Re: [aur-general] Suggestion to add a pinned comment to PKGBUILDs of high risk vulnerable software

2017-07-05 Thread LoneVVolf
On 04-07-17 10:19, NicoHood wrote: About the original suggestion for the AUR: I think its worth to have a pinned comment on the AUR page. The package maintainer should add it if an user gives him the hint. If he doesnt accept it a TU should check if the request is valid and pin the users comment

Re: [aur-general] Suggestion to add a pinned comment to PKGBUILDs of high risk vulnerable software

2017-07-04 Thread NicoHood
I want to point out another view from this situation: What if an outdated package is moved to AUR and does not have a new package with the replace=() variable? I personally had this several times and those packages are still kept on the system. This gave me some broken dependencies but also old s

Re: [aur-general] Suggestion to add a pinned comment to PKGBUILDs of high risk vulnerable software

2017-07-04 Thread Ralf Mardorf
On Tue, 4 Jul 2017 09:45:08 +0200, Ralf Mardorf wrote: >On Tue, 4 Jul 2017 14:00:50 +0800, Oon-Ee Ng via aur-general wrote: >>You could suggest it on the package's AUR page. > >Hi, > >yes, I could ask to do it for dependent packages such as >https://aur.archlinux.org/packages/xombrero/ even while

Re: [aur-general] Suggestion to add a pinned comment to PKGBUILDs of high risk vulnerable software

2017-07-04 Thread Ralf Mardorf
On Tue, 4 Jul 2017 14:00:50 +0800, Oon-Ee Ng via aur-general wrote: >You could suggest it on the package's AUR page. Hi, yes, I could ask to do it for dependent packages such as https://aur.archlinux.org/packages/xombrero/ even while I'm not using it. I could ask to do it for https://aur.archlin

Re: [aur-general] Suggestion to add a pinned comment to PKGBUILDs of high risk vulnerable software

2017-07-03 Thread Oon-Ee Ng via aur-general
On Tue, Jul 4, 2017 at 1:47 PM, Ralf Mardorf wrote: > On Tue, 4 Jul 2017 13:25:09 +0800, Oon-Ee Ng via aur-general wrote: > >This is the primary question here. If it's the maintainer then... what > >is this email thread even for? > > It's about sense of responsibility. As already pointed out, > s

Re: [aur-general] Suggestion to add a pinned comment to PKGBUILDs of high risk vulnerable software

2017-07-03 Thread Ralf Mardorf
On Tue, 4 Jul 2017 13:25:09 +0800, Oon-Ee Ng via aur-general wrote: >This is the primary question here. If it's the maintainer then... what >is this email thread even for? It's about sense of responsibility. As already pointed out, something like the webkit PKGBUILDs are objectively PKGBUILDs with

Re: [aur-general] Suggestion to add a pinned comment to PKGBUILDs of high risk vulnerable software

2017-07-03 Thread Oon-Ee Ng via aur-general
On Sun, Jul 2, 2017 at 4:56 PM, Ralf Mardorf wrote: > On Sun, 2 Jul 2017 03:49:10 -0400, Eli Schwartz via aur-general wrote: > > >Even if it weren't entirely up to the maintainer to pin comments, who > >are you proposing should be responsible for determining what packages > >should come with warn

Re: [aur-general] Suggestion to add a pinned comment to PKGBUILDs of high risk vulnerable software

2017-07-02 Thread Ralf Mardorf
On Sun, 2 Jul 2017 03:49:10 -0400, Eli Schwartz via aur-general wrote: >... That is entirely up to the maintainer of said package. Hi, yes and this shouldn't change. I just want to suggest to be responsible and add a note. >Even if it weren't entirely up to the maintainer to pin comments, who >a

Re: [aur-general] Suggestion to add a pinned comment to PKGBUILDs of high risk vulnerable software

2017-07-02 Thread Eli Schwartz via aur-general
On 07/02/2017 03:09 AM, Ralf Mardorf wrote: > Hi, > > I understand that users should decide on their own, if they wish to > install high risk vulnerable software, so I'm not writing because a > deletion request was rejected. > > I want to make a suggestion. > > A pinned comment could warn about

[aur-general] Suggestion to add a pinned comment to PKGBUILDs of high risk vulnerable software

2017-07-02 Thread Ralf Mardorf
Hi, I understand that users should decide on their own, if they wish to install high risk vulnerable software, so I'm not writing because a deletion request was rejected. I want to make a suggestion. A pinned comment could warn about the high security risk and assuming that upstream of the origi