Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-10 Thread Marian Ganisin
On Wed, May 08, 2013 at 10:00:50AM +0200, Olav Vitters wrote: On Sat, May 04, 2013 at 12:03:39AM -0500, Eric Sandeen wrote: Anaconda has a pretty special place in this project. It is the uber-administrator of every new Fedora install. We would do better as a community to hash out major

timeliness Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-09 Thread Ian Malone
On 9 May 2013 05:44, Felix Miata mrma...@earthlink.net wrote: On 2013-05-09 00:02 (GMT-0400) Adam Williamson composed: On Wed, 2013-05-08 at 22:36 -0400, Felix Miata wrote: On 2013-05-08 10:09 (GMT+0200) Pierre-Yves Chibon composed: you are replying to a 4 days old email on a thread

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-09 Thread Chris Adams
Once upon a time, Felix Miata mrma...@earthlink.net said: So everyone who cannot maintain currency has to catch up 100% prior to writing a response coming to mind while reading, lest he be publicly chastised by temporal relevance police? Well, yes. That is common courtesy in any form of

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-09 Thread David Woodhouse
On Sat, 2013-05-04 at 16:42 -0600, Kevin Fenzi wrote: If they do decide to keep the change, you could escalate it to FESCo. However, (speaking only for myself here) I would be VERY reluctant to override maintainers on their packages on something that is a design decision/judgement call. Where

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-09 Thread Felix Miata
On 2013-05-09 08:00 (GMT-0500) Chris Adams composed: Felix Miata composed: So everyone who cannot maintain currency has to catch up 100% prior to writing a response coming to mind while reading, lest he be publicly chastised by temporal relevance police? Well, yes. That is common

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-09 Thread John . Florian
From: Adam Williamson awill...@redhat.com On Wed, 2013-05-08 at 22:36 -0400, Felix Miata wrote: On 2013-05-08 10:09 (GMT+0200) Pierre-Yves Chibon composed: you are replying to a 4 days old email on a thread that is no longer active? A: The thread was started on a Friday night.

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-09 Thread Tomas Mraz
On Wed, 2013-05-08 at 07:04 +0200, Stef Walter wrote: On 06.05.2013 21:51, Adam Williamson wrote: On Mon, 2013-05-06 at 21:37 +0200, Stef Walter wrote: On 06.05.2013 18:38, Adam Williamson wrote: On Mon, 2013-05-06 at 11:43 -0400, Rahul Sundaram wrote: On 05/06/2013 10:48 AM, Miloslav

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Olav Vitters
On Mon, May 06, 2013 at 09:51:22AM -0400, Przemek Klosowski wrote: On 05/04/2013 12:30 AM, Matthew Garrett wrote: On Fri, May 03, 2013 at 11:24:01PM -0500, Eric Sandeen wrote: Matthew, with all due respect the tone of the bug doesn't make me think that there is a lot of interest in discussion

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Olav Vitters
On Sat, May 04, 2013 at 12:03:39AM -0500, Eric Sandeen wrote: Anaconda has a pretty special place in this project. It is the uber-administrator of every new Fedora install. We would do better as a community to hash out major changes before they're made, and try to reach some agreement before

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Olav Vitters
On Fri, May 03, 2013 at 09:03:02PM -0700, Dan Mashal wrote: Let's be realistic here. The precedence they have recently set is they make decisions and if you don't like it too bad. Even if that is true, what is your point? -- Regards, Olav -- devel mailing list devel@lists.fedoraproject.org

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Pierre-Yves Chibon
On Wed, 2013-05-08 at 10:10 +0200, Olav Vitters wrote: On Fri, May 03, 2013 at 09:03:02PM -0700, Dan Mashal wrote: Let's be realistic here. The precedence they have recently set is they make decisions and if you don't like it too bad. Even if that is true, what is your point? That you are

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Dan Mashal
On Wednesday, May 8, 2013, Pierre-Yves Chibon wrote: On Wed, 2013-05-08 at 10:10 +0200, Olav Vitters wrote: On Fri, May 03, 2013 at 09:03:02PM -0700, Dan Mashal wrote: Let's be realistic here. The precedence they have recently set is they make decisions and if you don't like it too bad.

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Pete Zaitcev
On Wed, 08 May 2013 10:09:13 +0200 Pierre-Yves Chibon pin...@pingoured.fr wrote: On Wed, 2013-05-08 at 10:10 +0200, Olav Vitters wrote: On Fri, May 03, 2013 at 09:03:02PM -0700, Dan Mashal wrote: Let's be realistic here. The precedence they have recently set is they make decisions and

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Felix Miata
On 2013-05-08 10:09 (GMT+0200) Pierre-Yves Chibon composed: you are replying to a 4 days old email on a thread that is no longer active? A: The thread was started on a Friday night. B: Some people don't get to read mail every day, or more than a few or less times a week. A + B = perfectly

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Ankur Sinha
On Wed, 2013-05-08 at 19:59 -0600, Pete Zaitcev wrote: FOUR DAYS is no longer active for you? Seriously? You want to STFU those who disagree _this hard_? Pete, There is no constructive discussion going on here any more. 4 days is certainly enough time for a mailing list thread to go inactive.

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Adam Williamson
On Wed, 2013-05-08 at 22:36 -0400, Felix Miata wrote: On 2013-05-08 10:09 (GMT+0200) Pierre-Yves Chibon composed: you are replying to a 4 days old email on a thread that is no longer active? A: The thread was started on a Friday night. B: Some people don't get to read mail every day,

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Felix Miata
On 2013-05-09 00:02 (GMT-0400) Adam Williamson composed: On Wed, 2013-05-08 at 22:36 -0400, Felix Miata wrote: On 2013-05-08 10:09 (GMT+0200) Pierre-Yves Chibon composed: you are replying to a 4 days old email on a thread that is no longer active? A: The thread was started on a

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-08 Thread Adam Williamson
On Thu, 2013-05-09 at 00:44 -0400, Felix Miata wrote: On 2013-05-09 00:02 (GMT-0400) Adam Williamson composed: On Wed, 2013-05-08 at 22:36 -0400, Felix Miata wrote: On 2013-05-08 10:09 (GMT+0200) Pierre-Yves Chibon composed: you are replying to a 4 days old email on a thread that is

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-07 Thread poma
On 06.05.2013 23:42, Adam Williamson wrote: On Fri, 2013-05-03 at 13:04 -0700, Dan Mashal wrote: Hi, In the latest Fedora 19 Beta TC2 install after I got through the initial steps of the install I started to setup my root password. To my surprise my password was shown in plain text instead

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-07 Thread Stef Walter
On 06.05.2013 21:51, Adam Williamson wrote: On Mon, 2013-05-06 at 21:37 +0200, Stef Walter wrote: On 06.05.2013 18:38, Adam Williamson wrote: On Mon, 2013-05-06 at 11:43 -0400, Rahul Sundaram wrote: On 05/06/2013 10:48 AM, Miloslav Trmač wrote: On Sat, May 4, 2013 at 6:31 AM, Rahul Sundaram

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Bill Peck
On 05/04/2013 06:22 PM, Dan Mashal wrote: On Sat, May 4, 2013 at 2:37 AM, Michael Scherer m...@zarb.org wrote: I can add to that that I have seen more than once people setting a password which was not the one they believed due to : - keyboard layout ( ie, qwerty vs azerty in France ) - small

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Przemek Klosowski
On 05/03/2013 04:08 PM, Reartes Guillermo wrote: I think that the previous behaviour was better. (covering the password with bullets). what if the password IS 12 bullet characters :) -- devel mailing list devel@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Reartes Guillermo
what if the password IS 12 bullet characters :) Three UI elements: * two password fields that do not echo the password by default or covers it with bullets or asterisks. * one check-box that shows the password if the user wishes so. It is the most flexible scheme. If one doubts the typed

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Przemek Klosowski
On 05/03/2013 10:59 PM, Matthew Garrett wrote: On Fri, May 03, 2013 at 10:36:51PM -0400, Rahul Sundaram wrote: I was referring to the decision to show the password in full when the user is typing it. Many UI decisions are unprecedented. That doesn't justify reopening bugs that the maintainer

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Josh Bressers
Will and Mairin had some good links talking about the merits of doing this and how hiding passwords doesn't even do all that much to help (a determined person can always just watch your keyboard). This argument isn't very solid. I mean someone can just break your window to get in your house,

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Florian Müllner
On Mon, May 6, 2013 at 3:21 PM, Przemek Klosowski przemek.klosow...@nist.gov wrote: Another example of such important change that recently appeared without recourse and much discussion is the lock screen: previously, the password unlock widget had focus so one could start typing the password,

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Stephen Gallagher
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/06/2013 09:27 AM, Josh Bressers wrote: Will and Mairin had some good links talking about the merits of doing this and how hiding passwords doesn't even do all that much to help (a determined person can always just watch your keyboard).

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Eric H. Christensen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, May 06, 2013 at 08:27:14AM -0500, Josh Bressers wrote: A checkbox is probably the right way to handle this. While yes it's slightly more work, it does two very important things. It puts the user in control, and it is secure by default.

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Przemek Klosowski
On 05/04/2013 12:30 AM, Matthew Garrett wrote: On Fri, May 03, 2013 at 11:24:01PM -0500, Eric Sandeen wrote: Matthew, with all due respect the tone of the bug doesn't make me think that there is a lot of interest in discussion from the developers. Reopening bugs is generally a good way of

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Przemek Klosowski
On 05/04/2013 05:37 AM, Michael Scherer wrote: Or I could also speak of the small non standard keyboard such as macbook one where ~ or | are not printed and where using the wrong keyboard could result in wrong characters if you are unaware of the problem. Reminds me of the famous case when

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Miloslav Trmač
On Sat, May 4, 2013 at 6:31 AM, Rahul Sundaram methe...@gmail.com wrote: On 05/04/2013 12:24 AM, Eric Sandeen wrote: On the other hand, if it's the right thing to do, then it needs to be done for GUI password change dialogs and the passwd command should be updated as well, for consistency,

Re: Do you think this is a security risk and if not is it a bad UI?decision?

2013-05-06 Thread Mateusz Marzantowicz
On 05.05.2013 10:54, drago01 wrote: Seriously this changes just papers over another bug we suck at keyboard layout selection ... fixing it by showing the password like that is just wrong. Thank you for writing this here! Password entry box is not a place for testing keyboard layout. Maybe

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Rahul Sundaram
On 05/06/2013 10:48 AM, Miloslav Trmač wrote: On Sat, May 4, 2013 at 6:31 AM, Rahul Sundaram wrote: On 05/04/2013 12:24 AM, Eric Sandeen wrote: On the other hand, if it's the right thing to do, then it needs to be done for GUI password change dialogs and the passwd

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Adam Williamson
On Mon, 2013-05-06 at 11:43 -0400, Rahul Sundaram wrote: On 05/06/2013 10:48 AM, Miloslav Trmač wrote: On Sat, May 4, 2013 at 6:31 AM, Rahul Sundaram wrote: On 05/04/2013 12:24 AM, Eric Sandeen wrote: On the other hand, if it's the right thing to do,

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Matthias Clasen
On Sat, 2013-05-04 at 00:26 -0500, Michael Cronenworth wrote: On 05/03/2013 03:08 PM, Reartes Guillermo wrote: I think that the previous behaviour was better. (covering the password with bullets). At least the phones only show one character at a time, not the whole password. GTK

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Matthias Clasen
On Mon, 2013-05-06 at 09:21 -0400, Przemek Klosowski wrote: On 05/03/2013 10:59 PM, Matthew Garrett wrote: On Fri, May 03, 2013 at 10:36:51PM -0400, Rahul Sundaram wrote: I was referring to the decision to show the password in full when the user is typing it. Many UI decisions are

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Adam Williamson
On Mon, 2013-05-06 at 12:48 -0400, Matthias Clasen wrote: On Sat, 2013-05-04 at 00:26 -0500, Michael Cronenworth wrote: On 05/03/2013 03:08 PM, Reartes Guillermo wrote: I think that the previous behaviour was better. (covering the password with bullets). At least the phones only

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Matthias Clasen
On Mon, 2013-05-06 at 11:01 -0700, Adam Williamson wrote: On Mon, 2013-05-06 at 12:48 -0400, Matthias Clasen wrote: On Sat, 2013-05-04 at 00:26 -0500, Michael Cronenworth wrote: On 05/03/2013 03:08 PM, Reartes Guillermo wrote: I think that the previous behaviour was better. (covering the

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Stef Walter
On 06.05.2013 18:38, Adam Williamson wrote: On Mon, 2013-05-06 at 11:43 -0400, Rahul Sundaram wrote: On 05/06/2013 10:48 AM, Miloslav Trmač wrote: On Sat, May 4, 2013 at 6:31 AM, Rahul Sundaram wrote: On 05/04/2013 12:24 AM, Eric Sandeen wrote: On the other hand, if

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Adam Williamson
On Mon, 2013-05-06 at 21:37 +0200, Stef Walter wrote: On 06.05.2013 18:38, Adam Williamson wrote: On Mon, 2013-05-06 at 11:43 -0400, Rahul Sundaram wrote: On 05/06/2013 10:48 AM, Miloslav Trmač wrote: On Sat, May 4, 2013 at 6:31 AM, Rahul Sundaram wrote: On 05/04/2013 12:24

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Adam Williamson
On Fri, 2013-05-03 at 13:04 -0700, Dan Mashal wrote: Hi, In the latest Fedora 19 Beta TC2 install after I got through the initial steps of the install I started to setup my root password. To my surprise my password was shown in plain text instead of bullets. For the record: commit

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Dan Mashal
On Mon, May 6, 2013 at 2:42 PM, Adam Williamson awill...@redhat.com wrote: For the record: commit da565b769979a031f318dbc727b9888e4f1fb37c Author: Chris Lumens clum...@redhat.com Date: Mon May 6 17:18:30 2013 -0400 Revert Add signal handlers for controlling password entry visibility.

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Nico Kadel-Garcia
On Mon, May 6, 2013 at 9:37 AM, Eric H. Christensen spa...@fedoraproject.org wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, May 06, 2013 at 08:27:14AM -0500, Josh Bressers wrote: A checkbox is probably the right way to handle this. While yes it's slightly more work, it does

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-06 Thread Nico Kadel-Garcia
On Mon, May 6, 2013 at 8:34 AM, Bill Peck bp...@redhat.com wrote: On 05/04/2013 06:22 PM, Dan Mashal wrote: On Sat, May 4, 2013 at 2:37 AM, Michael Scherer m...@zarb.org wrote: I can add to that that I have seen more than once people setting a password which was not the one they believed due

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Pierre-Yves Chibon
On Sat, 2013-05-04 at 15:22 -0700, Dan Mashal wrote: Hidden by default and showing it on demand is likely to still be a hindrance to people who may not know they type their password wrong ( because I think most assume that it will work fine, we are not to a point where people assume by

Re: Do you think this is a security risk and if not is it a bad UI?decision?

2013-05-05 Thread drago01
On Sat, May 4, 2013 at 10:27 PM, Adam Williamson awill...@redhat.com wrote: On Sat, 2013-05-04 at 13:20 -0700, Adam Williamson wrote: That's it. So far as I can see, that's the sole reference to any actual identifiable study. And again, so far as I can see, the entire 2009 debate spiraled out

Re: Do you think this is a security risk and if not is it a bad UI?decision?

2013-05-05 Thread Nicolas Mailhot
Le Sam 4 mai 2013 21:52, Adam Williamson a écrit : I think it's generally accepted that this is a case of a usability versus security trade-off, and the questions are a) exactly how much security does masking provide and b) once we have agreed on the terms (exactly how much more usable are

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Nicolas Mailhot
Le Dim 5 mai 2013 00:22, Dan Mashal a écrit : I think people that have Macs have learned how to use their slightly different keybaords by now. OTOH there are slight variations between the windows, mac and linux layouts for the same locale (due to the fact that getting fixes in xkb is way

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Dariusz J. Garbowski
On 05/05/13 08:40 AM, Pierre-Yves Chibon wrote: On Sat, 2013-05-04 at 15:22 -0700, Dan Mashal wrote: Hidden by default and showing it on demand is likely to still be a hindrance to people who may not know they type their password wrong ( because I think most assume that it will work fine, we

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread drago01
On Sun, May 5, 2013 at 1:28 AM, Adam Williamson awill...@redhat.com wrote: On Sat, 2013-05-04 at 15:58 -0700, Dan Mashal wrote: If they do decide to keep the change, you could escalate it to FESCo. However, (speaking only for myself here) I would be VERY reluctant to override maintainers

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Roberto Ragusa
On 05/04/2013 06:35 PM, Adam Williamson wrote: http://it.slashdot.org/story/13/05/04/1248242/fedora-19-to-stop-masking-passwords Well, that escalated quickly. And in one of the replies: http://it.slashdot.org/comments.pl?sid=3716785cid=43628711 I like the way Windows 8 addressed this

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Adam Williamson
On Sun, 2013-05-05 at 14:43 +0200, drago01 wrote: Excuse my cynicism here but this would also require some change to the QA process itself and what are blockers and what are not and the nice to have process which should be renamed we won't hold our breath. I don't really see any special

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Adam Williamson
On Sun, 2013-05-05 at 15:50 +0200, Roberto Ragusa wrote: On 05/04/2013 06:35 PM, Adam Williamson wrote: http://it.slashdot.org/story/13/05/04/1248242/fedora-19-to-stop-masking-passwords Well, that escalated quickly. And in one of the replies:

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Chris Murphy
On May 5, 2013, at 1:40 AM, Pierre-Yves Chibon pin...@pingoured.fr wrote: So if you disagree please provide *reasonable* arguments. Those who disagree have already done this ad nauseum. The summary: The Neilsen-Norman article cited is an editorial piece. It is out of scope, out of context,

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Orcan Ogetbil
On Fri, May 3, 2013 at 4:04 PM, Dan Mashal wrote: Hi, In the latest Fedora 19 Beta TC2 install after I got through the initial steps of the install I started to setup my root password. To my surprise my password was shown in plain text instead of bullets. The obvious workaround is to use

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Adam Williamson
On Sun, 2013-05-05 at 14:07 -0400, Orcan Ogetbil wrote: On Fri, May 3, 2013 at 4:04 PM, Dan Mashal wrote: Hi, In the latest Fedora 19 Beta TC2 install after I got through the initial steps of the install I started to setup my root password.

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread M. Edward (Ed) Borasky
On Sun, May 5, 2013 at 11:35 AM, Adam Williamson awill...@redhat.com wrote: [snip] Look, please, by all means, calmly discuss the merits of the decision. Just don't bring into question the motivations of its introduction unless you have a damn strong factual basis for doing so. I maintain an

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Michael Scherer
Le dimanche 05 mai 2013 à 11:18 -0600, Chris Murphy a écrit : On May 5, 2013, at 1:40 AM, Pierre-Yves Chibon pin...@pingoured.fr wrote: So if you disagree please provide *reasonable* arguments. Those who disagree have already done this ad nauseum. The summary: The Neilsen-Norman

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread T.C. Hollingsworth
On Sat, May 4, 2013 at 10:27 PM, Gregory Maxwell gmaxw...@gmail.com wrote: On Sat, May 4, 2013 at 11:06 AM, T.C. Hollingsworth tchollingswo...@gmail.com wrote: More to the point, the vast majority of the other software *in Fedora* that accepts passwords for any reason hides the passwords as

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Orcan Ogetbil
On Sun, May 5, 2013 at 2:35 PM, Adam Williamson wrote: On Sun, 2013-05-05 at 14:07 -0400, Orcan Ogetbil wrote: On Fri, May 3, 2013 at 4:04 PM, Dan Mashal wrote: Hi, In the latest Fedora 19 Beta TC2 install after I got through the initial steps of the

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-05 Thread Adam Williamson
On Mon, 2013-05-06 at 00:02 -0400, Orcan Ogetbil wrote: Look, please, by all means, calmly discuss the merits of the decision. Just don't bring into question the motivations of its introduction unless you have a damn strong factual basis for doing so. I believe I do have a damn strong

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Oron Peled
On Friday 03 May 2013 22:22:47 Bruno Wolff III wrote: It's not like the people entering the password don't know it is visible. I for one, will finish typing the password *way before* realizing it's visible: * Touch typing is fast * With passwords it's even faster: - Because it's very

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Stef Walter
On 04.05.2013 07:26, Michael Cronenworth wrote: On 05/03/2013 03:08 PM, Reartes Guillermo wrote: I think that the previous behaviour was better. (covering the password with bullets). At least the phones only show one character at a time, not the whole password. GTK shows everything or

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Oron Peled
On Saturday 04 May 2013 04:58:13 Matthew Garrett wrote: No, this isn't the most appropriate mailing list for the discussion - anaconda-devel-list is a better choice if you want to interact with the people who actually work on that code. What separate a Linux distro from a random batch of

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Michael Scherer
Le vendredi 03 mai 2013 à 21:41 -0700, Dan Mashal a écrit : On Fri, May 3, 2013 at 9:32 PM, Matthew Garrett mj...@srcf.ucam.org wrote: If you want to change a decision, it helps if you're discussing it in a forum that's read by the people who made that decision. Anaconda developers don't

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Rahul Sundaram
H On Sat, May 4, 2013 at 3:29 AM, Stef Walter st...@redhat.com wrote: There's already this exact phoneish password hint capability in GTK+ with the 'gtk-entry-password-hint-timeout' setting. Turn it on in $XDG_CONFIG_HOME/gtk-3.0/settings.ini, or use gtk_settings_set_string_property()

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Rahul Sundaram
Hi On Sat, May 4, 2013 at 4:06 AM, Rahul Sundaram wrote: This sounds pretty neat but I am unable to get this to work. I have tried gtk-entry-password-hint-timeout=600 and without the quotes as well. Never mind. For anyone else looking, just use the format in /etc/gtk-3.0/settings.ini

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Michael Scherer
Le vendredi 03 mai 2013 à 23:24 -0500, Eric Sandeen a écrit : What is the downside to defaulting to a hidden PW, with an opt-in mechanism to display the password as it's typed? The downsides of defaulting to cleartext have been noted, and to me are quite self-explanatory. First, we need to

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Rahul Sundaram
Hi On Sat, May 4, 2013 at 5:37 AM, Michael Scherer wrote: and I think that even Bruce Schneier have gave his opinion in favor of the proposal : http://www.schneier.com/blog/archives/2009/06/the_problem_wit_2.html http://www.schneier.com/blog/archives/2009/07/the_pros_and_co.html Not

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Björn Persson
Michael Scherer wrote: So what about hiding on demand, and having it visible by default ? This way, people who prefer to have it hidden will be happy, and we are still friendly to non technical users. That might be acceptable but only if there were a big, eye-catching warning that users would

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Matthew Garrett
On Sat, May 04, 2013 at 10:37:04AM +0300, Oron Peled wrote: What separate a Linux distro from a random batch of software is *policy* and what happened here is a radical policy change without any *prior* discussion. What happened here was a change in the UI of a single (albeit important)

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Matthew Garrett
On Fri, May 03, 2013 at 10:53:35PM -0600, Pete Zaitcev wrote: On Sat, 4 May 2013 05:32:18 +0100 Matthew Garrett mj...@srcf.ucam.org wrote: If you want to change a decision, it helps if you're discussing it in a forum that's read by the people who made that decision. This is a perfectly

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Matthew Garrett
On Fri, May 03, 2013 at 09:41:39PM -0700, Dan Mashal wrote: On Fri, May 3, 2013 at 9:32 PM, Matthew Garrett mj...@srcf.ucam.org wrote: If you want to change a decision, it helps if you're discussing it in a forum that's read by the people who made that decision. Anaconda developers don't

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Richard W.M. Jones
On Sat, May 04, 2013 at 05:51:02AM -0400, Rahul Sundaram wrote: Hi On Sat, May 4, 2013 at 5:37 AM, Michael Scherer wrote: and I think that even Bruce Schneier have gave his opinion in favor of the proposal : http://www.schneier.com/blog/archives/2009/06/the_problem_wit_2.html

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Andre Robatino
Richard W.M. Jones rjones at redhat.com writes: To be honest it would be a lot more convincing if someone had done a study and published the results of it, rather than just linking to opinions. I was rather hopeful that Neilsen-Norman would have done a study, but they don't publish their

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Adam Williamson
On Fri, 2013-05-03 at 13:04 -0700, Dan Mashal wrote: Hi, In the latest Fedora 19 Beta TC2 install after I got through the initial steps of the install I started to setup my root password. To my surprise my password was shown in plain text instead of bullets. I believe that this is a

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Adam Williamson
On Sat, 2013-05-04 at 04:58 +0100, Matthew Garrett wrote: On Fri, May 03, 2013 at 08:52:25PM -0700, Dan Mashal wrote: On Fri, May 3, 2013 at 8:51 PM, Matthew Garrett mj...@srcf.ucam.org wrote: And if the maintainers feel more than justified in closing it again? Bugzilla isn't a discussion

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Matthew Garrett
On Sat, May 04, 2013 at 09:42:22AM -0700, Adam Williamson wrote: On Sat, 2013-05-04 at 04:58 +0100, Matthew Garrett wrote: No, this isn't the most appropriate mailing list for the discussion - anaconda-devel-list is a better choice if you want to interact with the people who actually work

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread T.C. Hollingsworth
On Fri, May 3, 2013 at 10:45 PM, Chris Adams cmad...@hiwaay.net wrote: The vast majority of other software that accepts passwords for any reason hides the passwords as they are typed, so the general expectation is that passwords are not displayed on the screen. More to the point, the vast

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Michael Cronenworth
On 05/04/2013 02:29 AM, Stef Walter wrote: There's already this exact phoneish password hint capability in GTK+ with the 'gtk-entry-password-hint-timeout' setting. Turn it on in $XDG_CONFIG_HOME/gtk-3.0/settings.ini, or use gtk_settings_set_string_property() I forgot about that setting. It

Re: Do you think this is a security risk and if not is it a bad UI?decision?

2013-05-04 Thread Richard W.M. Jones
Another opinion. It is possible to study such things, and even give caveats and error bounds to show uncertainty. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Fedora Windows cross-compiler. Compile Windows programs, test, and build Windows installers.

Re: Do you think this is a security risk and if not is it a bad UI?decision?

2013-05-04 Thread Adam Williamson
On Sat, 2013-05-04 at 19:23 +0100, Richard W.M. Jones wrote: Another opinion. It is possible to study such things, and even give caveats and error bounds to show uncertainty. I went looking, but as T.C. Hollingsworth said, it doesn't appear that either side has produced anything much in the

Re: Do you think this is a security risk and if not is it a bad UI?decision?

2013-05-04 Thread Richard W.M. Jones
On Sat, May 04, 2013 at 12:52:00PM -0700, Adam Williamson wrote: I haven't found anything much beyond the initial pretty small study (62 participants) cited (and conducted) by Nielsen, Do you have a link to this one? This is the one I was originally looking for, but I still can't find the

Re: Do you think this is a security risk and if not is it a bad UI?decision?

2013-05-04 Thread Adam Williamson
On Sat, 2013-05-04 at 21:06 +0100, Richard W.M. Jones wrote: On Sat, May 04, 2013 at 12:52:00PM -0700, Adam Williamson wrote: I haven't found anything much beyond the initial pretty small study (62 participants) cited (and conducted) by Nielsen, Do you have a link to this one? This is the

Re: Do you think this is a security risk and if not is it a bad UI?decision?

2013-05-04 Thread Adam Williamson
On Sat, 2013-05-04 at 21:06 +0100, Richard W.M. Jones wrote: On Sat, May 04, 2013 at 12:52:00PM -0700, Adam Williamson wrote: I haven't found anything much beyond the initial pretty small study (62 participants) cited (and conducted) by Nielsen, Do you have a link to this one? This is the

Re: Do you think this is a security risk and if not is it a bad UI?decision?

2013-05-04 Thread Adam Williamson
On Sat, 2013-05-04 at 13:20 -0700, Adam Williamson wrote: That's it. So far as I can see, that's the sole reference to any actual identifiable study. And again, so far as I can see, the entire 2009 debate spiraled out from that single post, with lots of 'experts' adding their subjective $0.02

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Michael Scherer
Le samedi 04 mai 2013 à 05:51 -0400, Rahul Sundaram a écrit : Hi On Sat, May 4, 2013 at 5:37 AM, Michael Scherer wrote: and I think that even Bruce Schneier have gave his opinion in favor of the proposal :

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread David Woodhouse
On Sat, 2013-05-04 at 05:01 +0100, Matthew Garrett wrote: The appropriate place to discuss deliberate design decisions is a forum where said decisions are made, ie not Bugzilla. Or a forum where said decisions can be overridden with a little more sanity, such as FESCo. -- dwmw2 smime.p7s

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Adam Williamson
On Sat, 2013-05-04 at 22:48 +0100, David Woodhouse wrote: On Sat, 2013-05-04 at 05:01 +0100, Matthew Garrett wrote: The appropriate place to discuss deliberate design decisions is a forum where said decisions are made, ie not Bugzilla. Or a forum where said decisions can be overridden with

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread inode0
On Sat, May 4, 2013 at 5:01 PM, Adam Williamson awill...@redhat.com wrote: On Sat, 2013-05-04 at 22:48 +0100, David Woodhouse wrote: On Sat, 2013-05-04 at 05:01 +0100, Matthew Garrett wrote: The appropriate place to discuss deliberate design decisions is a forum where said decisions are

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Dan Mashal
On Sat, May 4, 2013 at 2:37 AM, Michael Scherer m...@zarb.org wrote: and I think that even Bruce Schneier have gave his opinion in favor of the proposal : http://www.schneier.com/blog/archives/2009/06/the_problem_wit_2.html http://www.schneier.com/blog/archives/2009/07/the_pros_and_co.html

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Dan Mashal
On Sat, May 4, 2013 at 3:42 PM, Kevin Fenzi ke...@scrye.com wrote: You posted this on friday afternoon, Rauhl re-opened the bug friday night. I suspect many anaconda folks have not even seen this discussion or the bug reopening yet. Is there some massive hurry here? No. Lets see what

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Chris Murphy
On May 4, 2013, at 3:37 AM, Michael Scherer m...@zarb.org wrote: Or I could also speak of the small non standard keyboard such as macbook one where ~ or | are not printed and where using the wrong keyboard could result in wrong characters if you are unaware of the problem. I don't know what

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Bruno Wolff III
On Sat, May 04, 2013 at 15:58:03 -0700, Dan Mashal dan.mas...@gmail.com wrote: I would rather have QA have move oversight on these things. As I only discovered this while doing QA. QA isn't really the right place to make up policy. This particular case doesn't seem to be something that

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Ian Malone
On 4 May 2013 23:42, Kevin Fenzi ke...@scrye.com wrote: On Sat, 4 May 2013 15:22:01 -0700 Dan Mashal dan.mas...@gmail.com wrote: On Sat, May 4, 2013 at 9:35 AM, Adam Williamson awill...@redhat.com wrote:

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Adam Williamson
On Sat, 2013-05-04 at 15:58 -0700, Dan Mashal wrote: If they do decide to keep the change, you could escalate it to FESCo. However, (speaking only for myself here) I would be VERY reluctant to override maintainers on their packages on something that is a design decision/judgement call.

Re: Do you think this is a security risk and if not is it a bad UI?decision?

2013-05-04 Thread Ian Malone
On 4 May 2013 19:23, Richard W.M. Jones rjo...@redhat.com wrote: Another opinion. It is possible to study such things, and even give caveats and error bounds to show uncertainty. Yes and no. It's possible it a tightly defined setting with specified outcomes. Since a crucial factors here

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Michael Scherer
Le samedi 04 mai 2013 à 15:22 -0700, Dan Mashal a écrit : On Sat, May 4, 2013 at 2:37 AM, Michael Scherer m...@zarb.org wrote: and I think that even Bruce Schneier have gave his opinion in favor of the proposal : http://www.schneier.com/blog/archives/2009/06/the_problem_wit_2.html

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Michael Scherer
Le samedi 04 mai 2013 à 17:06 -0600, Chris Murphy a écrit : On May 4, 2013, at 3:37 AM, Michael Scherer m...@zarb.org wrote: Or I could also speak of the small non standard keyboard such as macbook one where ~ or | are not printed and where using the wrong keyboard could result in

Re: Do you think this is a security risk and if not is it a bad UI decision?

2013-05-04 Thread Toshio Kuratomi
On Sat, May 04, 2013 at 04:42:58PM -0600, Kevin Fenzi wrote: If they do decide to keep the change, you could escalate it to FESCo. However, (speaking only for myself here) I would be VERY reluctant to override maintainers on their packages on something that is a design decision/judgement

  1   2   >