Re: Security concerns with minified javascript code

2015-08-30 Thread Raphael Hertzog
On Sun, 30 Aug 2015, Bas Wijnen wrote: > Why do you care that software is in main, if you evidently do not care about > any of the rules we have for it? I don't think that implying that Vincent doesn't not care about Free Software is very constructive. Can we please stop this now? If all the ene

Re: Summary of the DebConf firmware discussion

2015-08-30 Thread Paul Wise
On Sun, Aug 30, 2015 at 5:26 PM, Philipp Kern wrote: > On Sat, Aug 29, 2015 at 01:29:16PM +0200, Paul Wise wrote: >> On Sat, Aug 29, 2015 at 9:48 AM, Philipp Kern wrote: >> > freeness are distinct for the CPU and auxiliary PUs. >> I get the feeling that the practical consequences of non-free softwa

Re: Summary of the DebConf firmware discussion

2015-08-30 Thread Don Armstrong
On Sat, 29 Aug 2015, Philipp Kern wrote: > Having been a bit late I didn't fit into the room. I'm still in favor > to have a vote on this. I'm personally unconvinced by the argument > that it's "ok" for the hardware to use firmware blobs as long as you > don't load them from within Debian. (Or, as

Re: Pacakging small package (was Re: Security concerns with minified javascript code)

2015-08-30 Thread Samuel Thibault
Bastien ROUCARIÈS, le Sun 30 Aug 2015 23:15:39 +0200, a écrit : > What could be done in order to improve the whole system performance in order > to package really small package ? Is it not possible to group them like X.org does? Samuel

Bug#797472: ITP: r-cran-hypergeo -- GNU R package providing the Gaussian hypergeometric function for complex numbers

2015-08-30 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-hypergeo Version : 1.2-11 Upstream Author : Robin K. S. Hankin * URL : http://cran.r-project.org/package=hypergeo * License : GPL Programming Lang: R Description : GNU R package pr

Re: system upgrade by systemd

2015-08-30 Thread Philipp Kern
On Sun, Aug 30, 2015 at 06:00:50PM +0100, Philip Hands wrote: > I have been told by several newbies that the "updates available" > notification, and them subsequently following the prompts to update > their own system, was the first time they'd ever felt like they were in > charge of a computer, ra

Bug#797468: ITP: r-cran-desolve -- GNU R package providing functions that solve initial value problems of a system of first-order ordinary differential equations (ODE), of partial differential equatio

2015-08-30 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-desolve Version : 1.12 Upstream Author : Thomas Petzoldt * URL : http://desolve.r-forge.r-project.org/ * License : GPL Programming Lang: R Description : GNU R package providing fun

Bug#797467: ITP: r-cran-contfrac -- GNU R package providing various utilities for evaluating continued fractions

2015-08-30 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-contfrac Version : 1.1-9 Upstream Author : Robin K. S. Hankin * URL : http://cran.r-project.org/package=contfrac * License : GPL Programming Lang: R Description : GNU R package pro

Re: Security concerns with minified javascript code

2015-08-30 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Aug 30, 2015 at 02:12:43PM +0200, Vincent Bernat wrote: > This is becoming quite a stretch. At this rate, we will fail to match > SC#2 because we ship previous versions of software and upstream is > unlikely to accept a patch against a non-curr

Re: system upgrade by systemd

2015-08-30 Thread Marc Haber
eOn Sun, 30 Aug 2015 18:00:50 +0100, Philip Hands wrote: >Could we perhaps decide to buck this trend, and instead by default >assume that our users are not idiots? > >Then we could just notify them when updates are available (as used to be >the case), and expect them to make an informed decision a

Re: Security concerns with minified javascript code

2015-08-30 Thread IOhannes m zmölnig
On 08/28/2015 01:14 AM, Russ Allbery wrote: > Bas Wijnen writes: > > Last time I checked, Doxygen includes minified Javascript in all of its > generated output. Would we have to move every piece of Doxygen-generated > documentation into a separate package so that we could put it in contrib, > or

Re: system upgrade by systemd

2015-08-30 Thread Frederic Peters
Hi, > Simon McVittie wrote (30 Aug 2015 15:41:32 GMT) : > >> Or even noconnectivity at all > >> (which at least Android and Windows actively check for using a call-home > >> mechanism.) > > > Both NetworkManager and ConnMan are able to do that, although I don't > > know whether that's enabled in

prevent-unattended-upgrades (was Re: system upgrade by systemd)

2015-08-30 Thread Thorsten Glaser
Michael Meskes debian.org> writes: > Who said the update failed? I want to make the decision as to when and > how to update my system and I never want to see some stupid software PSA: the src:mirabilos-support package¹ builds a growing number of prevent-* packages; among them is prevent-unattend

Re: system upgrade by systemd

2015-08-30 Thread Steve Cotton
On Sun, Aug 30, 2015 at 10:30:54AM +0200, Michael Banck wrote: > But in general I think we want that our users get security updates ASAP, I think this implementation doesn't fit that problem. All of this is IIUC: A user who depends on this only gets security updates when they reboot. As long as

Re: Recommending packages not available in arch

2015-08-30 Thread Thorsten Glaser
IOhannes m zmölnig (Debian/GNU debian.org> writes: > my first reaction was that the intention of this paragraph is mainly to > keep the system uncontaminated from non-free and contrib, but while the I think that is correct. Furthermore, arch-qualifying Recommends is not possible in an arch:all p

Re: system upgrade by systemd

2015-08-30 Thread Philip Hands
Marc Haber writes: > On Sun, 30 Aug 2015 14:42:54 +0200, intrigeri > wrote: >>Marc Haber wrote (30 Aug 2015 11:43:09 GMT) : >>> You reasoning again resembles what Microsoft says. >> >>I may be misunderstanding, but given what immediately follows ("I >>don't know whether [...]) it seems to me tha

Re: system upgrade by systemd

2015-08-30 Thread intrigeri
Simon McVittie wrote (30 Aug 2015 15:41:32 GMT) : >> Or even noconnectivity at all >> (which at least Android and Windows actively check for using a call-home >> mechanism.) > Both NetworkManager and ConnMan are able to do that, although I don't > know whether that's enabled in Debian. In both cas

Re: system upgrade by systemd

2015-08-30 Thread Jonas Smedegaard
Quoting Simon McVittie (2015-08-30 17:41:32) > On 30/08/15 16:18, Philipp Kern wrote: >> FWIW, it is possible to heuristically detect iPhones and Android >> devices that offer tethering and to discard WWAN connections. But I'm >> not sure if we have a framework on Linux now that would offer an >

Re: system upgrade by systemd

2015-08-30 Thread Marc Haber
On Sun, 30 Aug 2015 14:42:54 +0200, intrigeri wrote: >Marc Haber wrote (30 Aug 2015 11:43:09 GMT) : >> You reasoning again resembles what Microsoft says. > >I may be misunderstanding, but given what immediately follows ("I >don't know whether [...]) it seems to me that you're attaching >a negative

Re: system upgrade by systemd

2015-08-30 Thread Simon McVittie
On 30/08/15 16:18, Philipp Kern wrote: > FWIW, it is possible to heuristically detect iPhones and Android devices > that offer tethering and to discard WWAN connections. But I'm not sure > if we have a framework on Linux now that would offer an answer to the > question if you're currently on a band

Re: system upgrade by systemd

2015-08-30 Thread Philipp Kern
On Sun, Aug 30, 2015 at 06:46:24AM +0200, Michael Meskes wrote: > > It’s gnome-software in sid, or g-s-d in jessie, querying PackageKit for > > updates. > > The default policy is to not schedule any downloads when running on > > battery or on a modem connection. > Which is not enough IMO. (W)LAN co

Re: Summary of the DebConf firmware discussion

2015-08-30 Thread Philipp Kern
On Sat, Aug 29, 2015 at 01:29:16PM +0200, Paul Wise wrote: > On Sat, Aug 29, 2015 at 9:48 AM, Philipp Kern wrote: > > freeness are distinct for the CPU and auxiliary PUs. > I get the feeling that the practical consequences of non-free software > running on auxiliary PUs can be worse than CPUs: > >

Re: system upgrade by systemd

2015-08-30 Thread Cyril Brulebois
Jakub Wilk (2015-08-30): > * Cyril Brulebois , 2015-08-30, 05:38: > >>JFTR, what is g-s-d? gnome-software-? > > > >kibi@arya:~$ apt-file search /usr/bin/g*-s*-d* > >gnome-settings-daemon: /usr/bin/gnome-settings-daemon > > To clarify: it only worked because you had g-s-d installed, so your shell

Re: system upgrade by systemd

2015-08-30 Thread Frederic Peters
Michael Banck wrote: > I think it probably makes sense to have this on by default for stable > and off by default for testing/unstable. I assume the default option is > not configurable? > > Even better might be a first-boot question asking the user about it, but > I am not sure such a framework

Bug#797406: ITP: drf-haystack -- Haystack for Django REST Framework

2015-08-30 Thread Michael Fladischer
Package: wnpp Severity: wishlist Owner: Michael Fladischer -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 * Package name: drf-haystack Version : 1.5.2 Upstream Author : Rolf Håvard Blindheim , Eirik Krogstad * URL : https://github.com/inonit/drf-haystack * License

Re: system upgrade by systemd

2015-08-30 Thread intrigeri
Hi, Marc Haber wrote (30 Aug 2015 11:43:09 GMT) : > You reasoning again resembles what Microsoft says. I may be misunderstanding, but given what immediately follows ("I don't know whether [...]) it seems to me that you're attaching a negative connotation to this statement. In case that's indeed

the status of gstreamer1.0-plugins-bad

2015-08-30 Thread Vincent Lefevre
The gstreamer1.0-plugins-bad package description says: [...] GStreamer Bad Plug-ins is a set of plug-ins that aren't up to par compared to the rest. They might be close to being good quality, but they're missing something - be it a good code review, some documentation, a set of tests, a real l

Re: Security concerns with minified javascript code

2015-08-30 Thread Vincent Bernat
❦ 30 août 2015 11:52 GMT, Bas Wijnen  : >> However, this is a readable source code that will accomodate any >> modification that a end user will deem necessary. > > That is not the only reason that we want the user to have source. > They are not some detached "customer". When we make changes to

Bug#797400: ITP: dl-poly-classic -- General purpose molecular dynamics simulation package

2015-08-30 Thread Michael Banck
Package: wnpp Severity: wishlist Owner: Debichem Team * Package name: dl-poly-classic Version : 1.9 Upstream Author : W. Smith, T.R. Forester and I.T. Todorov * URL : http://www.ccp5.ac.uk/DL_POLY_CLASSIC/ * License : BSD Programming Lang: Fortran/Java Desc

Re: system upgrade by systemd

2015-08-30 Thread Marc Haber
On Sun, 30 Aug 2015 11:27:02 +0200, Michael Banck wrote: >On Sun, Aug 30, 2015 at 10:53:17AM +0200, Marc Haber wrote: >> Yes, Windows 10 has _exactly_ the same issue. I am astonished that we >> managed to copy that epic fuckup in such a short time span. > >This is getting ridiculous, are you now c

Re: system upgrade by systemd

2015-08-30 Thread Marc Haber
On Sun, 30 Aug 2015 10:30:54 +0200, Michael Banck wrote: >Package: network-manager >Severity: wishlist > >On Sun, Aug 30, 2015 at 06:46:24AM +0200, Michael Meskes wrote: >> > It’s gnome-software in sid, or g-s-d in jessie, querying PackageKit for >> > updates. >> > The default policy is to not sch

Re: Security concerns with minified javascript code

2015-08-30 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Aug 30, 2015 at 10:14:13AM +0200, Vincent Bernat wrote: > The build script determines the outcome of what will effectively run on > our users' machine. I fail to see how this is not an important > issue. You are correct, this is important. >

Re: system upgrade by systemd

2015-08-30 Thread Frederic Peters
Hi, Michael Banck wrote: > Package: network-manager > Severity: wishlist > > On Sun, Aug 30, 2015 at 06:46:24AM +0200, Michael Meskes wrote: > > > It’s gnome-software in sid, or g-s-d in jessie, querying PackageKit for > > > updates. > > > The default policy is to not schedule any downloads when

Bug#797390: ITP: r-cran-pbivnorm -- GNU R package providing a vectorized R function for calculating probabilities from a standard bivariate normal CDF

2015-08-30 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-pbivnorm Version : 0.6.0 Upstream Author : Brenton Kenkel * URL : http://cran.r-project.org/package=pbivnorm * License : GPL Programming Lang: R Description : GNU R package providi

Re: system upgrade by systemd

2015-08-30 Thread Ben Hutchings
On Sun, 2015-08-30 at 10:30 +0200, Michael Banck wrote: > Package: network-manager > Severity: wishlist > > On Sun, Aug 30, 2015 at 06:46:24AM +0200, Michael Meskes wrote: > > > It’s gnome-software in sid, or g-s-d in jessie, querying PackageKit for > > > updates. > > > The default policy is to no

Bug#797388: ITP: r-cran-pbapply -- GNU R package providing progress bars for vectorized R functions

2015-08-30 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-pbapply Version : 1.1-1 Upstream Author : Peter Solymos * URL : http://cran.r-project.org/package=pbapply * License : GPL Programming Lang: R Description : GNU R package providing

Re: Security concerns with minified javascript code

2015-08-30 Thread Paul Wise
On Sun, Aug 30, 2015 at 10:14 AM, Vincent Bernat wrote: > The build script determines the outcome of what will effectively run on > our users' machine. I fail to see how this is not an important > issue. But until the effort to get ppc64el, not regenerating the > configure script was just a fine o

Re: system upgrade by systemd

2015-08-30 Thread Michael Banck
On Sun, Aug 30, 2015 at 10:53:17AM +0200, Marc Haber wrote: > Yes, Windows 10 has _exactly_ the same issue. I am astonished that we > managed to copy that epic fuckup in such a short time span. This is getting ridiculous, are you now claiming the Debian Gnome team or Gnome upstream was tracking th

Re: Replacing ldconfig maintscripts with declarative methods

2015-08-30 Thread Niels Thykier
On 2015-08-29 23:52, Aurelien Jarno wrote: >[...] > >> * The major concern I have, is that "activate"-triggers are done for >>- unpack (is this ok?) >>- configure (ok) >>- remove (ok, assuming it is post-removal) >>- purge (should not be an issue) >>- deconfigure (would be a no

Re: system upgrade by systemd

2015-08-30 Thread Marc Haber
On Sun, 30 Aug 2015 05:38:36 +0200, Cyril Brulebois wrote: >Chris Bannister (2015-08-30): >> On Sat, Aug 29, 2015 at 10:42:13PM +0200, Josselin Mouette wrote: >> > Le jeudi 27 août 2015 à 05:22 +0200, Michael Meskes a écrit : >> > > Besides, what causes the system to make those package downloads

Re: system upgrade by systemd

2015-08-30 Thread Jonas Smedegaard
Quoting Chris Bannister (2015-08-30 09:37:31) > On Sun, Aug 30, 2015 at 05:38:36AM +0200, Cyril Brulebois wrote: >> Chris Bannister (2015-08-30): >>> On Sat, Aug 29, 2015 at 10:42:13PM +0200, Josselin Mouette wrote: Le jeudi 27 août 2015 à 05:22 +0200, Michael Meskes a écrit : > Besides,

Re: system upgrade by systemd

2015-08-30 Thread Marc Haber
On Sat, 29 Aug 2015 22:42:13 +0200, Josselin Mouette wrote: >The default policy is to not schedule any downloads when running on >battery or on a modem connection. Bad policy, there are gazillions of people using mobile hotspots which _are_ metered but appear as a normal WiFi connection. Yes, Wi

Re: Summary of the DebConf firmware discussion

2015-08-30 Thread Jan Hauke Rahm
On Sat, Aug 29, 2015 at 03:15:07PM -0300, Henrique de Moraes Holschuh wrote: > On Sat, Aug 29, 2015, at 11:04, Jan Hauke Rahm wrote: > > > I see how non-free firmware is needed, espacially if the installation > > can't proceed due to missing network connectivity. But after it's done, > > after the

Re: system upgrade by systemd

2015-08-30 Thread Michael Banck
Package: network-manager Severity: wishlist On Sun, Aug 30, 2015 at 06:46:24AM +0200, Michael Meskes wrote: > > It’s gnome-software in sid, or g-s-d in jessie, querying PackageKit for > > updates. > > The default policy is to not schedule any downloads when running on > > battery or on a modem con

Re: system upgrade by systemd

2015-08-30 Thread Jakub Wilk
* Cyril Brulebois , 2015-08-30, 05:38: JFTR, what is g-s-d? gnome-software-? kibi@arya:~$ apt-file search /usr/bin/g*-s*-d* gnome-settings-daemon: /usr/bin/gnome-settings-daemon To clarify: it only worked because you had g-s-d installed, so your shell expanded the wildcard. This works ever

Re: Security concerns with minified javascript code

2015-08-30 Thread Vincent Bernat
❦ 29 août 2015 19:12 -0700, Steve Langasek  : > Yet you try to compare this with autoconf. Even if we tolerated configure > scripts today in the archive that we can't rebuild using the software in > Debian (which by and large we do *not* tolerate - because we've learned our > lesson), there's a

Re: Raising the severity of reproduciblity issues to "important"

2015-08-30 Thread Wouter Verhelst
On Mon, Aug 24, 2015 at 10:30:45PM +0100, Colin Tuckley wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > On 24/08/15 22:02, Vincent Bernat wrote: > > > We have pushed other archive-wide goals that were not shared by > > all upstreams. For example, we have enabled hardening build fla

Re: system upgrade by systemd

2015-08-30 Thread Chris Bannister
On Sun, Aug 30, 2015 at 05:38:36AM +0200, Cyril Brulebois wrote: > Chris Bannister (2015-08-30): > > On Sat, Aug 29, 2015 at 10:42:13PM +0200, Josselin Mouette wrote: > > > Le jeudi 27 août 2015 à 05:22 +0200, Michael Meskes a écrit : > > > > Besides, what causes the system to make those package d

Re: Summary of the DebConf firmware discussion

2015-08-30 Thread Paul Wise
On Sat, Aug 29, 2015 at 3:54 PM, Jan Hauke Rahm wrote: > I like the idea in principal, I just also think that dividing non-free > must be a very thought-through process - with our users as first > priority. Agreed. We should probably start with only non-free/firmware for now. -- bye, pabs http

Re: Bug#797359: ITP: universal-ctags -- Generates an index (or tag) file of names found in source files

2015-08-30 Thread Stefano Zacchiroli
On Sun, Aug 30, 2015 at 12:44:44AM +0200, Víctor Cuadrado Juan wrote: > * Package name: universal-ctags > * URL : https://ctags.io/ > A continuation of the exuberant-ctags implementation of the ctags Hey, can you elaborate a bit on how universal-ctags compare to exuberant-ctags? T