Re: PolicyKit and malware, was: What I HATE about F11

2009-06-23 Thread Kevin Kofler
David Zeuthen wrote: (I'm not subscribed to fedora-devel so if you want replies from me don't remove me from the Cc.) Hmmm, I can't directly CC folks through Gmane, the best I can do is to use the KNode feature which copies the text into KMail. An example where 1. is useful includes, funny

Re: What I HATE about F11

2009-06-21 Thread Horst H. von Brand
Lennart Poettering mzerq...@0pointer.de wrote: [...] Gah. Allowing packages to pierce the firewall just makes the firewall redundant. Not entirely. I still think that the current firewall situation on Fedora is pretty much broken. It's a bit like SELinux: it's one of the first features

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-19 Thread Nils Philippsen
On Thu, 2009-06-18 at 11:02 -0400, Matthias Clasen wrote: On Thu, 2009-06-18 at 11:58 +0200, Nils Philippsen wrote: As it is, malware need only sit in the background and wait for e.g. a PolicyKit-enabled user manager to acquire the authorization for user creation to be able to easily

PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread Nils Philippsen
On Tue, 2009-06-16 at 16:57 -0700, Adam Williamson wrote: Ve haf zer technology, already. :) it's just a case of adding code to more apps to take advantage of the awesomeness of PolicyKit, and I believe this is scheduled to happen. I still have one fairly serious gripe with PolicyKit: If one

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread Matthias Clasen
On Thu, 2009-06-18 at 11:58 +0200, Nils Philippsen wrote: As it is, malware need only sit in the background and wait for e.g. a PolicyKit-enabled user manager to acquire the authorization for user creation to be able to easily install a backdoor account. Nils, this is somewhat inaccurate

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread David Zeuthen
Hi, This is an accurate description of how things work, thanks to Matthias for clearing things up on this list. There's more background information about this particular thing here http://hal.freedesktop.org/docs/polkit/ http://hal.freedesktop.org/docs/polkit/PolicyKit-1.8.html

Re: What I HATE about F11

2009-06-18 Thread Martin Langhoff
On Sun, Jun 14, 2009 at 8:08 PM, Lennart Poetteringmzerq...@0pointer.de wrote: Gah. Allowing packages to pierce the firewall just makes the firewall redundant. True A firewall is an extra layer of security that simply hides the actual problem. Um!? Layered security is a _good thing_. *All*

Re: What I HATE about F11

2009-06-18 Thread Seth Vidal
On Thu, 18 Jun 2009, Martin Langhoff wrote: On Sun, Jun 14, 2009 at 8:08 PM, Lennart Poetteringmzerq...@0pointer.de wrote: Gah. Allowing packages to pierce the firewall just makes the firewall redundant. True A firewall is an extra layer of security that simply hides the actual problem.

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread Colin Walters
On Thu, Jun 18, 2009 at 5:58 AM, Nils Philippsenn...@redhat.com wrote: On Tue, 2009-06-16 at 16:57 -0700, Adam Williamson wrote: Ve haf zer technology, already. :) it's just a case of adding code to more apps to take advantage of the awesomeness of PolicyKit, and I believe this is scheduled to

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread Matthias Clasen
On Thu, 2009-06-18 at 19:09 +0100, Richard W.M. Jones wrote: On Thu, Jun 18, 2009 at 11:02:22AM -0400, Matthias Clasen wrote: The retained authorization is only valid for the subject that obtained it, which will typically be a process (identified by process id and start time) or a canonical

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread Matthew Garrett
On Thu, Jun 18, 2009 at 07:09:29PM +0100, Richard W.M. Jones wrote: On Thu, Jun 18, 2009 at 11:02:22AM -0400, Matthias Clasen wrote: The retained authorization is only valid for the subject that obtained it, which will typically be a process (identified by process id and start time) or a

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread Richard Hughes
On Thu, Jun 18, 2009 at 7:09 PM, Richard W.M. Jonesrjo...@redhat.com wrote: Can the malware inject code into the process which gained the authentication (eg. using ptrace)? Also, using a new PackageKit the worst you'll be able to do is install signed software from already configured repos.

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread Richard W.M. Jones
On Thu, Jun 18, 2009 at 03:02:53PM -0400, Matthias Clasen wrote: On Thu, 2009-06-18 at 19:09 +0100, Richard W.M. Jones wrote: On Thu, Jun 18, 2009 at 11:02:22AM -0400, Matthias Clasen wrote: The retained authorization is only valid for the subject that obtained it, which will typically be

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread Muayyad AlSadi
If one application acquires an authorization it automatically authorizes all other applications running on the same desktop -- and I think that is a potential attack vector for malware. maybe this is about sudo and a like things but PolicyKit is designed AFAIK to be much fine grained, it does

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread Simo Sorce
On Thu, 2009-06-18 at 20:53 +0100, Matthew Garrett wrote: On Thu, Jun 18, 2009 at 07:09:29PM +0100, Richard W.M. Jones wrote: On Thu, Jun 18, 2009 at 11:02:22AM -0400, Matthias Clasen wrote: The retained authorization is only valid for the subject that obtained it, which will typically be

Re: PolicyKit and malware, was: What I HATE about F11

2009-06-18 Thread David Zeuthen
Hi, On Thu, 2009-06-18 at 21:11 +0100, Richard W.M. Jones wrote: On Thu, Jun 18, 2009 at 03:02:53PM -0400, Matthias Clasen wrote: On Thu, 2009-06-18 at 19:09 +0100, Richard W.M. Jones wrote: Can the malware inject code into the process which gained the authentication (eg. using ptrace)?

Re: What I HATE about F11

2009-06-17 Thread Michael Fleming
On Mon, 15 Jun 2009 18:35:00 -0300 Martín Marqués martin.marq...@gmail.com wrote: 2009/6/15 Casey Dahlin cdah...@redhat.com: Maybe we should just make the command line more friendly so users don't mind reaching for it. I vote we add clippy. You're joking, right? It's *clippy* - of

Re: What I HATE about F11

2009-06-16 Thread Nicolas Mailhot
Le Lun 15 juin 2009 20:47, Casey Dahlin a écrit : On 06/14/2009 02:08 PM, Lennart Poettering wrote: Gah. Allowing packages to pierce the firewall just makes the firewall redundant. Not true. Allowing any listening program to poke a hole in the firewall would make it redundant. Packages

Re: What I HATE about F11

2009-06-16 Thread Thomas Woerner
Lennart Poettering wrote: On Mon, 15.06.09 12:41, Thomas Woerner (twoer...@redhat.com) wrote: So, what should happen here? Should we leave the firewall enabled in these cases* by default and require admins to open them? If so, is there any way that we can make this easier in some

Re: What I HATE about F11

2009-06-16 Thread Kevin Kofler
Charles Butterfield wrote: * My supported NVIDIA card (Quadro NVS 295) Supported by what? Who said it's supported? If it's NVidia, that's irrelevant, as their driver is proprietary and NOT supported or included in Fedora. Kevin Kofler -- fedora-devel-list mailing list

Re: What I HATE about F11

2009-06-16 Thread Adam Williamson
On Sun, 2009-06-14 at 19:36 +0100, Matthew Garrett wrote: there is an interesting issue; if you poke a hole in your firewall for all the ports that are listening automatically. you might as well not have a firewall in the first place... Well, not exactly. For instance, making it

Re: What I HATE about F11

2009-06-16 Thread Adam Williamson
On Tue, 2009-06-16 at 16:39 -0700, Adam Williamson wrote: On Sun, 2009-06-14 at 19:36 +0100, Matthew Garrett wrote: there is an interesting issue; if you poke a hole in your firewall for all the ports that are listening automatically. you might as well not have a firewall in the

Re: What I HATE about F11

2009-06-16 Thread Adam Williamson
On Mon, 2009-06-15 at 12:22 -0800, Jeff Spaleta wrote: On Mon, Jun 15, 2009 at 11:42 AM, Casey Dahlincdah...@redhat.com wrote: The ability for nautilus to prompt for credentials when the user tries to do something outside his permission level has been missing for far too long. Its

Re: What I HATE about F11

2009-06-16 Thread Matthias Clasen
On Tue, 2009-06-16 at 16:17 -0800, Jeff Spaleta wrote: Its the next circle, the less frequent administrative chore tasks, that I'm not sure its well defined in terms of which applications need PolKit support added in. Maybe Nautilus is that circle, maybe its not. Maybe its not time to start

Re: What I HATE about F11

2009-06-16 Thread Casey Dahlin
On 06/16/2009 07:57 PM, Adam Williamson wrote: On Mon, 2009-06-15 at 12:22 -0800, Jeff Spaleta wrote: On Mon, Jun 15, 2009 at 11:42 AM, Casey Dahlincdah...@redhat.com wrote: The ability for nautilus to prompt for credentials when the user tries to do something outside his

Re: What I HATE about F11

2009-06-15 Thread Frank Murphy
On 15/06/09 01:24, Guido Grazioli wrote: That said, I agree the wheel group should be enabled with sudo, though I disagree that the initial install user should be automatically added to it. But then again, I hate sudo :P I do most scripting that requires root access via

Re: What I HATE about F11

2009-06-15 Thread Matej Cepl
Charles Butterfield, Sat, 13 Jun 2009 22:19:17 -0400: Okay, so I mostly love Fedora. However, here are 4 things that got by blood really, really boiling, so I thought I'd share my emotions. They are mostly policy issues, where I think you have gotten it very very wrong. DON'T FEED THE

Re: What I HATE about F11

2009-06-15 Thread Thomas Woerner
Lennart Poettering wrote: On Sun, 14.06.09 18:34, Matthew Garrett (m...@redhat.com) wrote: So, solving this is pretty easy, even for newbies. But I agree that the error message will not help someone without advanced knowledge. Although I think people running Samba generally will know where to

Re: What I HATE about F11

2009-06-15 Thread Thomas Woerner
Matthew Garrett wrote: On Sun, Jun 14, 2009 at 06:13:51PM +0200, Julian Aloofi wrote: So, solving this is pretty easy, even for newbies. But I agree that the error message will not help someone without advanced knowledge. Although I think people running Samba generally will know where to look

Re: What I HATE about F11

2009-06-15 Thread Andrew Bartlett
On Sun, 2009-06-14 at 10:35 +0200, Martin Sourada wrote: On Sat, 2009-06-13 at 22:19 -0400, Charles Butterfield wrote: * Samba (outbound) browsing requires firewall mods I don't know how Samba works, so forgive me if I say obvious stupidity, but shouldn't *client* work even behind

Re: What I HATE about F11

2009-06-15 Thread Lennart Poettering
On Mon, 15.06.09 12:41, Thomas Woerner (twoer...@redhat.com) wrote: So, what should happen here? Should we leave the firewall enabled in these cases* by default and require admins to open them? If so, is there any way that we can make this easier in some Packagekit-oriented manner? If

Re: What I HATE about F11

2009-06-15 Thread Bill Nottingham
Lennart Poettering (mzerq...@0pointer.de) said: It's not just that ens1371 is shown as unrealistically popular, es1371 is what either QEMU or VMWare emulates. Bill -- fedora-devel-list mailing list fedora-devel-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-devel-list

Re: What I HATE about F11

2009-06-15 Thread Michael Cronenworth
Jeff Spaleta wrote: I wonder, Would there be a reliable way to separate out emulated hardware inside the smolt database reliably so we can get a better statistical survey of in-service physical hardware devices? QEMU inserts its name into the CPU string does it not? It could be sorted that

Re: What I HATE about F11

2009-06-15 Thread Ville Skyttä
On Sunday 14 June 2009, Richard Fearn wrote: We have the wheel group which would fit the bill. Yeah, I always uncomment the %wheel line in sudoers and then add myself to that group. Ditto. See also https://bugzilla.redhat.com/show_bug.cgi?id=462161 -- fedora-devel-list mailing list

Re: What I HATE about F11

2009-06-15 Thread Dave Jones
On Sun, Jun 14, 2009 at 09:57:56PM -0500, Mike McGrath wrote: On Sun, 14 Jun 2009, Mike McGrath wrote: On Mon, 15 Jun 2009, Lennart Poettering wrote: On Mon, 15.06.09 09:15, James Morris (jmor...@namei.org) wrote: On Sun, 14 Jun 2009, Lennart Poettering wrote:

Re: What I HATE about F11

2009-06-15 Thread Seth Vidal
On Mon, 15 Jun 2009, Seth Vidal wrote: On Mon, 15 Jun 2009, Lennart Poettering wrote: On Mon, 15.06.09 14:47, Dave Jones (da...@redhat.com) wrote: As already mentioned, smolt never heard of HDA. Either I am blind or there is no trace at all of HDA devices in this web UI. Maybe I'm

Re: What I HATE about F11

2009-06-15 Thread Casey Dahlin
On 06/15/2009 03:04 PM, Robert Marcano wrote: On Mon, Jun 15, 2009 at 2:17 PM, Casey Dahlincdah...@redhat.com wrote: The problem that does arise is: just because apache is installed doesn't mean its running. Really, init scripts should open the firewall ports they need when their service

Re: What I HATE about F11

2009-06-15 Thread Matthew Woehlke
Casey Dahlin wrote: Really, init scripts should open the firewall ports they need when their service comes up (and I'll propose something for upstart 1.0 later today to make that make more sense.) How is that supposed to work when I only want to allow connections to a service on a whitelist

Re: What I HATE about F11

2009-06-15 Thread Mike McGrath
On Mon, 15 Jun 2009, Lennart Poettering wrote: On Mon, 15.06.09 14:47, Dave Jones (da...@redhat.com) wrote: Are you speaking of the same smolt that lists es1371 as most popular sound card? i.e. a sound card that has been out of production since about 10 years now? Somehow I

Re: What I HATE about F11

2009-06-15 Thread Casey Dahlin
On 06/14/2009 09:13 PM, Simo Sorce wrote: On Sun, 2009-06-14 at 14:23 -0800, Jeff Spaleta wrote: On Sun, Jun 14, 2009 at 6:45 AM, Simo Sorcesso...@redhat.com wrote: I haven't done a graphical root login in the past 10 years probably and on multiple distribution. Graphical root login is

Re: What I HATE about F11

2009-06-15 Thread Matthew Woehlke
Matthew Woehlke wrote: Configuration is fine, just as long as there /is/ configuration and not running a service always exposes it to the world with no way to prevent that. (Prevention by editing init-scripts doesn't count ;-).) That's terrible. Unfortunately, I noticed after hitting 'send'

Re: What I HATE about F11

2009-06-15 Thread Jeff Spaleta
On Mon, Jun 15, 2009 at 11:42 AM, Casey Dahlincdah...@redhat.com wrote: The ability for nautilus to prompt for credentials when the user tries to do something outside his permission level has been missing for far too long. Its annoying to implement, but I'll owe a beer to whoever finally does

Re: What I HATE about F11

2009-06-15 Thread Casey Dahlin
On 06/15/2009 04:22 PM, Jeff Spaleta wrote: On Mon, Jun 15, 2009 at 11:42 AM, Casey Dahlincdah...@redhat.com wrote: The ability for nautilus to prompt for credentials when the user tries to do something outside his permission level has been missing for far too long. Its annoying to

Re: What I HATE about F11

2009-06-15 Thread drago01
On Mon, Jun 15, 2009 at 2:34 AM, Lennart Poetteringmzerq...@0pointer.de wrote: On Sun, 14.06.09 16:11, Jeff Spaleta (jspal...@gmail.com) wrote: On Sun, Jun 14, 2009 at 3:36 PM, Lennart Poetteringmzerq...@0pointer.de wrote: Are you speaking of the same smolt that lists es1371 as most

Re: What I HATE about F11

2009-06-15 Thread drago01
On Mon, Jun 15, 2009 at 10:33 PM, Casey Dahlincdah...@redhat.com wrote: Maybe we should just make the command line more friendly so users don't mind reaching for it. I vote we add clippy. yum install hotwire ;) -- fedora-devel-list mailing list fedora-devel-list@redhat.com

Re: What I HATE about F11

2009-06-15 Thread Jeff Spaleta
On Mon, Jun 15, 2009 at 12:33 PM, Casey Dahlincdah...@redhat.com wrote: Maybe we should just make the command line more friendly so users don't mind reaching for it. I vote we add clippy. I'm not saying that necessarily needs to be friendlier to use but it may need to be more discoverable as

Re: What I HATE about F11

2009-06-14 Thread Michael Fleming
On Sat, 13 Jun 2009 22:19:17 -0400 Charles Butterfield charles.butterfi...@nextcentury.com wrote: Okay, so I mostly love Fedora. However, here are 4 things that got by blood really, really boiling, so I thought I'd share my emotions. They are mostly policy issues, where I think you have

Re: What I HATE about F11

2009-06-14 Thread Martin Sourada
On Sat, 2009-06-13 at 22:19 -0400, Charles Butterfield wrote: snip * Root gdm login - gets harder every release - SHAME ON YOU root nazis! You can always init 3, login as root and startx if you *really need* graphical root login (or use su in gnome-terminal or whatever gui terminal

Re: What I HATE about F11

2009-06-14 Thread Richard Fearn
Hi, To be honest, I like the Ubuntu way of adding a sudoers entry for the first user that gets created. Then suggest it as a feature for F12 That is actually a very good idea. Ubuntu has an admin group, and users in that group can use sudo due to this line in sudoers: %admin ALL=(ALL) ALL

Re: What I HATE about F11

2009-06-14 Thread Mathieu Bridon (bochecha)
Ubuntu has an admin group, and users in that group can use sudo due to this line in sudoers: %admin ALL=(ALL) ALL I might suggest this as a feature unless anyone else wants to (or thinks I shouldn't) ? # grep -n wheel /etc/sudoers 81:## Allows people in group wheel to run all commands 82:#

Re: What I HATE about F11

2009-06-14 Thread Richard Fearn
# grep -n wheel /etc/sudoers 81:## Allows people in group wheel to run all commands 82:# %wheel     ALL=(ALL)       ALL 85:# %wheel     ALL=(ALL)       NOPASSWD: ALL All you have to do is uncomment one line ;) That's exactly what I do, followed by: $ usermod -a -G wheel rich But wouldn't

Re: What I HATE about F11

2009-06-14 Thread Simo Sorce
On Sun, 2009-06-14 at 10:35 +0200, Martin Sourada wrote: On Sat, 2009-06-13 at 22:19 -0400, Charles Butterfield wrote: snip * Root gdm login - gets harder every release - SHAME ON YOU root nazis! You can always init 3, login as root and startx if you *really need* graphical

Re: What I HATE about F11

2009-06-14 Thread Jesse Keating
On Jun 14, 2009, at 5:31, Richard Fearn richardfe...@gmail.com wrote: Hi, To be honest, I like the Ubuntu way of adding a sudoers entry for the first user that gets created. Then suggest it as a feature for F12 That is actually a very good idea. Ubuntu has an admin group, and users

Re: What I HATE about F11

2009-06-14 Thread Bruno Wolff III
On Sun, Jun 14, 2009 at 17:45:43 +1000, Michael Fleming mflem...@thatfleminggent.com wrote: I've done reinstalls and upgrades and not seen a denial AVC - I believe if it runs during the installer it would be a permissive / targeted mode. I did have SELinux break an upgrade but that was many

Re: What I HATE about F11

2009-06-14 Thread Richard Fearn
We have the wheel group which would fit the bill. Yeah, I always uncomment the %wheel line in sudoers and then add myself to that group. Hmmm, having looked at the Features guidelines I'm not sure if this warrants a feature page or not. It would only involve a change to the default sudoers

Re: What I HATE about F11

2009-06-14 Thread Frank Murphy
On 14/06/09 16:07, Orcan Ogetbil wrote: snip However I agree with you that samba is always a pain to setup on new systems. I do not hate it, but I wish this had been made easier. Logging into X as root? I can't comment on this as I didn't ever feel the need to do that. I didn't know it was

Re: What I HATE about F11

2009-06-14 Thread Richard Fearn
The way it is done right now, you have a system that might give too few permissions to some users. If that causes a problem, you'll notice it, and you can correct it in a very simple way (uncomment one line and add a user to a group). However, if we change the default, you have a system that

Re: What I HATE about F11

2009-06-14 Thread Jesse Keating
On Sun, 2009-06-14 at 15:59 +0100, Richard Fearn wrote: We have the wheel group which would fit the bill. Yeah, I always uncomment the %wheel line in sudoers and then add myself to that group. Hmmm, having looked at the Features guidelines I'm not sure if this warrants a feature page or

Re: What I HATE about F11

2009-06-14 Thread Matthew Garrett
On Sun, Jun 14, 2009 at 05:10:14PM +0200, Mathieu Bridon (bochecha) wrote: However, if we change the default, you have a system that may be giving too much permissions to some users depending on your taste. And the worse part is that you (as an admin) might not even know it ! The semantics of

Re: What I HATE about F11

2009-06-14 Thread Julian Aloofi
Am Sonntag, den 14.06.2009, 17:10 +0200 schrieb Mathieu Bridon The way it is done right now, you have a system that might give too few permissions to some users. If that causes a problem, you'll notice it, and you can correct it in a very simple way (uncomment one line and add a user to a

Re: What I HATE about F11

2009-06-14 Thread Mathieu Bridon (bochecha)
The way it is done right now, you have a system that might give too few permissions to some users. If that causes a problem, you'll notice it, and you can correct it in a very simple way (uncomment one line and add a user to a group). However, if we change the default, you have a system that

Re: What I HATE about F11

2009-06-14 Thread drago01
On Sun, Jun 14, 2009 at 6:13 PM, Julian Aloofijulian.fedorali...@googlemail.com wrote: Am Sonntag, den 14.06.2009, 17:10 +0200 schrieb Mathieu Bridon Samba (outbound) browsing requires firewall mods So, solving this is pretty easy, even for newbies. But I agree that the error message will

Re: What I HATE about F11

2009-06-14 Thread Petrus de Calguarium
Charles Butterfield wrote: ... Does it help if more people (dis)agree? I will add my voice. - I like a root login option, especially when first setting up the system, as it is helpful to do things as root. I consciously choose to use root and realize that I MYSELF could be exposing MY OWN

Re: What I HATE about F11

2009-06-14 Thread Paul Wouters
On Sun, 14 Jun 2009, Lennart Poettering wrote: The way it is done right now, you have a system that might give too few permissions to some users. If that causes a problem, you'll notice it, and you can correct it in a very simple way (uncomment one line and add a user to a group). However, if

Re: What I HATE about F11

2009-06-14 Thread Bastien Nocera
On Sun, 2009-06-14 at 10:52 -0700, Arjan van de Ven wrote: On Sun, 14 Jun 2009 18:34:52 +0100 I think this is actually a problem that needs solving. We have several network services that are either installed by default or might be expected to be part of a standard setup, but which don't

Re: What I HATE about F11

2009-06-14 Thread Kevin Fenzi
On Sun, 14 Jun 2009 15:59:58 +0100 Richard Fearn richardfe...@gmail.com wrote: We have the wheel group which would fit the bill. Yeah, I always uncomment the %wheel line in sudoers and then add myself to that group. Hmmm, having looked at the Features guidelines I'm not sure if this

Re: What I HATE about F11

2009-06-14 Thread inode0
On Sun, Jun 14, 2009 at 1:05 PM, Paul Woutersp...@xelerance.com wrote: That said, I agree the wheel group should be enabled with sudo, though I disagree that the initial install user should be automatically added to it. Should sudo be treated in this case any differently than su? I think wheel

Re: What I HATE about F11

2009-06-14 Thread Bruno Wolff III
On Sun, Jun 14, 2009 at 20:08:31 +0200, Lennart Poettering mzerq...@0pointer.de wrote: enabled by default, like we currently do. If an application cannot be trusted then it should not be allowed to listen on a port by default in the first place. A firewall is an extra layer of security that

Re: What I HATE about F11

2009-06-14 Thread Chuck Anderson
On Sun, Jun 14, 2009 at 10:45:09AM -0400, Simo Sorce wrote: * Samba (outbound) browsing requires firewall mods I don't know how Samba works, so forgive me if I say obvious stupidity, but shouldn't *client* work even behind closed firewall (like with any other services like ssh, ftp,

Re: What I HATE about F11

2009-06-14 Thread David
On 6/13/2009 10:19 PM, Charles Butterfield wrote: Okay, so I mostly love Fedora. However, here are 4 things that got by blood really, really boiling, so I thought I’d share my emotions. They are mostly policy issues, where I think you have gotten it very very wrong. Just installed F11

Re: What I HATE about F11

2009-06-14 Thread Yaakov Nemoy
2009/6/14 Richard Fearn richardfe...@gmail.com: # grep -n wheel /etc/sudoers 81:## Allows people in group wheel to run all commands 82:# %wheel     ALL=(ALL)       ALL 85:# %wheel     ALL=(ALL)       NOPASSWD: ALL All you have to do is uncomment one line ;) That's exactly what I do,

Re: What I HATE about F11

2009-06-14 Thread Nicolas Mailhot
Le dimanche 14 juin 2009 à 20:08 +0200, Lennart Poettering a écrit : I still think that the current firewall situation on Fedora is pretty much broken. It's a bit like SELinux: it's one of the first features most people disable. For the people I know disabling the firewall is very low under

Re: What I HATE about F11

2009-06-14 Thread Krzysztof Halasa
Michael Fleming mflem...@thatfleminggent.com writes: With the likes of sudo / ConsoleKit / console-helper et. al you should never, ever need to run an extended session as root. Your day-to-day work can be done perfectly well as a standard non-privileged user, the applications that *need*

Re: What I HATE about F11

2009-06-14 Thread Krzysztof Halasa
inode0 ino...@gmail.com writes: Actually, I am strongly against the way Fedora forces the creation of the first user without allowing the admin to set the uid/gid of the user. That is a different annoying issue. Hmm... Does it? I installed F11 (i386, with netinstall) recently and it didn't

Re: What I HATE about F11

2009-06-14 Thread Richard Fearn
I didn't say the wheel group was a nonsense or a problem. I was responding to Richard who wanted the line to be uncommented (harmless per se) AND the first user to be added to the wheel group by default. I've since changed my mind :-) For example, a « add to the wheel group » checkbox in

Re: What I HATE about F11

2009-06-14 Thread Richard W.M. Jones
On Sun, Jun 14, 2009 at 05:45:43PM +1000, Michael Fleming wrote: Ich bin ein secure user and you should be too. Logging in as root into X directly (or the console for that matter) is a *bad idea*. Erm, logging as root on the console is a bad idea? _You've_ obviously not got any machines

Re: What I HATE about F11

2009-06-14 Thread Richard Fearn
Who says the first created user is root-equivalent? It wouldn't be root-equivalent. You have to explicitly use sudo, and enter your password when you do use it. It's not the same as a root prompt. In any case, I like Mathieu Bridon's idea of having a firstboot option. Rich --

Re: What I HATE about F11

2009-06-14 Thread Leszek Matok
Dnia 2009-06-14, o godz. 22:12:47 Krzysztof Halasa k...@pm.waw.pl napisał(a): a false feeling that the non-privileged account doesn't need the same level of protection as the root account needs. The feeling isn't false - overtaking a root-run program is potentially more harmful to the system,

Re: What I HATE about F11

2009-06-14 Thread Krzysztof Halasa
Richard Fearn richardfe...@gmail.com writes: Who says the first created user is root-equivalent? It wouldn't be root-equivalent. You have to explicitly use sudo, and enter your password when you do use it. It's not the same as a root prompt. It is from a security person POV. If an attacker

Re: What I HATE about F11

2009-06-14 Thread Jeff Spaleta
On Sun, Jun 14, 2009 at 6:45 AM, Simo Sorcesso...@redhat.com wrote: I haven't done a graphical root login in the past 10 years probably and on multiple distribution. Graphical root login is meaningless. Let me ask you a question as an example to better define the expectation on behavior that

Re: What I HATE about F11

2009-06-14 Thread James Morris
On Sun, 14 Jun 2009, Lennart Poettering wrote: much broken. It's a bit like SELinux: it's one of the first features most people disable. False. Most people leave SELinux enabled, according to the smolt stats which have been collecting since the F8 era. Fedora is the only big distro that

Re: What I HATE about F11

2009-06-14 Thread Lennart Poettering
On Mon, 15.06.09 09:15, James Morris (jmor...@namei.org) wrote: On Sun, 14 Jun 2009, Lennart Poettering wrote: much broken. It's a bit like SELinux: it's one of the first features most people disable. False. Most people leave SELinux enabled, according to the smolt stats which have

Re: What I HATE about F11

2009-06-14 Thread James Morris
On Mon, 15 Jun 2009, Lennart Poettering wrote: Are you speaking of the same smolt that lists es1371 as most popular sound card? i.e. a sound card that has been out of production since about 10 years now? Somehow I have serious doubts about the validity of the smolt data. I've previously

Re: What I HATE about F11

2009-06-14 Thread Jeff Spaleta
On Sun, Jun 14, 2009 at 3:36 PM, Lennart Poetteringmzerq...@0pointer.de wrote: Are you speaking of the same smolt that lists es1371 as most popular sound card? i.e. a sound card that has been out of production since about 10 years now? Somehow I have serious doubts about the validity of the

Re: What I HATE about F11

2009-06-14 Thread Guido Grazioli
That said, I agree the wheel group should be enabled with sudo, though I disagree that the initial install user should be automatically added to it. But then again, I hate sudo :P I do most scripting that requires root access via root logins directly with ssh and keys. i completely agree

Re: What I HATE about F11

2009-06-14 Thread Lennart Poettering
On Sun, 14.06.09 16:11, Jeff Spaleta (jspal...@gmail.com) wrote: On Sun, Jun 14, 2009 at 3:36 PM, Lennart Poetteringmzerq...@0pointer.de wrote: Are you speaking of the same smolt that lists es1371 as most popular sound card? i.e. a sound card that has been out of production since about

Re: What I HATE about F11

2009-06-14 Thread Simo Sorce
On Sun, 2009-06-14 at 15:11 -0400, Chuck Anderson wrote: On Sun, Jun 14, 2009 at 10:45:09AM -0400, Simo Sorce wrote: * Samba (outbound) browsing requires firewall mods I don't know how Samba works, so forgive me if I say obvious stupidity, but shouldn't *client* work even behind

Re: What I HATE about F11

2009-06-14 Thread Simo Sorce
On Sun, 2009-06-14 at 14:23 -0800, Jeff Spaleta wrote: On Sun, Jun 14, 2009 at 6:45 AM, Simo Sorcesso...@redhat.com wrote: I haven't done a graphical root login in the past 10 years probably and on multiple distribution. Graphical root login is meaningless. Let me ask you a question as

Re: What I HATE about F11

2009-06-14 Thread Mike McGrath
On Mon, 15 Jun 2009, Lennart Poettering wrote: On Mon, 15.06.09 09:15, James Morris (jmor...@namei.org) wrote: On Sun, 14 Jun 2009, Lennart Poettering wrote: much broken. It's a bit like SELinux: it's one of the first features most people disable. False. Most people leave

Re: What I HATE about F11

2009-06-14 Thread Mike McGrath
On Sun, 14 Jun 2009, Mike McGrath wrote: On Mon, 15 Jun 2009, Lennart Poettering wrote: On Mon, 15.06.09 09:15, James Morris (jmor...@namei.org) wrote: On Sun, 14 Jun 2009, Lennart Poettering wrote: much broken. It's a bit like SELinux: it's one of the first features most

Re: What I HATE about F11

2009-06-13 Thread Christian Rose
On 6/14/09, Charles Butterfield charles.butterfi...@nextcentury.com wrote: [...] Root gdm login - gets harder every release - SHAME ON YOU root nazis! Interesting. Godwin's law right from the start of a thread? I must buy a lottery ticket today. http://en.wikipedia.org/wiki/Godwin%27s_law