On 9/24/07, Tormod Volden [EMAIL PROTECTED] wrote:
  Same here, I think there's a need for a console-based Ubiquity
  installer, and a need for it to be accessible on the isolinux boot
  prompt

 I wonder if it's worth trying to spec this out as a launchpad blueprint?
  --

There is one here:
https://blueprints.edge.launchpad.net/ubuntu/+spec/ubiquity-sans-live-session

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Apturl (security) issues and inclusion in Gutsy

2007-09-25 Thread Wouter Stomp
On 9/18/07, Alexander Sack [EMAIL PROTECTED] wrote:
 On Mon, Sep 17, 2007 at 10:33:15PM +0200, Wouter Stomp wrote:
  1. It's possible to run arbitrary scripts in the preinst/postrm phase
  of dpkg installation or the installed program itself could be
  malicious. By allowing the repository to be specified the deb can come
  from anywhere. So, you've basically got just a yes/no dialog stopping
  arbitrary code execution. (Not far from UAC and ActiveX in windows.)
 

 This is a feature of deb packages in general. ATM, you can provide
 .deb links that will run gdebi by default. The difference of apturl is
 that it allows you to ship dependencies of your provided packages as
 well.

When clicking on a .deb link, the user is given the choice between
downloading the file or opening it with an application of the user's
choice. Gdebi is only opened when the user chooses to do so.


  2. Repositories added through apturl could provide packages included
  in Ubuntu but with higher version numbers with malicious code.

 ... this is a feature, not an issue.


This is not a feature, it is very dangerous.

 
  3. there should be a VERY OBVIOUS visual indication of whether the
  program is going to be installed from the official repos or some third
  party site (right now it is not)

 If this is not obvious enough, we should take a look. ATM you get at
 least a warning because the 3rd party repository is not signed with a
 trusted key.


But once you have added the 3rd party repository, it can replace any
package without warning.

 
  4. It is not well maintained. In the two months that it has been in
  the archives, 20 bugs have been reported, none have been fixed. Only
  one had a response and that is a bug about a spelling mistake in the
  package description. (all together it seems to have been uploaded only
  to enable the plugin wizard in firefox to work, after whcich it hasn't
  had any more attention)

 Are there any serious bugs filed?


I think so yes, but it actually doesn't matter if they are serious or
not. One of the requirements for inclusion in main (let alone to be
shipped on the cd) is that upstream supports and cares for the
package. Well here clearly no one seems to care for the package.

 
  5. It hasn't had a lot of testing. It wasn't mentioned in any of the
  tribe release notes. There hasn't been a post in the dev-link forum or
  on the mailing lists. So not many people know about it or have tested
  it.

 The ffox plugin finder wizard was announced with tribe-5. I agree
 though, that we should call for more widespread testing/comments,
 especially how we can raise awareness about the security implications
 of 3rd party packages.


apturl itself wasn't announced anywhere

 
  6. It functions for firefox only, even though solutions to enable it
  for konqueror and opera have been provided in bug report. This makes
  it impossible for a website to provide an install this link for an
  Ubuntu package. They have to mention that it only works if you are
  running firefox, not if you are a kubuntu user running konqueror for
  example.

 I don't think that this is a valid argument. As you say, there are
 solutions for other browsers available. The fact that they haven't
 been integrated yet is not an issue of apturl.


But they should be integrated before shipping apturl by default,
otherwise it will reflect badly on ubuntu when a link works on ubuntu
but not on kubuntu or xubuntu for example because they use a different
browser.

 
  7. There is currently no way for a website to know whether apt urls
  will work on the users operating system. If a website provides an apt
  install link it will be broken for feisty and earlier ubuntu versions
  or other linux distributions,

 How is this different from providing links to .deb packages? Users
 unaware about architectures et al are not really capable to
 understand comments next to the link either. If they are, you can do
 the same for apturl links.


The users don't need to be aware of architectures or anything. But
there shouldn't be links to install programs on websites when they
don't work. The links should be hidden/removed when they won't work
anyway.

 
  8. making people enter their sudo password in a popup you got from
  clicking on a link on an arbitary website is definitely not secure.

 I see the point of this. We should investigate how we can make the
 installer more spoof-proof. IIRC, it shades the application that
 started the installer atm, which is a good start and probably hard to
 spoof with just HTML mechanisms. Maybe we can add more
 prominent/graphical hints that its now the ubuntu install wizard
 processing your request?


It should be made a lot harder. Currently it is very easy to spoof.
You know that effect that some pages have when an image pops up and
the website itself goes gray? Use that and add a popup asking for the
users password and the majority of users won't notice the difference.

 
  9. apturl in its current version

Re: python-cjson is on Debian but not on Ubuntu

2007-09-17 Thread Wouter Stomp
On 9/17/07, Scott Kitterman [EMAIL PROTECTED] wrote:

 It wasn't in Sid when the auto-sync was turned off.  It'll be automatically
 sync'ed for Hardy.

 Scott K

For Hardy, could there be made a distinction between autosyncing new
versions and autosyncing new packages? Autosyncing new packages could
continue to sync new packages long after the importfreeze until
universe new packages freeze.

Wouter

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Apturl (security) issues and inclusion in Gutsy

2007-09-17 Thread Wouter Stomp
Hello,

I would like to discuss the recent inclusion of apturl in the Gutsy
default installation. The idea of apturl is great but the current
implementation has a lot of issues, some of which I will list here:

1. It's possible to run arbitrary scripts in the preinst/postrm phase
of dpkg installation or the installed program itself could be
malicious. By allowing the repository to be specified the deb can come
from anywhere. So, you've basically got just a yes/no dialog stopping
arbitrary code execution. (Not far from UAC and ActiveX in windows.)

2. Repositories added through apturl could provide packages included
in Ubuntu but with higher version numbers with malicious code.

3. there should be a VERY OBVIOUS visual indication of whether the
program is going to be installed from the official repos or some third
party site (right now it is not)

4. It is not well maintained. In the two months that it has been in
the archives, 20 bugs have been reported, none have been fixed. Only
one had a response and that is a bug about a spelling mistake in the
package description. (all together it seems to have been uploaded only
to enable the plugin wizard in firefox to work, after whcich it hasn't
had any more attention)

5. It hasn't had a lot of testing. It wasn't mentioned in any of the
tribe release notes. There hasn't been a post in the dev-link forum or
on the mailing lists. So not many people know about it or have tested
it.

6. It functions for firefox only, even though solutions to enable it
for konqueror and opera have been provided in bug report. This makes
it impossible for a website to provide an install this link for an
Ubuntu package. They have to mention that it only works if you are
running firefox, not if you are a kubuntu user running konqueror for
example.

7. There is currently no way for a website to know whether apt urls
will work on the users operating system. If a website provides an apt
install link it will be broken for feisty and earlier ubuntu versions
or other linux distributions,

8. making people enter their sudo password in a popup you got from
clicking on a link on an arbitary website is definitely not secure.

9. apturl in its current version doesn't show the package description
so people don't have a clue about what they are about to install other
than the information provided on the website

Conclusion: apturl is a great idea, but needs some work before it can
be included and enabled by default on Ubuntu. In its current form it
would do Gutsy more harm than good.

With some work I think Gutsy could ship with it if for now it would
only allow installation of packages from the official ubuntu
repositories. Adding of third party repositories by clicking a weblink
is something that at least needs some discussion and imho should not
be done at all.

Cheers,

Wouter

n.b. link to apturl bug list: https://bugs.launchpad.net/ubuntu/+source/apturl

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: update-db cron job: solving a long-standing issue

2007-09-15 Thread Wouter Stomp
On 9/15/07, Milan [EMAIL PROTECTED] wrote:

 We can also think (and this is my opinion ;-) ) that the locate command
 is only used by advanced users that now how to install slocate in two
 minutes, and thus that we don't need to install it by default. Newbies
 don't use locate in a terminal, but Tracker in GNOME. And we should
 remember that users are likely to use new background processes with
 Tracker or Beagle, that may even be installed by default. So the less
 are running, the better the system will work. Replacements like find can
 be used when necessary (eg for occasional remote help), though they are
 less efficient.


Wouldn't it be possible to replace locate with tracker somehow? Or let
locate use the tracker database?

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Main Frozen for Tribe 5

2007-08-21 Thread Wouter Stomp
On 8/21/07, Jonathan Riddell [EMAIL PROTECTED] wrote:

 We have frozen the archive for Tribe 5, scheduled for Thursday.
 Uploads will be held in the unapproved queue, if you have an upload
 for main which should be in the Tribe please let me know.  Uploads to
 universe can be let through without review by asking me.

 Please continue fixing bugs and close any that have already been
 fixed.

 https://launchpad.net/ubuntu/+bugs?field.milestone:Alist=472


Is it possible to nominate a bug for that list? Currently the open
source ati driver is broken for many people, see
https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-ati/+bug/133192

Cheers,

Wouter

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Announcement: One Click Installer

2007-08-06 Thread Wouter Stomp
On 8/6/07, Greg K Nicholson [EMAIL PROTECTED] wrote:


 The apt protocol ( https://wiki.ubuntu.com/AptFirefoxFileHandler ) will
 fix this.



Can anyone tell if this will be implemented in time for Gutsy?

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


Re: Single CD for Server Desktop?

2007-07-31 Thread Wouter Stomp
On 7/30/07, Kevin Fries [EMAIL PROTECTED] wrote:

 Actually, what would be ideal in the corporate or business environments
 would be a very minimal install with all updates coming from a central
 repository (i.e. not from the CD).  Something similar to the old Debian
 or RedHat FTP based install.


A netboot cd image already exists:
http://archive.ubuntu.com/ubuntu/dists/feisty/main/installer-i386/current/images/netboot/

Wouter.

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss