Re: [Rd] Proposal to limit Internet access during package load

2022-09-28 Thread Blätte , Andreas
Dear Tomas, thank you so much for the explanation. Very helpful for myself, and relevant for the wider context of packages using rwinlib! Andreas Am 27.09.22, 20:18 schrieb "Tomas Kalibera" : On 9/27/22 18:42, Blätte, Andreas wrote: > Dear all, > > my apologies for a dull

Re: [Rd] Proposal to limit Internet access during package load

2022-09-27 Thread Tomas Kalibera
On 9/27/22 18:42, Blätte, Andreas wrote: Dear all, my apologies for a dull question. I think I do understand that unnoticed Internet access requires scrutiny and a more explicit approach. But I am not sure how this would impact on the practice on many Windows machines to download static

Re: [Rd] Proposal to limit Internet access during package load

2022-09-27 Thread Iñaki Ucar
El mar., 27 sept. 2022 18:42, Blätte, Andreas escribió: > Dear all, > > my apologies for a dull question. I think I do understand that unnoticed > Internet access requires scrutiny and a more explicit approach. > > But I am not sure how this would impact on the practice on many Windows >

Re: [Rd] Proposal to limit Internet access during package load

2022-09-27 Thread Blätte , Andreas
Dear all, my apologies for a dull question. I think I do understand that unnoticed Internet access requires scrutiny and a more explicit approach. But I am not sure how this would impact on the practice on many Windows machines to download static libraries from one of the rwinlib

Re: [Rd] Proposal to limit Internet access during package load

2022-09-27 Thread Iñaki Ucar
El mar., 27 sept. 2022 4:22, Dirk Eddelbuettel escribió: > > Regarding 'system' libraries: Packages like stringi and nloptr download the > source of, respectively, libicu or libnlopt and build a library _if_ the > library is not found locally. If we outlaw this, more users may hit a > brick >

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Gabriel Becker
Ah, thats embarrassing. Thats a bug in how/where I handle lack of connectivity, rather than me not doing it. I've just push a fix to the github repo that now cleanly passes check with no internet connectivity (much more stringent). Using a canned file is a bit odd, because in the case where

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Dirk Eddelbuettel
Regarding 'system' libraries: Packages like stringi and nloptr download the source of, respectively, libicu or libnlopt and build a library _if_ the library is not found locally. If we outlaw this, more users may hit a brick wall because they cannot install system libraries (for lack of

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Bob Rudis
I would personally like something like an Android/iOS permissions required/requested manifest document describing what the pkg needs with R doing what it can to enforce said permissions. R would be breaking some ground in this space, but it does that regularly in many respects. Yes, I know I just

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
BTW: It is a good question whether packages that require internet access in order to function at all should be flagged as such so they can be removed from server installations. Let's say if a package provides an API for retrieving stock quotes online and it's all it does then perhaps it does

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
> On 27/09/2022, at 11:02 AM, Gabriel Becker wrote: > > For the record, the only things switchr (my package) is doing internet wise > should be hitting the bioconductor config file > (http://bioconductor.org/config.yaml) so that it knows the things it need to > know about Bioc

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Gabriel Becker
For the record, the only things switchr (my package) is doing internet wise should be hitting the bioconductor config file ( http://bioconductor.org/config.yaml) so that it knows the things it need to know about Bioc repos/versions/etc (at load time, actually, not install time, but since install

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
> On 27/09/2022, at 10:21 AM, Iñaki Ucar wrote: > > On Mon, 26 Sept 2022 at 23:07, Simon Urbanek > wrote: >> >> Iñaki, >> >> I'm not sure I understand - system dependencies are an entirely different >> topic and I would argue a far more important one (very happy to start a >> discussion

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Iñaki Ucar
On Mon, 26 Sept 2022 at 23:07, Simon Urbanek wrote: > > Iñaki, > > I'm not sure I understand - system dependencies are an entirely different > topic and I would argue a far more important one (very happy to start a > discussion about that), but that has nothing to do with declaring downloads.

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
Iñaki, I'm not sure I understand - system dependencies are an entirely different topic and I would argue a far more important one (very happy to start a discussion about that), but that has nothing to do with declaring downloads. I assumed your question was about large files in packages which

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
Gabe, that's a great example how **not** to do it and why it is such a bad idea. icu4c is a system library, so it is generally available and it already includes the data in the system library, so embedding data from an outdated version is generally bad. I'm not sure why it should be needed in

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Iñaki Ucar
On Mon, 26 Sept 2022 at 21:50, Simon Urbanek wrote: > > [snip] > Sure, I fully agree that it would be a good first step, but I'm still waiting > for examples ;). Oh, you want me to actually name specific packages? I thought that this was a well-established fact from your initial statement "I

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Gabriel Becker
Hi Simon, The example of this I'm aware of that is most popular and widely used "in the wild" is the stringi package (which is a dep of the widely used stringr pkg) whose configure file downloads the ICU Data Library (icudt). See https://github.com/gagolews/stringi/blob/master/configure#L5412

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
> On Sep 27, 2022, at 8:25 AM, Iñaki Ucar wrote: > > On Sat, 24 Sept 2022 at 01:55, Simon Urbanek > wrote: >> >> Iñaki, >> >> I fully agree, this a very common issue since vast majority of server >> deployments I have encountered don't allow internet access. In practice this >> means

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Iñaki Ucar
On Sat, 24 Sept 2022 at 01:55, Simon Urbanek wrote: > > Iñaki, > > I fully agree, this a very common issue since vast majority of server > deployments I have encountered don't allow internet access. In practice this > means that such packages are effectively banned. > > I would argue that not

Re: [Rd] Proposal to limit Internet access during package load

2022-09-23 Thread Simon Urbanek
Iñaki, I fully agree, this a very common issue since vast majority of server deployments I have encountered don't allow internet access. In practice this means that such packages are effectively banned. I would argue that not even (1) or (2) are really an issue, because in fact the CRAN

Re: [Rd] Proposal to limit Internet access during package load

2022-09-23 Thread Iñaki Ucar
On Fri, 23 Sept 2022 at 17:22, Iñaki Ucar wrote: > > [snip] > Now, what if connection is suppressed during package load? There are > basically three use cases out there: > > (1) The package requires additional files for the installation (e.g. > the source code of an external library) that cannot