building jquery without grunt (was "Security concerns with minified javascript code")

2015-08-28 Thread Antonio Terceiro
On Fri, Aug 28, 2015 at 10:06:17AM +0200, Vincent Bernat wrote: > ❦ 28 août 2015 08:22 +0100, Philip Hands  : > > >>> Or alternatively, by packaging the minifier that is being used with the > >>> package > >>> that needs it. Yes, that's a horrible idea with lots of code > >>> duplication, but

Bug#797251: ITP: r-cran-modeltools -- GNU R package providing a collection of tools to deal with statistical models

2015-08-28 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-modeltools Version : 0.2-21 Upstream Author : Torsten Hothorn * URL : http://cran.r-project.org/package=modeltools * License : GPL Programming Lang: R Description : GNU R package p

Bug#797247: ITP: r-cran-lsmeans -- GNU R package for obtaining least-squares means for many linear, generalized linear, and mixed models

2015-08-28 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-lsmeans Version : 2.19 Upstream Author : Russell V. Lenth * URL : http://cran.r-project.org/package=lsmeans * License : GPL Programming Lang: R Description : GNU R package for obta

Bug#797243: ITP: r-cran-logspline -- GNU R package providing routines for the logspline density estimation

2015-08-28 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-logspline Version : 2.1.8 Upstream Author : Charles Kooperberg * URL : http://cran.r-projects.org/package=logspline * License : GPL Programming Lang: R, C Description : GNU R packa

Re: Security concerns with minified javascript code

2015-08-28 Thread Vincent Bernat
❦ 28 août 2015 17:37 +0100, Steve McIntyre  : >>The problem is that this *is* usable for nearly all the people who >>currently use it, who just run one command to install it and have all >>those dependencies pulled from a remote repo for them. Because the >>dependency installation process is so

Re: Summary of the DebConf firmware discussion

2015-08-28 Thread Andrew M.A. Cater
On Fri, Aug 28, 2015 at 04:33:04PM +0100, Steve McIntyre wrote: > Hi folks, > > > (Non-free) Firmware in Debian > = > > Background > -- > > Our users are finding problems with current common hardware - much of > it depends on loadable firmware. Much (most?) o

Re: Security concerns with minified javascript code

2015-08-28 Thread Pau Garcia i Quiles
On Fri, Aug 28, 2015 at 4:12 PM, Jean-Michel Vourgère wrote: Vincent Bernat wrote: > > (...) > > It has already been said numerous time in the past, for some Javascript > > code, we don't really have the tools in Debian to easily go from the > > source to the minified version. It's possible, but

Re: Security concerns with minified javascript code

2015-08-28 Thread Pau Garcia i Quiles
On Fri, Aug 28, 2015 at 4:12 PM, Jean-Michel Vourgère wrote: Vincent Bernat wrote: > > (...) > > It has already been said numerous time in the past, for some Javascript > > code, we don't really have the tools in Debian to easily go from the > > source to the minified version. It's possible, but

Re: system upgrade by systemd

2015-08-28 Thread Matthias Klumpp
2015-08-28 6:03 GMT+02:00 Michael Meskes : > > Having just read this entire thread, and been affected by this once, it > > occurs to me that the likely answer has been offered, but I suspect you > > may have thought Matthias' reference to “GNOME Software” to be a generic > > answer (apologies if I

Re: Security concerns with minified javascript code

2015-08-28 Thread Russ Allbery
Steve McIntyre writes: > Depressingly, it seems a lot of the same web typists don't have any > problems with doing the equivalent of "curl http://some.site/install.sh > | sudo bash" . That doesn't mean we have to do the same in Debian. If > there's no sensible way to do controlled web development

Re: Security concerns with minified javascript code

2015-08-28 Thread Steve McIntyre
Russ Allbery wrote: >Neil Williams writes: > >> Usable software needs usable tools. > >The problem is that this *is* usable for nearly all the people who >currently use it, who just run one command to install it and have all >those dependencies pulled from a remote repo for them. Because the >dep

Re: Security concerns with minified javascript code

2015-08-28 Thread Russ Allbery
Neil Williams writes: > I still find it hard to believe that *so* much code is required to > minify JS. The excuse that JS is "moving fast" is nonsense. The reality > would appear to be that nobody actually *cares* about the mess, they > just use it. This is almost certainly correct. > Usable s

Summary of the DebConf firmware discussion

2015-08-28 Thread Steve McIntyre
Hi folks, As promised, here's a quick summary of what was discussed at the Firmware discussion session in Heidelberg. This was not recorded on video, so I can't provide a link for that. I've taken a copy of the Gobby notes too [1], and the nice folks at LWN even included a write-up in this week's

Re: system upgrade by systemd

2015-08-28 Thread Michael Meskes
On 28.08.2015 08:10, Geert Stappers wrote: > On Fri, Aug 28, 2015 at 06:14:05AM +0200, Michael Meskes wrote: >>> Is this enough to go on to move this to a report against gnome-software? >> >> Bug reported btw. > > Where? ( "Where to follow the bugreport?" ) #797135 Seems you were faster than th

Re: Security concerns with minified javascript code

2015-08-28 Thread Jean-Michel Vourgère
Vincent Bernat wrote: > (...) > It has already been said numerous time in the past, for some Javascript > code, we don't really have the tools in Debian to easily go from the > source to the minified version. It's possible, but without the > appropriate tools, it's painful. I've been using yui-com

Bug#797202: ITP: r-cran-elliptic -- GNU R package providing elliptic and related functions

2015-08-28 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-elliptic Version : 1.3-5 Upstream Author : Robin K. S. Hankin * URL : http://cran.r-project.org/package=elliptic * License : GPL Programming Lang: R Description : GNU R package pro

Re: Security concerns with minified javascript code

2015-08-28 Thread Simon Josefsson
Dmitry Smirnov writes: > On Monday 24 August 2015 13:54:21 Simon Josefsson wrote: >> I believe the blog post below has relevance to Debian's stance on >> including minified JavaScript in packages: >> >> https://zyan.scripts.mit.edu/blog/backdooring-js/ > > Thank you for a nice argument against m

Re: Security concerns with minified javascript code

2015-08-28 Thread Vincent Bernat
❦ 28 août 2015 12:03 +0200, Samuel Thibault  : > I wonder why mere gzip compression is not used. Don't all browsers > support Accept-Compress: gzip? Minification saves some additional bytes. About 10% (when gzipped). -- If you tell the truth you don't have to remember anything.

Re: Security concerns with minified javascript code

2015-08-28 Thread Samuel Thibault
Neil Williams, le Fri 28 Aug 2015 10:32:52 +0100, a écrit : > On Fri, 28 Aug 2015 10:45:16 +0200 > Samuel Thibault wrote: > > > Vincent Bernat, le Fri 28 Aug 2015 10:06:17 +0200, a écrit : > > > Maybe it can be trimmed a bit more, but that's still 239 unique > > > dependencies. > > > > Note that

Re: Security concerns with minified javascript code

2015-08-28 Thread Vincent Bernat
❦ 28 août 2015 10:32 +0100, Neil Williams  : > I still find it hard to believe that *so* much code is required to > minify JS. The excuse that JS is "moving fast" is nonsense. The reality > would appear to be that nobody actually *cares* about the mess, they > just use it. It's a feature. The JS

Re: Security concerns with minified javascript code

2015-08-28 Thread Neil Williams
On Fri, 28 Aug 2015 10:45:16 +0200 Samuel Thibault wrote: > Vincent Bernat, le Fri 28 Aug 2015 10:06:17 +0200, a écrit : > > Maybe it can be trimmed a bit more, but that's still 239 unique > > dependencies. > > Note that you don't have to make that 239 debian packages, you could > as well just s

Re: Security concerns with minified javascript code

2015-08-28 Thread Dmitry Smirnov
On Monday 24 August 2015 13:54:21 Simon Josefsson wrote: > I believe the blog post below has relevance to Debian's stance on > including minified JavaScript in packages: > > https://zyan.scripts.mit.edu/blog/backdooring-js/ Thank you for a nice argument against minification. During packaging I a

Bug#797173: ITP: r-cran-estimability -- GNU R package providing tools for determining estimability of linear functions

2015-08-28 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-estimability Version : 1.1 Upstream Author : Russel V. Lenth * URL : http://cran.r-project.org/package=estimability * License : GPL Programming Lang: R Description : GNU R package

Re: Security concerns with minified javascript code

2015-08-28 Thread Samuel Thibault
Vincent Bernat, le Fri 28 Aug 2015 10:48:28 +0200, a écrit : > ❦ 28 août 2015 10:29 +0200, Samuel Thibault  : > > >> What will happen is that maintainers will fallback to the second less > >> horrible solution and cripple the package (by using an older version of > >> the JS lib for example) to a

Re: Security concerns with minified javascript code

2015-08-28 Thread Vincent Bernat
❦ 28 août 2015 10:29 +0200, Samuel Thibault  : >> What will happen is that maintainers will fallback to the second less >> horrible solution and cripple the package (by using an older version of >> the JS lib for example) to allow it to stay in main. > > Why would they want to stay in main? [...

Re: Security concerns with minified javascript code

2015-08-28 Thread Samuel Thibault
Vincent Bernat, le Fri 28 Aug 2015 10:06:17 +0200, a écrit : > Maybe it can be trimmed a bit more, but that's still 239 unique > dependencies. Note that you don't have to make that 239 debian packages, you could as well just ship them all in one package, as long as the whole code passes NEW, i.e.

Re: Security concerns with minified javascript code

2015-08-28 Thread Samuel Thibault
Vincent Bernat, le Fri 28 Aug 2015 07:42:42 +0200, a écrit : > > Yes, that is a danger. I think putting those things in contrib should be a > > good solution if rebuilding is such a big problem. Because if it is, the > > code > > really really doesn't belong in main. > > What will happen is tha

Re: Security concerns with minified javascript code

2015-08-28 Thread Vincent Bernat
❦ 28 août 2015 08:22 +0100, Philip Hands  : >>> Or alternatively, by packaging the minifier that is being used with the >>> package >>> that needs it. Yes, that's a horrible idea with lots of code duplication, >>> but >>> if I understand the problem, every JS file must be minified with the exa

Re: Security concerns with minified javascript code

2015-08-28 Thread Philip Hands
Vincent Bernat writes: > 28 août 2015 01:46 GMT, Bas Wijnen  : > >> Or alternatively, by packaging the minifier that is being used with the >> package >> that needs it. Yes, that's a horrible idea with lots of code duplication, >> but >> if I understand the problem, every JS file must be minif