Re: Three steps we could take to make supply chain attacks a bit harder

2024-04-17 Thread Kilian Hanich via devel
Am 17.04.24 um 23:34 schrieb Kevin Kofler via devel: And in my view, the fact that, in those implementations, there is no Treacherous Computing hardware preventing me from doing what I want with my own private key (e.g., just copying the same key to all my devices, as I can also do with TOTP) is

Re: convert everything to rpmautospec?

2024-04-08 Thread Kilian Hanich via devel
Am 08.04.24 um 14:55 schrieb Emmanuel Seyman: Well, you and Kevin see "salami tactics" (whatever that may be), FTR, I have no idea what "salami tactics" is. Since apperently multiple people don't know the term: https://en.wikipedia.org/wiki/Salami_slicing_tactics Regards Kilian --

Re: F42 Change Proposal: Fedora Plasma Workstation (System-Wide)

2024-04-03 Thread Kilian Hanich via devel
Am 04.04.24 um 03:00 schrieb Gordon Messmer: I think this gets to the heart of the issue.  If we set aside subjective arguments about which desktop is better or more popular, only one of these desktops allows Fedora to publish a stable operating system which is a coherent whole, because only one

Re: F42 Change Proposal: Fedora Plasma Workstation (System-Wide)

2024-04-03 Thread Kilian Hanich via devel
Am 04.04.24 um 01:46 schrieb Sam Varshavchik: This is not going to happen. There's going to be someone else, sitting next to them, who will be teaching the new user how to use a computer. And that someone will /also/ be familiar with traditional desktop concepts and paradigms. They, like the

Re: F42 Change Proposal: Fedora Plasma Workstation (System-Wide)

2024-04-03 Thread Kilian Hanich via devel
Am 04.04.24 um 01:03 schrieb Kevin Kofler via devel: You make a good point there. The thing is, GNOME tries really hard to design for new users, whom they define as a user who has never before used a computer. Such users are basically on the edge of extinction. A paradigm that works great for

Re: F42 Change Proposal: Fedora Plasma Workstation (System-Wide)

2024-04-02 Thread Kilian Hanich via devel
Am 03.04.24 um 01:48 schrieb Kevin Fenzi: On Tue, Apr 02, 2024 at 04:06:45PM -0400, Steve Cossette wrote: Alright, so a substantial amount of information changed since the original submission of the change proposal. We aren't necessarily thinking of demoting Gnome. The overall spirit of the CP

Re: Three steps we could take to make supply chain attacks a bit harder

2024-04-02 Thread Kilian Hanich via devel
Am 02.04.24 um 10:22 schrieb Florian Weimer: - Can some wrappers be developed to make it both easier and safer? GCC already provides function multi-versioning/target clones as a higher-level interface. Also, upstreams should by default properly mark their stuffs with restrictive

Re: Three steps we could take to make supply chain attacks a bit harder

2024-03-31 Thread Kilian Hanich via devel
Am 31.03.24 um 23:02 schrieb Scott Schmit: On Sun, Mar 31, 2024 at 04:09:36PM -0400, Ben Beasley wrote: On 3/31/24 2:12 PM, Kevin Kofler via devel wrote: But the fact is: What WOULD have stopped this attack: (one or more of:) * Deleting ALL unit tests in %prep (and then of course not trying

Re: Three steps we could take to make supply chain attacks a bit harder

2024-03-31 Thread Kilian Hanich via devel
Am 31.03.24 um 21:19 schrieb Simon de Vlieger: I don't quite agree with you. Two factor authentication whether an actual second factor device or not does prevent credential stuffing which is a common attack method that is easy to perform. It is when people take databases of previously leaked

Re: Three steps we could take to make supply chain attacks a bit harder

2024-03-30 Thread Kilian Hanich via devel
Am 30.03.24 um 20:11 schrieb Kevin Kofler via devel: Or better: Do not execute tests to begin with! rm -rf test in %prep and NEVER run tests during builds. Even when the tests are all legitimate, all it does is slow down the build (e.g., compare glibc build times without and with tests) and

Re: Three steps we could take to make supply chain attacks a bit harder

2024-03-30 Thread Kilian Hanich via devel
Am 30.03.24 um 15:44 schrieb Zbigniew Jędrzejewski-Szmek: Meson outclasses CMake in functionality, clarity, and brevity. I doesn't make sense to consider switching to CMake at this point. While I do agree on clarity and brevity, I don't on functionality. Meson doesn't allow you do create your

Re: just to let you know FESCo agreed to a preliminary injunction while we consider this issue

2024-02-10 Thread Kilian Hanich via devel
Am 10.02.24 um 09:47 schrieb Neal Gompa: Technically, turning off display sync completely is quite difficult right now since the actual driver stack in Linux underneath everything (both Wayland and X11) uses implicit sync right now (Linux kernel drivers, Mesa drivers, etc.). Interesting

Re: just to let you know FESCo agreed to a preliminary injunction while we consider this issue

2024-02-09 Thread Kilian Hanich via devel
Am 09.02.24 um 18:28 schrieb Neal Gompa: On Fri, Feb 9, 2024 at 12:16 PM Roy Bekken wrote: On fredag 9. februar 2024 17:41:33 CET Neal Gompa wrote: On Fri, Feb 9, 2024 at 11:06 AM Roy Bekken wrote: On fredag 9. februar 2024 04:04:04 CET Steve Cossette wrote: I am not gonna reply to

Re: just to let you know FESCo agreed to a preliminary injunction while we consider this issue

2024-02-01 Thread Kilian Hanich via devel
Am 01.02.24 um 17:44 schrieb Neal Gompa: That is not necessarily true. For your example about window placement, there is this:https://gitlab.freedesktop.org/wayland/wayland-protocols/-/merge_requests/264 Am 01.02.24 um 17:46 schrieb Neal Gompa: Sorry, I meant to point to this as well: