Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-25 Thread Leo Famulari
On Thu, Mar 25, 2021 at 03:22:16PM +0100, Mathieu Othacehe wrote: > I recently added a new metric in Cuirass: "Builds count per machine > during the last day". Turns out the overdrive1 with its two workers > seems to outperform the hydra-guix-X running emulated builds on four > workers. That's

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-25 Thread Mathieu Othacehe
Hello, > Concretely, this would mean a Honeycomb LX2 or Ampere ALTRA workstation, > since I don't believe there are any other aarch64 workstations available > for sale. > > https://www.solid-run.com/arm-servers-networking-platforms/honeycomb-workstation/ >

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-24 Thread Leo Famulari
On Wed, Mar 24, 2021 at 09:24:40PM +0100, Vincent Legoll wrote: > I already volunteered (privately) to host the same (1 or 2 WS power-class), > currently on ADSL uplink (so not for substitute distribution, only building), > FTTH in the future, no UPS though. The architecture of the build arm is

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-24 Thread Léo Le Bouter
On Wed, 2021-03-24 at 21:24 +0100, Vincent Legoll wrote: > Hello, > > On Wed, Mar 24, 2021 at 8:51 PM Leo Famulari > wrote: > > > We bought a handful of Overdrive 1000 in the past (they are no > > > longer > > > sold), and hosting was always an obstacle. > > > > I volunteer to host one or two

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-24 Thread Vincent Legoll
Hello, On Wed, Mar 24, 2021 at 8:51 PM Leo Famulari wrote: > > We bought a handful of Overdrive 1000 in the past (they are no longer > > sold), and hosting was always an obstacle. > > I volunteer to host one or two workstation-type 64-bit ARM machines. I already volunteered (privately) to host

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-24 Thread Leo Famulari
On Tue, Mar 23, 2021 at 11:54:54PM +0100, Ricardo Wurmus wrote: > This seems to be a misunderstanding. The first step is to use the money > we already have but cannot exchange for hardware, because > > - finding appropriate hardware that you can actually buy is not easy > - hosting needs to be

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-23 Thread Mark H Weaver
Joshua Branson writes: > raingloom writes: >> >> What about a Liberapay for Guix? Could also be used to pay developers. >> > > I'd be game for something like this. We could have a guix membership. > Drew Devault has a "secret irc" channel for paying patreons. Perhaps we > could advertise a

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-23 Thread Ricardo Wurmus
raingloom writes: > On Sat, 20 Mar 2021 12:19:11 +0100 > Ludovic Courtès wrote: > >> Hi, >> >> Mark H Weaver skribis: >> >> > Ultimately, I gave up. In my opinion, Guix has never achieved >> > usability as a desktop system on non-Intel systems. Therefore, the >> > Guix community is

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-23 Thread Leo Famulari
On Mon, Mar 22, 2021 at 02:44:04PM +0100, raingloom wrote: > What about a Liberapay for Guix? Could also be used to pay developers. Some of us already have Liberapay accounts.

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-23 Thread Joshua Branson
raingloom writes: > > What about a Liberapay for Guix? Could also be used to pay developers. > I'd be game for something like this. We could have a guix membership. Drew Devault has a "secret irc" channel for paying patreons. Perhaps we could advertise a guix membership on the guix site. When

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-22 Thread raingloom
On Sat, 20 Mar 2021 12:19:11 +0100 Ludovic Courtès wrote: > Hi, > > Mark H Weaver skribis: > > > Ultimately, I gave up. In my opinion, Guix has never achieved > > usability as a desktop system on non-Intel systems. Therefore, the > > Guix community is unable to attract many developers who

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-20 Thread Ludovic Courtès
Hi, Mark H Weaver skribis: > Ultimately, I gave up. In my opinion, Guix has never achieved usability > as a desktop system on non-Intel systems. Therefore, the Guix community > is unable to attract many developers who want a distro that supports > non-Intel systems well. Our community has

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-17 Thread Léo Le Bouter
Sorry for duplicated email.. On Tue, 2021-03-16 at 19:19 -0400, Mark H Weaver wrote: > If not, it would be good to work toward the goal of making Guix > usable > on non-Intel systems. I'm sorry to say that, in my opinion, your > proposal would move us in the wrong direction to achieve that goal.

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-17 Thread Léo Le Bouter
On Tue, 2021-03-16 at 19:19 -0400, Mark H Weaver wrote: > That said, I strongly disagree that we should "never backport patches > ourselves in most cases". The only way to do that, while addressing > security flaws, would be to promptly update even our lowest-level > libraries in response to

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Leo Famulari
On Tue, Mar 16, 2021 at 07:19:59PM -0400, Mark H Weaver wrote: > Ultimately, I gave up. In my opinion, Guix has never achieved usability > as a desktop system on non-Intel systems. Therefore, the Guix community > is unable to attract many developers who want a distro that supports > non-Intel

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Mark H Weaver
Hi Léo, Léo Le Bouter writes: > I would like to share some opinion I have on CVE-patching for non- > rolling release GNU/Linux distributions and why we should strive to > always update to the latest available releases or always follow > upstream supported release series and never backport

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Leo Famulari
On Tue, Mar 16, 2021 at 12:10:26PM +0100, Léo Le Bouter wrote: > For these reasons, I suggest that we always strive to update packages > to their latest versions and that I think it is security relevant to > always do so. Of course, new code could *introduce* new vulnerabilities > but I am not

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Léo Le Bouter
On Tue, 2021-03-16 at 12:17 +0100, Jonathan Brielmaier wrote: > I think the only two reasons against that are: time and > CI/rebuilding. I > think thats the reason why stuff like Gnome and others lower in the > dependency tree are lacking behind... Being non-FHS and non-systemd > makes updates for

Re: [opinion] CVE-patching is not sufficient for package security patching

2021-03-16 Thread Jonathan Brielmaier
On 16.03.21 12:10, Léo Le Bouter wrote: For these reasons, I suggest that we always strive to update packages to their latest versions and that I think it is security relevant to always do so. Of course, new code could *introduce* new vulnerabilities but I am not trying to debate this, it's that