Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-25 Thread Leo Famulari
On Thu, Mar 25, 2021 at 03:22:16PM +0100, Mathieu Othacehe wrote: > I recently added a new metric in Cuirass: "Builds count per machine > during the last day". Turns out the overdrive1 with its two workers > seems to outperform the hydra-guix-X running emulated builds on four > workers. That's

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-25 Thread Mathieu Othacehe
Hello, > Concretely, this would mean a Honeycomb LX2 or Ampere ALTRA workstation, > since I don't believe there are any other aarch64 workstations available > for sale. > > https://www.solid-run.com/arm-servers-networking-platforms/honeycomb-workstation/ >

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-24 Thread Leo Famulari
On Wed, Mar 24, 2021 at 09:24:40PM +0100, Vincent Legoll wrote: > I already volunteered (privately) to host the same (1 or 2 WS power-class), > currently on ADSL uplink (so not for substitute distribution, only building), > FTTH in the future, no UPS though. The architecture of the build arm is

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-24 Thread Léo Le Bouter
On Wed, 2021-03-24 at 21:24 +0100, Vincent Legoll wrote: > Hello, > > On Wed, Mar 24, 2021 at 8:51 PM Leo Famulari > wrote: > > > We bought a handful of Overdrive 1000 in the past (they are no > > > longer > > > sold), and hosting was always an obstacle. > > > > I volunteer to host one or two

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-24 Thread Vincent Legoll
Hello, On Wed, Mar 24, 2021 at 8:51 PM Leo Famulari wrote: > > We bought a handful of Overdrive 1000 in the past (they are no longer > > sold), and hosting was always an obstacle. > > I volunteer to host one or two workstation-type 64-bit ARM machines. I already volunteered (privately) to host

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-24 Thread Leo Famulari
On Tue, Mar 23, 2021 at 11:54:54PM +0100, Ricardo Wurmus wrote: > This seems to be a misunderstanding. The first step is to use the money > we already have but cannot exchange for hardware, because > > - finding appropriate hardware that you can actually buy is not easy > - hosting needs to be

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-23 Thread Mark H Weaver
Joshua Branson writes: > raingloom writes: >> >> What about a Liberapay for Guix? Could also be used to pay developers. >> > > I'd be game for something like this. We could have a guix membership. > Drew Devault has a "secret irc" channel for paying patreons. Perhaps we > could advertise a

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-23 Thread Ricardo Wurmus
raingloom writes: > On Sat, 20 Mar 2021 12:19:11 +0100 > Ludovic Courtès wrote: > >> Hi, >> >> Mark H Weaver skribis: >> >> > Ultimately, I gave up. In my opinion, Guix has never achieved >> > usability as a desktop system on non-Intel systems. Therefore, the >> > Guix community is

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-23 Thread Leo Famulari
On Mon, Mar 22, 2021 at 02:44:04PM +0100, raingloom wrote: > What about a Liberapay for Guix? Could also be used to pay developers. Some of us already have Liberapay accounts.

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-23 Thread Joshua Branson
raingloom writes: > > What about a Liberapay for Guix? Could also be used to pay developers. > I'd be game for something like this. We could have a guix membership. Drew Devault has a "secret irc" channel for paying patreons. Perhaps we could advertise a guix membership on the guix site. When

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-22 Thread raingloom
On Sat, 20 Mar 2021 12:19:11 +0100 Ludovic Courtès wrote: > Hi, > > Mark H Weaver skribis: > > > Ultimately, I gave up. In my opinion, Guix has never achieved > > usability as a desktop system on non-Intel systems. Therefore, the > > Guix community is unable to attract many developers who

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-20 Thread Ludovic Courtès
Hi, Mark H Weaver skribis: > Ultimately, I gave up. In my opinion, Guix has never achieved usability > as a desktop system on non-Intel systems. Therefore, the Guix community > is unable to attract many developers who want a distro that supports > non-Intel systems well. Our community has

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-17 Thread Léo Le Bouter
Sorry for duplicated email.. On Tue, 2021-03-16 at 19:19 -0400, Mark H Weaver wrote: > If not, it would be good to work toward the goal of making Guix > usable > on non-Intel systems. I'm sorry to say that, in my opinion, your > proposal would move us in the wrong direction to achieve that goal.

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-17 Thread Léo Le Bouter
On Tue, 2021-03-16 at 19:19 -0400, Mark H Weaver wrote: > That said, I strongly disagree that we should "never backport patches > ourselves in most cases". The only way to do that, while addressing > security flaws, would be to promptly update even our lowest-level > libraries in response to

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Leo Famulari
On Tue, Mar 16, 2021 at 07:19:59PM -0400, Mark H Weaver wrote: > Ultimately, I gave up. In my opinion, Guix has never achieved usability > as a desktop system on non-Intel systems. Therefore, the Guix community > is unable to attract many developers who want a distro that supports > non-Intel

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Mark H Weaver
Hi Léo, Léo Le Bouter writes: > I would like to share some opinion I have on CVE-patching for non- > rolling release GNU/Linux distributions and why we should strive to > always update to the latest available releases or always follow > upstream supported release series and never backport

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Leo Famulari
On Tue, Mar 16, 2021 at 12:10:26PM +0100, Léo Le Bouter wrote: > For these reasons, I suggest that we always strive to update packages > to their latest versions and that I think it is security relevant to > always do so. Of course, new code could *introduce* new vulnerabilities > but I am not

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Léo Le Bouter
On Tue, 2021-03-16 at 12:17 +0100, Jonathan Brielmaier wrote: > I think the only two reasons against that are: time and > CI/rebuilding. I > think thats the reason why stuff like Gnome and others lower in the > dependency tree are lacking behind... Being non-FHS and non-systemd > makes updates for

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Jonathan Brielmaier
On 16.03.21 12:10, Léo Le Bouter wrote: For these reasons, I suggest that we always strive to update packages to their latest versions and that I think it is security relevant to always do so. Of course, new code could *introduce* new vulnerabilities but I am not trying to debate this, it's that

[opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Léo Le Bouter
Hello! I would like to share some opinion I have on CVE-patching for non- rolling release GNU/Linux distributions and why we should strive to always update to the latest available releases or always follow upstream supported release series and never backport patches ourselves in most cases (some