[gentoo-dev] Project Sunrise resumed

[Stefan Schweizer]

To my fellow Gentoo developers and users,

Sunrise is about contributing ebuilds and getting feedback and review while
doing so. The main resource this currently happens for is the Gentoo User
Overlay of Sunrise and second come ebuilds that get into portage afterwards

In last weeks council meeting [1] it was decided that the Sunrise project is
no longer suspended. I can give a short overview of the current status of
the overlay:

- we currently have 154 ebuilds in 58 categories in the overlay
  not counting the ebuilds that got into portage and were removed again

- we have 8 developers, 4 trusted committers who have taken the ebuild quiz
  and 26 users committing to the overlay

The basic project concept of creating a social workspace has been reached.
#gentoo-sunrise is an active IRC channel where users usually find help
quickly and it also forms a friendly community.

Best regards,
Stefan

[1] http://www.gentoo.org/proj/en/council/meeting-logs/20060720-summary.txt
http://www.gentoo.org/proj/en/council/meeting-logs/20060720.txt
Other useful resources:
Project page http://www.gentoo.org/proj/en/sunrise/
svn reviewed http://www.gentoo-sunrise.org/svn/reviewed/
cia page http://cia.navi.cx/stats/project/sunrise/

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed

[Stephen P. Becker]

Stefan Schweizer wrote:

In last weeks council meeting [1] it was decided that the Sunrise project is
no longer suspended. I can give a short overview of the current status of
the overlay:

- we currently have 154 ebuilds in 58 categories in the overlay
  not counting the ebuilds that got into portage and were removed again

- we have 8 developers, 4 trusted committers who have taken the ebuild quiz
  and 26 users committing to the overlay

The basic project concept of creating a social workspace has been reached.
#gentoo-sunrise is an active IRC channel where users usually find help
quickly and it also forms a friendly community.

>

[1] http://www.gentoo.org/proj/en/council/meeting-logs/20060720-summary.txt
http://www.gentoo.org/proj/en/council/meeting-logs/20060720.txt


Eso since when did we have the discussion where you actually 
addressed all of the numerous concerns brought forth right before this 
project was initially suspended?  Looking at the meeting log, the 
council even noted that the concerns had not been addressed, yet still 
voted to un-suspend anyway.  WTF?


-Steve
--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed

[Martin Schlemmer]

On Thu, 2006-07-27 at 18:21 -0400, Stephen P. Becker wrote:
> Stefan Schweizer wrote:
> > In last weeks council meeting [1] it was decided that the Sunrise project is
> > no longer suspended. I can give a short overview of the current status of
> > the overlay:
> > 
> > - we currently have 154 ebuilds in 58 categories in the overlay
> >   not counting the ebuilds that got into portage and were removed again
> > 
> > - we have 8 developers, 4 trusted committers who have taken the ebuild quiz
> >   and 26 users committing to the overlay
> > 
> > The basic project concept of creating a social workspace has been reached.
> > #gentoo-sunrise is an active IRC channel where users usually find help
> > quickly and it also forms a friendly community.
>  >
> > [1] 
> > http://www.gentoo.org/proj/en/council/meeting-logs/20060720-summary.txt
> > http://www.gentoo.org/proj/en/council/meeting-logs/20060720.txt
> 
> Eso since when did we have the discussion where you actually 
> addressed all of the numerous concerns brought forth right before this 
> project was initially suspended?  Looking at the meeting log, the 
> council even noted that the concerns had not been addressed, yet still 
> voted to un-suspend anyway.  WTF?
> 

I don't seem to remember this.  I do though seem to remember that I
noted that there was complaints, but died away after Mike asked to
actually give some concrete feedback.


-- 
Martin Schlemmer



signature.asc
Description: This is a digitally signed message part

Re: [gentoo-dev] Project Sunrise resumed

[Mike Frysinger]

On Thursday 27 July 2006 18:21, Stephen P. Becker wrote:
> Looking at the meeting log, the
> council even noted that the concerns had not been addressed

no, we noted that people claimed they had concerns but when cornered and asked 
what exactly their concerns were, no more responses were to be had

people need to bring up their outstanding issues now and get them addressed
-mike


pgpRtWNjnOIBP.pgp
Description: PGP signature

Re: [gentoo-dev] Project Sunrise resumed

[Stephen P. Becker]

Mike Frysinger wrote:

On Thursday 27 July 2006 18:21, Stephen P. Becker wrote:

Looking at the meeting log, the
council even noted that the concerns had not been addressed


no, we noted that people claimed they had concerns but when cornered and asked 
what exactly their concerns were, no more responses were to be had


people need to bring up their outstanding issues now and get them addressed


Ok, since the first time around apparently wasn't good enough, how about 
this?  This project sucks.  It takes random ebuilds without enough merit 
or demand to even have some team and/or developer within Gentoo pick it 
up, and dumps it to a 
user-supported-yet-completely-official-break-my-gentoo-style tree that 
has to potential to cause all sorts of QA problems.  It flies right in 
the face of those of us that have strived to educate users not to rice 
out their systems with outside-the-tree ebuilds that have not gone 
through some sort of arch team and/or maintainer QA before hitting the 
tree.  There is nothing you or anyone else can say that will make me 
think otherwise, and I think it needs to be killed.  Now.


-Steve
--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed

[Andrew Gaffney]

Stephen P. Becker wrote:
Ok, since the first time around apparently wasn't good enough, how about 
this?  This project sucks.  It takes random ebuilds without enough merit 
or demand to even have some team and/or developer within Gentoo pick it 
up, and dumps it to a 
user-supported-yet-completely-official-break-my-gentoo-style tree that 
has to potential to cause all sorts of QA problems.  It flies right in 
the face of those of us that have strived to educate users not to rice 
out their systems with outside-the-tree ebuilds that have not gone 
through some sort of arch team and/or maintainer QA before hitting the 
tree.  There is nothing you or anyone else can say that will make me 
think otherwise, and I think it needs to be killed.  Now.


I try to stay out of these types of things, but I have to say that I agree 
completely.


--
Andrew Gaffneyhttp://dev.gentoo.org/~agaffney/
Gentoo Linux Developer   Installer Project
--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed

[Alex Tarkovsky]

On 7/30/06, Stephen P. Becker <[EMAIL PROTECTED]> wrote:

There is nothing you or anyone else can say that will make me
think otherwise,


You won't listen, yet you expect to be listened to. Speaking as a user
and lover of Gentoo I believe you should resign as a developer.

On this list and on IRC, I've watched you disparage Sunrise, its
supporters, and by implication the general user community's desire to
contribute more directly to Gentoo. You've established yourself as
quite an extremist.

Gentoo is a team effort. There's no place in Gentoo for developers who
can't function within a team environment where members must be capable
of rational deliberation and, from time to time, compromise. You are
harming Gentoo far more gravely than your imagined Sunrise QA
problems, because the latter can be managed by the team to within
reasonable tolerances if it becomes an issue, but your willful
ignorance and uncompromising attitude cannot.
--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed

[Mike Frysinger]

On Sunday 30 July 2006 18:47, Stephen P. Becker wrote:
> There is nothing you or anyone else can say

well if you're coming forth with such stout resolution of ignoring any one 
else's input, then there's no point in debating the topic with you now is 
there ?
-mike


pgpRLmOrTjAue.pgp
Description: PGP signature

Re: [gentoo-dev] Project Sunrise resumed

[Jan Kundrát]

Alex Tarkovsky wrote:
> Gentoo is a team effort. There's no place in Gentoo for developers who
> can't function within a team environment where members must be capable
> of rational deliberation and, from time to time, compromise.

OTOH this "team collaboration" doesn't mean that we have to agree with
each other, does it?

Cheers,
-jkt

-- 
cd /local/pub && more beer > /dev/mouth



signature.asc
Description: OpenPGP digital signature

Re: [gentoo-dev] Project Sunrise resumed

[Giacomo Cariello]

Mike Frysinger wrote:
> people need to bring up their outstanding issues now and get them
> addressed
Hello all,
I'm currently a Gentoo "power user" and I'm being mentored by kloeri to
become a developer. During this time, I've had the chance to study
accurately the Gentoo developer's handbook and from what I can
understand, respecting the Etiquette policy and being polite to other
developers and users is part of the Quality Assurance of the Gentoo
project. I understand that some matters are particularly "hot" to
discuss, but please help this project be different from other OS
projects that have a high quality code but miss to treat their users and
developers adequately and don't make it confortable to interact with:
it's really part of the user's experience and if we can achieve to keep
this debate from degenerating into a flame, maybe more people will try
to step in and help find a solution. Furthermore, if suspending the
project with a definite timeline to reconsider the next steps may help
to discuss it with more serenity, I encourage the Council to do so.
That said, I'd like to be proactive and share with you my experience
about OpenBSD, another project that has a "tree" of unsupported packages
compiled from source through a series of scripts (ports). In OpenBSD,
ports tree is clearly claimed as unsupported. In my opinion, the
percentage of users that miss to understand that ports do not receive
the same QA as the core system ranges between 5 and 15%. You may also
want to consider that OpenBSD core system is quite limited in terms of
quantity and youth of softwares included, but it's not simply a
collection of packages: instead their target is to assure the quality of
all the code, not just the packaging system. Furthermore, ports are
maintained partly by the OpenBSD team and partly by the developers of
the ported software. This aspect is interesting: if the developer of a
tool is given the possibility to maintain their port or packaging
scripts for various Operating Systems, there's a chance that they will
implement them with a good quality, because they know the packaged
software certainly better than an external developer from the OS team:
most people like keeping their car polished, but not in working for a
car wash. After all, most ebuilds under Gentoo are not going much
further the statement that "it works fine". Obviously, this a two-edge
blade: unlimited free commit to any quantity and quality of ebuilds is
given, when the unofficial overlay grows larger, its quality will
evenually decrease to an unacceptable level. So maybe a good compromise
could be to limit access of users to one specific software or series of
softwares, giving priority to those who actually develop the software
they want to package under Gentoo. This way, we would be able to improve
sinergy between herds and software developers and maybe lift some work
to external sources while avoiding the risk of malicious code injected
into widely-used packages. In OpenBSD, external developers must show
their diligence and knowledge of ports system, before they're given CVS
access to their port.

While I'm not upholding the idea that we should conform to OpenBSD in
its kind of management (Actually, I'm not expert enough to have a solid
opinion on wether Sunrise project should be aborted or continued), the
above hints may be useful to this discussion, in order to understand
what could happen or not happen in the future if we go through a certain
way and they may be useful to formulate new ideas or proposals.

Last, IMHO we should avoid the word "support" regarding Sunrise, because
this word is ambiguous, since it has two different meanings:
a) Yes, we support it, meaning that we endorse it and spend some of our
resources to make it work.
b) No, we don't support it, since we don't give any warranty regarding
its quality.

Sincerely,

Giacomo 'jwk' Cariello
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed

[Roy Bamford]

On 2006.07.31 03:00, Alex Tarkovsky wrote:

On 7/30/06, Stephen P. Becker <[EMAIL PROTECTED]> wrote:

There is nothing you or anyone else can say that will make me
think otherwise,


You won't listen, yet you expect to be listened to. Speaking as a  
user and lover of Gentoo I believe you should resign as a developer.



[snip]

--
gentoo-dev@gentoo.org mailing list




Gentoo is a microcosm of the real world, there are closed minds and  
predudices everywhere - why should the Gentoo dev community be any  
different?


Regards,

Roy Bamford

--
gentoo-dev@gentoo.org mailing list

AW: [gentoo-dev] Project Sunrise resumed

[Noack, Sebastian]

A patch for your signature to increase your life expectancy. ;)

@@ -1 +1 @@
-cd /local/pub && more beer > /dev/mouth
+cd /local/pub && more beer | sed -e "s/beer/water/g" > /dev/mouth


Best Regards
Sebastian Noack


-Ursprüngliche Nachricht-
Von: Jan Kundrát [mailto:[EMAIL PROTECTED] 
Gesendet: Montag, 31. Juli 2006 09:42
An: gentoo-dev@lists.gentoo.org
Betreff: Re: [gentoo-dev] Project Sunrise resumed

Alex Tarkovsky wrote:
> Gentoo is a team effort. There's no place in Gentoo for developers who
> can't function within a team environment where members must be capable
> of rational deliberation and, from time to time, compromise.

OTOH this "team collaboration" doesn't mean that we have to agree with
each other, does it?

Cheers,
-jkt

-- 
cd /local/pub && more beer > /dev/mouth


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed

[Dirk Heinrichs]

Am Montag, 31. Juli 2006 11:16 schrieb ext Noack, Sebastian:
> A patch for your signature to increase your life expectancy. ;)
>
> @@ -1 +1 @@
> -cd /local/pub && more beer > /dev/mouth
> +cd /local/pub && more beer | sed -e "s/beer/water/g" > /dev/mouth

Luckily, this doesn't even work :-) Beer will always be beer.

Bye...

Dirk
-- 
Dirk Heinrichs  | Tel:  +49 (0)162 234 3408
Configuration Manager   | Fax:  +49 (0)211 47068 111
Capgemini Deutschland   | Mail: [EMAIL PROTECTED]
Hambornerstraße 55  | Web:  http://www.capgemini.com
D-40472 Düsseldorf  | ICQ#: 110037733
GPG Public Key C2E467BB | Keyserver: www.keyserver.net


pgpTOWovbwr43.pgp
Description: PGP signature

Re: AW: [gentoo-dev] Project Sunrise resumed

[Jan Kundrát]

Noack, Sebastian wrote:
> A patch for your signature to increase your life expectancy. ;)
> 
> @@ -1 +1 @@
> -cd /local/pub && more beer > /dev/mouth
> +cd /local/pub && more beer | sed -e "s/beer/water/g" > /dev/mouth

BTTTDW (Been There, Tried That, Didn't Work :) )

Cheers,
-jkt

-- 
cd /local/pub && more beer > /dev/mouth



signature.asc
Description: OpenPGP digital signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Seemant Kulleen]

On Mon, 2006-07-31 at 03:53 +0100, Ciaran McCreesh wrote:

> Partly, the part where it's run by people who have little clue about
> ebuild development or QA, who will be taking code from people who have
> little clue about ebuild development or QA and giving it to other
> people who have little clue about ebuild development or QA.

Can you back up the first part? The people running it, you claim, have
little clue about ebuild dev and QA -- can you provide proof of this? It
does, actually, fall on you, since you're making the accusation.

> Partly, the way it's bypassing the normal herd system and allowing
> unqualified developers to push code related to things they don't
> understand.

Where is this code being pushed to, exactly?

> Partly, the way it's being pushed through without proper discussion and
> without following the proper processes that're used to reduce the risk
> of major screwup.

This list has been full of discussion. And before the council meeting,
there were many further calls for discussion and comment.  The sunrise
folks have been actually pretty patient about addressing the same
concerns over and over and over.

> Sunrise is the wrong solution to a misrepresented problem being run by
> the wrong people.

OK, let's start with: what exactly is the problem? What is the correct
way to represent it?  After that please explain how you came to see
sunrise as the wrong solution to that problem.

You've claimed several times that you just try to stick to technical, so
please put a stop to the "look, but it's *them* doing it, how can you
trust those people?" bullshit already.


-- 
Seemant Kulleen <[EMAIL PROTECTED]>
Gentoo Foundation / Gentoo Linux

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Seemant Kulleen]

On Mon, 2006-07-31 at 06:30 +0100, Ciaran McCreesh wrote:

> Their commit history backs it up all by itself.

Ppint to specifically what, in their respective histories, proves your
case.  This is like pulling teeth.


> | Where is this code being pushed to, exactly?
> 
> Users.

Please note the difference between pulling and pushing.  Pushing implies
that people who don't want sunrise on their systems have to have it and
have to use it.  This is not the case.  So, again, where is this code
being *pushed* to, exactly?


> The correct way to push through a large change is part of the developer
> quiz. There's no excuse for anyone not knowing it.

Was it really a *large change* that they pushed through?  They haven't
altered the way anybody does things.  Any developer or user going about
their normal business does not even have to *think* about sunrise.  Not
that large a change, after all.


> Would you fly in a plane being piloted by Britney Spears?

What do I care what the pilot's name is?  And how is that relevant to
the discussion, when you've yet to actually show why any of the Sunrise
staff is unfit.

Furthermore, there were other questions I asked that you completely
removed from your reply.  Please answer those as well.


-- 
Seemant Kulleen <[EMAIL PROTECTED]>
Gentoo Foundation / Gentoo Linux

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Ciaran McCreesh]

On Mon, 31 Jul 2006 01:38:42 -0400 Seemant Kulleen <[EMAIL PROTECTED]>
wrote:
| On Mon, 2006-07-31 at 06:30 +0100, Ciaran McCreesh wrote:
| > Their commit history backs it up all by itself.
| 
| Ppint to specifically what, in their respective histories, proves your
| case.  This is like pulling teeth.

No, the question is what in their respective histories refutes it. And
the answer here is nothing. QA ability isn't something that's assumed,
it's something that has to be demonstrated.

| > | Where is this code being pushed to, exactly?
| > 
| > Users.
| 
| Please note the difference between pulling and pushing.  Pushing
| implies that people who don't want sunrise on their systems have to
| have it and have to use it.  This is not the case.  So, again, where
| is this code being *pushed* to, exactly?

http://www.gentoo.org/news/en/gwn/20060619-newsletter.xml

| > The correct way to push through a large change is part of the
| > developer quiz. There's no excuse for anyone not knowing it.
| 
| Was it really a *large change* that they pushed through?  They haven't
| altered the way anybody does things.  Any developer or user going
| about their normal business does not even have to *think* about
| sunrise.  Not that large a change, after all.

Any developer going about their normal business now has to worry about
an officially approved BMGalike, and whether it's causing the bugs
they're receiving. Any developer going about their normal business now
has to worry about people who know little about the packages they
maintain pushing out content that would ordinarily be covered by their
herd to users via a back route.

| > Would you fly in a plane being piloted by Britney Spears?
| 
| What do I care what the pilot's name is?  

You care whether or not the pilot knows how to fly a plane.

| And how is that relevant to
| the discussion, when you've yet to actually show why any of the
| Sunrise staff is unfit.

To continue with the plane analogy, you don't assume that everyone can
fly a plane until they disprove it by crashing one.

| Furthermore, there were other questions I asked that you completely
| removed from your reply.  Please answer those as well.

They're not relevant to this discussion. We're not discussing what the
right solution is, we're discussing why Sunrise is the wrong solution.
There's a hell of a difference -- as an illustration, most people could
tell you why giving everybody nukes is the wrong way to get peace in
the middle east, but very few could tell you what the right way is...

-- 
Ciaran McCreesh
Mail: ciaran dot mccreesh at blueyonder.co.uk


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Mike Frysinger]

On Monday 31 July 2006 01:53, Ciaran McCreesh wrote:
> On Mon, 31 Jul 2006 01:38:42 -0400 Seemant Kulleen <[EMAIL PROTECTED]>
> | Please note the difference between pulling and pushing.  Pushing
> | implies that people who don't want sunrise on their systems have to
> | have it and have to use it.  This is not the case.  So, again, where
> | is this code being *pushed* to, exactly?
>
> http://www.gentoo.org/news/en/gwn/20060619-newsletter.xml

too bad the link doesnt really say anything
-mike


pgpbbWjzyDyfp.pgp
Description: PGP signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Seemant Kulleen]

> 
> They're not relevant to this discussion. We're not discussing what the
> right solution is, we're discussing why Sunrise is the wrong solution.
> There's a hell of a difference -- as an illustration, most people could
> tell you why giving everybody nukes is the wrong way to get peace in
> the middle east, but very few could tell you what the right way is...
> 

Yes they are. You obviously didn't read the questions.  I'll paste:
OK, let's start with: what exactly is the problem? What is the correct
way to represent it?  After that please explain how you came to see
sunrise as the wrong solution to that problem.

Note, that nowhere did I aske what the right solution is.  Please be so
kind as to actually *read* what others are saying to you, instead of
presuming.
-- 
Seemant Kulleen <[EMAIL PROTECTED]>
Gentoo Foundation / Gentoo Linux

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Ciaran McCreesh]

On Mon, 31 Jul 2006 02:37:41 -0400 Seemant Kulleen <[EMAIL PROTECTED]>
wrote:
| > They're not relevant to this discussion. We're not discussing what
| > the right solution is, we're discussing why Sunrise is the wrong
| > solution. There's a hell of a difference -- as an illustration,
| > most people could tell you why giving everybody nukes is the wrong
| > way to get peace in the middle east, but very few could tell you
| > what the right way is...
| > 
| 
| Yes they are. You obviously didn't read the questions.  I'll paste:
| OK, let's start with: what exactly is the problem? What is the correct
| way to represent it?  After that please explain how you came to see
| sunrise as the wrong solution to that problem.
| 
| Note, that nowhere did I aske what the right solution is.  Please be
| so kind as to actually *read* what others are saying to you, instead
| of presuming.

Knowing what the problem is is part of making the solution. The problem
is not that users can't push arbitrary content into a centralised
official repository with no oversight from the herds appropriate for
said content quickly enough. I didn't claim to know exactly what the
real problem is, merely that it's not what's being solved here.

-- 
Ciaran McCreesh
Mail: ciaran dot mccreesh at blueyonder.co.uk


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Joshua Jackson]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Ciaran McCreesh wrote:
>
> Knowing what the problem is is part of making the solution. The problem
> is not that users can't push arbitrary content into a centralised
> official repository with no oversight from the herds appropriate for
> said content quickly enough. I didn't claim to know exactly what the
> real problem is, merely that it's not what's being solved here.
>

There is a lot of irony in this entire discussion. We are actually
talking about going against what the heck part of the reason this
project was started. Are we seriously that *can't find the word I'm
looking for* idiotically to not see that we're arguing over not
allowing a user a choice in what they want to do. That we are so high
and mighty that we automatically know what is better for the user then
they themselves know? Who defined us as the ones to make that choice
for someone else, when we are supposedly about allowing choice.

That is the issue at hand at the core of this. Its called choice.
People can choose to use a separate program to download the sunrise
overlays. That separates it entirely from the core tree itself. A
disclaimer for checking out could be added that is prominent that will
warn that these are a service provided to the community from the
community. That those who have gone through the "developer mentorship"
will continue to work on the core of the heart of gentoo, allowing us
to focus and make the product so much better and quicker that you'll
be blindsided with the new improved product. We'll have a rebirth so
to speak.

Bloody, I mean seriously...think about what it is we are arguing over,
and then remember what gentoo is, why you came to it in the first
place. That will probably tell you where it should go.


-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEza2pSENan+PfizARAtG2AJ9vvGWRcsRfNtr8oUGgRnK79dcADwCfdP1I
qiTETbjrFc2qBrLYFiHn3xM=
=Oofv
-END PGP SIGNATURE-

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Ciaran McCreesh]

On Mon, 31 Jul 2006 00:13:45 -0700 Joshua Jackson <[EMAIL PROTECTED]>
wrote:
| That is the issue at hand at the core of this. Its called choice.

Choice is not an end in itself.

-- 
Ciaran McCreesh
Mail: ciaran dot mccreesh at blueyonder.co.uk


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Mike Kelly]

On Mon, 31 Jul 2006 00:13:45 -0700
Joshua Jackson <[EMAIL PROTECTED]> wrote:

> There is a lot of irony in this entire discussion. We are actually
> talking about going against what the heck part of the reason this
> project was started. Are we seriously that *can't find the word I'm
> looking for* idiotically to not see that we're arguing over not
> allowing a user a choice in what they want to do. That we are so high
> and mighty that we automatically know what is better for the user then
> they themselves know? Who defined us as the ones to make that choice
> for someone else, when we are supposedly about allowing choice.
> 
> That is the issue at hand at the core of this. Its called choice.
> People can choose to use a separate program to download the sunrise
> overlays. That separates it entirely from the core tree itself. A
> disclaimer for checking out could be added that is prominent that will
> warn that these are a service provided to the community from the
> community. That those who have gone through the "developer mentorship"
> will continue to work on the core of the heart of gentoo, allowing us
> to focus and make the product so much better and quicker that you'll
> be blindsided with the new improved product. We'll have a rebirth so
> to speak.
> 
> Bloody, I mean seriously...think about what it is we are arguing over,
> and then remember what gentoo is, why you came to it in the first
> place. That will probably tell you where it should go.

Speaking as a user of Gentoo in general, and as a small contributor to
Sunrise, I don't think your argument about "choice" really is relevant.
Since Gentoo is licensed under the GPL-2, end users can always choose
to do whatever the heck they want. They can make their own overlays,
patch packages to no tomorrow, and use whatever packages they wish on
their system.

As I understand it, the real goal is to let users get a taste of what
ebuild development is supposed to be like, and to give them a lot of
guidance and a chance to get their draft work peer reviewed. This is
something they could always /choose/ to do, either by visiting the
#gentoo-dev-help channel on freenode, posting a new ebuild on bugzilla,
the forums, etc. The Sunrise project is just trying to focus entirely
on ebuilds, while most of the above have other primary focuses.

I /think/ the issues some folks are taking with the project are:

 * It's dangerous to have this sort of thing "officially" affiliated
   with Gentoo because it has the potential to cause unforeseen
   breakage. For example, an ebuild in the tree may have a flag
   for ./configure which wasn't explicitly disabled but which will now
   auto-set itself on when a certain package from Sunrise was
   installed. This /could/ cause some breakage which is very difficult
   for someone trying to help a user submitting a bug to recreate, and
   create some wasted time and general frustration on both sides. In
   general, many wish to change the image of Gentoo being the "ricer"
   OS, and in some ways this project has that sort of air about it.

 * The design of the project, people involved, whatever, isn't
   conducive to it achieving its desired goal (helping train users in
   proper ebuild development). I think the point about not having
   involvement from the relevant herds or arch teams is related to this
   as well.I don't have enough experience to judge this point at all. 

Speaking just as myself, I think that, if I were to choose to use some
ebuild from Sunrise other than the one I wrote myself, I would be
careful and wouldn't scream to hard if something broke. I don't know
what others would do. I think that the project does have some merit and
seeks to achieve a worthy goal. I don't know, however, if it is the
best option available, or the best execution.

-- 
Mike Kelly


signature.asc
Description: PGP signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Carsten Lohrke]

On Monday 31 July 2006 07:05, Seemant Kulleen wrote:
> OK, let's start with: what exactly is the problem?

Please reread my replies in the first sunrise thread. Points are: no security, 
issues with eclass changes which will result in bug spam, the fact that 
sunrise is a bunch of arbitrary packages, instead close related ones managed 
by one team, that does exactly maintain relevant packages. These issues are 
fundamental, pointed out multiple times. You can't believe how ridiculous 
Mike's question in the other thread, if there were any remaining issues, 
sound to me and obviously others.

From your other email:
>People actually quit over this issue, which is pretty unfathomable to me.
Um, thought about it as well. One of the reasons I'm less active the last 
weeks.


Carsten


pgpM9mIuIzqma.pgp
Description: PGP signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Alec Warner]

Carsten Lohrke wrote:

On Monday 31 July 2006 07:05, Seemant Kulleen wrote:

OK, let's start with: what exactly is the problem?


Please reread my replies in the first sunrise thread. Points are: no security, 
issues with eclass changes which will result in bug spam, the fact that 

eclass changes?  You can't even commit eclasses to it...

--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Carsten Lohrke]

On Thursday 01 January 1970 01:00, Alec Warner wrote:
> eclass changes?  You can't even commit eclasses to it...

Eclass changes in the main tree, including all relevant ebuilds updated, but 
breaking the ebuilds in the Surise overlay, having whining users or borked 
systems in the worst case.


Carsten


pgpbBODt0RBXc.pgp
Description: PGP signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Brian Harring]

On Wed, Aug 02, 2006 at 02:24:17AM +0200, Carsten Lohrke wrote:
> On Monday 31 July 2006 07:05, Seemant Kulleen wrote:
> > OK, let's start with: what exactly is the problem?
> 1) Please reread my replies in the first sunrise thread. Points are:
1) no security, 

Suggest you read their responses, and look into some of their material 
(in particular their faq).

Two levels.

One, holding area (essentially).
Second level (what users get), is the reviewed branch.

So... if you're arguing people can stick malicious shit into the first 
level, yes, they could.

I could also stick malicious code into bugzilla.  If you're dumb 
enough to run it without checking it, your own fault (both cases).

If you're arguing that malicious code gets stuck into reviewed... when 
I was a dev, I could have very easily done the same thing.

Comes down to trust that they know what they're doing for the second 
level- again, same situation for the gentoo-x86.

And... just cause I'm mildly sick of this bullshit, I'll head off 
the retort of "but people with +w for gentoo-x86 have been passed 
through the developer process, screening the malicious".  Ayone 
determined can punch through it without issue- *both* gentoo-x86 and 
sunrise.


> 2) issues with eclass changes which will result in bug spam

You're not supposed to change the exposed api of eclasses in the tree 
(something y'all do violate I might add, which is a seperate QA 
matter).  Same issue applies to the 'official' overlays offered by 
devs also, and to the tree in general.

It's a reaching statement, bluntly.  Using such an arguement has the 
side affect of stating that no overlays should ever exist, because 
they suffer the same potentials.

Which obviously is a bit of BS.


> 3) the fact that sunrise is a bunch of arbitrary packages, instead close 
> related ones managed 
> by one team, that does exactly maintain relevant packages.

What the hell do you think the tree is?  It's a bunch of arbitrary 
packages maintained loosely by subgroups of people; you're stating 
that sunrise is too loose yet gentoo-x86 is fundamentally no 
different.

Sunrise is pretty much the same damn thing.


> These issues are 
> fundamental, pointed out multiple times. You can't believe how ridiculous 
> Mike's question in the other thread, if there were any remaining issues, 
> sound to me and obviously others.

Frankly, your points are assine/fud here.  If you're going to bitch 
about flaws inherent in the work _you_ also do, kindly at least state 
it's universal rather then pawning it off as a sunrise specific 
failing.

~harring


pgptKcKdR2dgG.pgp
Description: PGP signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Thierry Carrez]

Brian Harring wrote:

> What the hell do you think the tree is?  It's a bunch of arbitrary 
> packages maintained loosely by subgroups of people; you're stating 
> that sunrise is too loose yet gentoo-x86 is fundamentally no 
> different.
> 
> Sunrise is pretty much the same damn thing.

Or maybe he means the "Gentoo developers" are an elite group of flawless
people, blessed by the mighty ebuild quizz ? That elitism would in the
end kill us, and I thank the Sunrise project for opening up Gentoo a
little more to the community. We may have to lose a few elitist fellows
in the process, but I still stand by the Council decision that it was
the right thing to do.

I just can't see how an ebuild directly committed without peer review to
the tree is necessary better than an ebuild contributed by a power user
and peer-reviewed by a Gentoo developer, ending up in a repository you
have to choose to use...

-- 
Koon
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Ciaran McCreesh]

On Wed, 02 Aug 2006 11:21:38 +0200 Thierry Carrez <[EMAIL PROTECTED]>
wrote:
| Or maybe he means the "Gentoo developers" are an elite group of
| flawless people, blessed by the mighty ebuild quizz ? That elitism
| would in the end kill us, and I thank the Sunrise project for opening
| up Gentoo a little more to the community. We may have to lose a few
| elitist fellows in the process, but I still stand by the Council
| decision that it was the right thing to do.

The alternative to elitism is mediocrity. Would you like Gentoo to be a
mediocre distribution?

-- 
Ciaran McCreesh
Mail: ciaran dot mccreesh at blueyonder.co.uk


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Denis Dupeyron]

On 8/2/06, Ciaran McCreesh <[EMAIL PROTECTED]> wrote:

The alternative to elitism is mediocrity. Would you like Gentoo to be a
mediocre distribution?


The real world isn't binary. So there's a whole range of alternatives
between elitism and mediocrity.

Denis.
--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Ciaran McCreesh]

On Wed, 2 Aug 2006 11:41:10 +0200 "Denis Dupeyron" <[EMAIL PROTECTED]>
wrote:
| On 8/2/06, Ciaran McCreesh <[EMAIL PROTECTED]> wrote:
| > The alternative to elitism is mediocrity. Would you like Gentoo to
| > be a mediocre distribution?
| 
| The real world isn't binary. So there's a whole range of alternatives
| between elitism and mediocrity.

But the quality of an overall product is no greater than the quality of
its worst part...

-- 
Ciaran McCreesh
Mail: ciaran dot mccreesh at blueyonder.co.uk


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Alex Tarkovsky]

On 8/2/06, Ciaran McCreesh <[EMAIL PROTECTED]> wrote:

The alternative to elitism is mediocrity. Would you like Gentoo to be a
mediocre distribution?


Every time you post it's like fingernails on a chalkboard...

http://arcanux.org/scarecrow.png

Cheers.
--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Roy Bamford]

On 2006.08.02 10:51, Ciaran McCreesh wrote:

On Wed, 2 Aug 2006 11:41:10 +0200 "Denis Dupeyron"
<[EMAIL PROTECTED]>
wrote:
| On 8/2/06, Ciaran McCreesh <[EMAIL PROTECTED]> wrote:
| > The alternative to elitism is mediocrity. Would you like Gentoo to
| > be a mediocre distribution?
|
| The real world isn't binary. So there's a whole range of
alternatives
| between elitism and mediocrity.


The alternative to elitism is extinction, in a binary world.



But the quality of an overall product is no greater than the quality
of its worst part...


So the quality of British Rail trains is no better than the sandwiches  
they serve ?
At least the sandwiches are not safety involved, nor made as if they  
were.




--
Ciaran McCreesh
Mail: ciaran dot mccreesh at blueyonder.co.uk


--
gentoo-dev@gentoo.org mailing list


Regards,

Roy Bamford

--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Jochen Maes]

> On 8/2/06, Ciaran McCreesh <[EMAIL PROTECTED]> wrote:
>> The alternative to elitism is mediocrity. Would you like Gentoo to be a
>> mediocre distribution?
>
> Every time you post it's like fingernails on a chalkboard...
>
> http://arcanux.org/scarecrow.png
>
but this time he is right, am i gl
> Cheers.
> --
> gentoo-dev@gentoo.org mailing list
>
>


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Jochen Maes]

> On 8/2/06, Ciaran McCreesh <[EMAIL PROTECTED]> wrote:
>> The alternative to elitism is mediocrity. Would you like Gentoo to be a
>> mediocre distribution?
>
> Every time you post it's like fingernails on a chalkboard...
>
> http://arcanux.org/scarecrow.png
but he has a valid point. this is not a step forward!
>
> Cheers.
> --
> gentoo-dev@gentoo.org mailing list
>
>


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Stephen P. Becker]

Every time you post it's like fingernails on a chalkboard...

http://arcanux.org/scarecrow.png


Ha ha ha! Oh gosh that's funny! That's really funny! Do you photoshop 
your own material? Do you? Because that is so fresh. Ciaranm is like a 
scarecrow. You know, I've, I've never heard anyone make that joke 
before. Hmm. You're the first. I've never heard anyone reference, 
reference that outside of irc before. Because that's what everyone who 
disagrees with him says right? Isn't it? He is a scarecrow. And, and yet 
you've taken that and posted it in this discussion to insult him in this 
everyday situation. God what a clever, smart person you must be, to come 
up with a joke like that all by yourself. That's so fresh too. Any, any 
George W. Bush jokes you want to throw out too as long as we're hitting 
these phenomena at the height of their popularity? God you're so funny!

--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Paul de Vrieze]

On Monday 31 July 2006 08:47, Ciaran McCreesh wrote:
> Knowing what the problem is is part of making the solution. The problem
> is not that users can't push arbitrary content into a centralised
> official repository with no oversight from the herds appropriate for
> said content quickly enough. I didn't claim to know exactly what the
> real problem is, merely that it's not what's being solved here.
>
Herds do not have turfs. They specialise in particular areas but that doesn't 
mean that all packages in that area have to fall under the herd.

Paul

-- 
Paul de Vrieze
Gentoo Developer
Mail: [EMAIL PROTECTED]
Homepage: http://www.devrieze.net


pgpjmmuU20zMl.pgp
Description: PGP signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Carsten Lohrke]

First I'd like to state that I do offer my opinion. You don't have to like it, 
but disqualifying it as flaming, while exactly doing this yourself, 
disqualifies you. I'd appreciate, if you would try to have a controversial 
discussion, without starting to loose your manners.


On Wednesday 02 August 2006 03:39, Brian Harring wrote:
> 1) no security,
>
> Suggest you read their responses, and look into some of their material
> (in particular their faq).
>
> Two levels.
>
> One, holding area (essentially).
> Second level (what users get), is the reviewed branch.
>
> So... if you're arguing people can stick malicious shit into the first
> level, yes, they could.
> [...] 

You haven't read what I wrote, as I asked you to do. My point isn't that 
people add malicious ebuilds to the overlay. There're more subtle methods 
anyway, given that the tree still isn't signed. I wrote about vulnerablities 
in the upstream software, neither having a security team backing them up nor 
GLSA's to be written.


> And... just cause I'm mildly sick of this bullshit,

And I'm sick of people, who miss the point.


> > 2) issues with eclass changes which will result in bug spam
>
> You're not supposed to change the exposed api of eclasses in the tree
> (something y'all do violate I might add, which is a seperate QA
> matter).  Same issue applies to the 'official' overlays offered by
> devs also, and to the tree in general.

We can change eclasses all the time, assuming all relevant ebuilds in the tree 
get adjusted - just that no one cares for any overlay.

> It's a reaching statement, bluntly.  Using such an arguement has the
> side affect of stating that no overlays should ever exist, because
> they suffer the same potentials.

Local overlays are fine as the user exactly knows what he does in his private 
overlay (and hopefully follows eclass changes), development overlays are fine 
(assuming the group of people controls the releavant overlays as well), 
overlays like Sunrise are problematic, not to use such anal words as you do.

> > 3) the fact that sunrise is a bunch of arbitrary packages, instead close
> > related ones managed by one team, that does exactly maintain relevant
> > packages.
>
> What the hell do you think the tree is?  It's a bunch of arbitrary
> packages maintained loosely by subgroups of people; you're stating
> that sunrise is too loose yet gentoo-x86 is fundamentally no
> different.
>
> Sunrise is pretty much the same damn thing.

Exactly that isn't right. No one cares for compatibility of the main tree 
(eclasses, conflicts between ebuilds with regards to installed files) and 
Sunrise ebuilds.


Carsten


pgppgHR1KggPH.pgp
Description: PGP signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Alex Tarkovsky]

On 8/2/06, Stephen P. Becker <[EMAIL PROTECTED]> wrote:

> Every time you post it's like fingernails on a chalkboard...
>
> http://arcanux.org/scarecrow.png

Ha ha ha! Oh gosh that's funny! That's really funny! Do you photoshop
your own material? Do you? Because that is so fresh. Ciaranm is like a
scarecrow. You know, I've, I've never heard anyone make that joke
before. Hmm. You're the first. I've never heard anyone reference,
reference that outside of irc before. Because that's what everyone who
disagrees with him says right? Isn't it? He is a scarecrow. And, and yet
you've taken that and posted it in this discussion to insult him in this
everyday situation. God what a clever, smart person you must be, to come
up with a joke like that all by yourself. That's so fresh too. Any, any
George W. Bush jokes you want to throw out too as long as we're hitting
these phenomena at the height of their popularity? God you're so funny!


There's a stark line between satire (my post) and invective (your
tirade). That you don't seem aware of its existence and decided to
exhibit this ignorance publicly is yet another reason I believe you
should retire as a Gentoo developer. Please, you're hurting Gentoo.
--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Alec Warner]

Alex Tarkovsky wrote:
> On 8/2/06, Stephen P. Becker <[EMAIL PROTECTED]> wrote:
>> > Every time you post it's like fingernails on a chalkboard...
>> >
>> > http://arcanux.org/scarecrow.png
>>
>> Ha ha ha! Oh gosh that's funny! That's really funny! Do you photoshop
>> your own material? Do you? Because that is so fresh. Ciaranm is like a
>> scarecrow. You know, I've, I've never heard anyone make that joke
>> before. Hmm. You're the first. I've never heard anyone reference,
>> reference that outside of irc before. Because that's what everyone who
>> disagrees with him says right? Isn't it? He is a scarecrow. And, and yet
>> you've taken that and posted it in this discussion to insult him in this
>> everyday situation. God what a clever, smart person you must be, to come
>> up with a joke like that all by yourself. That's so fresh too. Any, any
>> George W. Bush jokes you want to throw out too as long as we're hitting
>> these phenomena at the height of their popularity? God you're so funny!
> 
> There's a stark line between satire (my post) and invective (your
> tirade). That you don't seem aware of its existence and decided to
> exhibit this ignorance publicly is yet another reason I believe you
> should retire as a Gentoo developer. Please, you're hurting Gentoo.

I'd prefer you both take your retorts offlist, as neither are on topic here.
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Ciaran McCreesh]

On Wed, 2 Aug 2006 14:49:19 -0500 "Alex Tarkovsky"
<[EMAIL PROTECTED]> wrote:
| On 8/2/06, Stephen P. Becker <[EMAIL PROTECTED]> wrote:
| > > Every time you post it's like fingernails on a chalkboard...
| > >
| > > http://arcanux.org/scarecrow.png
| >
| > Ha ha ha! Oh gosh that's funny! That's really funny! Do you
| > photoshop your own material? Do you? Because that is so fresh.
| > Ciaranm is like a scarecrow. You know, I've, I've never heard
| > anyone make that joke before. Hmm. You're the first. I've never
| > heard anyone reference, reference that outside of irc before.
| > Because that's what everyone who disagrees with him says right?
| > Isn't it? He is a scarecrow. And, and yet you've taken that and
| > posted it in this discussion to insult him in this everyday
| > situation. God what a clever, smart person you must be, to come up
| > with a joke like that all by yourself. That's so fresh too. Any,
| > any George W. Bush jokes you want to throw out too as long as we're
| > hitting these phenomena at the height of their popularity? God
| > you're so funny!
| 
| There's a stark line between satire (my post) and invective (your
| tirade).

No no. Stephen's post was beautifully ironic satire. Yours was just
a lame attempt at flamebait. Try sticking "Because that is so fresh."
into Google...

| That you don't seem aware of its existence and decided to
| exhibit this ignorance publicly is yet another reason I believe you
| should retire as a Gentoo developer. Please, you're hurting Gentoo.

Again, no, it's a sign that you don't get it and you should keep quiet
until you do. You're filling this list up with noise and not
contributing anything to the discussion. Please stop.

-- 
Ciaran McCreesh
Mail: ciaran dot mccreesh at blueyonder.co.uk


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Jakub Moc]

Ciaran McCreesh wrote:
> On Wed, 2 Aug 2006 14:49:19 -0500 "Alex Tarkovsky"
> <[EMAIL PROTECTED]> wrote:
> | On 8/2/06, Stephen P. Becker <[EMAIL PROTECTED]> wrote:
> | > > Every time you post it's like fingernails on a chalkboard...

> | > Ha ha ha! Oh gosh that's funny! That's really funny! 
> | There's a stark line between satire (my post) and invective (your
> | tirade).
> 
> No no. Stephen's post was beautifully ironic satire. 

ZOMG! This this to gentoo-blurb or whatever else, this thread is long
enough as it is even without this off-topic junk.


-- 
Best regards,

 Jakub Moc
 mailto:[EMAIL PROTECTED]
 GPG signature:
 http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0xCEBA3D9E
 Primary key fingerprint: D2D7 933C 9BA1 C95B 2C95  B30F 8717 D5FD CEBA 3D9E

 ... still no signature   ;)



signature.asc
Description: OpenPGP digital signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Brian Harring]

On Wed, Aug 02, 2006 at 08:05:15PM +0200, Carsten Lohrke wrote:
> First I'd like to state that I do offer my opinion. You don't have to like 
> it, 
> but disqualifying it as flaming, while exactly doing this yourself, 
> disqualifies you.

*cough*.  bit hypocritical for you to lecture me about viewing 
your statements as 'flaming', and in the same breath label 
my own as 'flaming' ;)

Why am I pointing this out?  My initial points were that of "why the 
double standard", with you providing an apt example (while that's 
barbed, you did provide a perfect refresher of the definition).


> I'd appreciate, if you would try to have a controversial 
> discussion, without starting to loose your manners.

And I'd appreciate a less condescending tone.


> On Wednesday 02 August 2006 03:39, Brian Harring wrote:
> > 1) no security,
> >
> > Suggest you read their responses, and look into some of their material
> > (in particular their faq).
> >
> > Two levels.
> >
> > One, holding area (essentially).
> > Second level (what users get), is the reviewed branch.
> >
> > So... if you're arguing people can stick malicious shit into the first
> > level, yes, they could.
> > [...] 
> 
> You haven't read what I wrote, as I asked you to do.

You wrote 'no security'.  That's pretty fricking vague, can cover 
everything from no verification of sync'd contents, to their vcs 
security, to their screening processes, to vulns in their packages.

If you wanted to home in vulns in the source (which isn't security as 
much as 'vulnerabilities in the source'), be explicit.

Now on to the real points (yay)...

> My point isn't that 
> people add malicious ebuilds to the overlay. There're more subtle methods 
> anyway, given that the tree still isn't signed. I wrote about vulnerablities 
> in the upstream software, neither having a security team backing them up nor 
> GLSA's to be written.

1) same issue with the ebuilds sitting in bugzilla, going to hunt 
through bugzie marking each submitted ebuild when a security bug hits?

2) Response to that is that "there is no claim of support"- which is 
the same for sunrise.  Why are the rules different for sunrise then?

3) Assumption that sunrise will just be a dumping ground, without any 
form of maintainance is implicit here- if it becomes as such, already 
was stated it would get wedgied by the council.  So that leaves the 
angle of "they don't have a security team", which implies to actually 
handle nuking vulnerable ebuilds, one has to have a security team 
(obviously false).

Besides... frankly it's kind of BS to push the vuln angle onto sunrise 
when gentoo can't even clean out years old vulnerable packages from 
gentoo-x86 (that doesn't absolve sunrise from having to watch it, nor 
a potshot at the understaffed security team, merely that double 
standards suck).

You want to set a standard for 'em, fine, lets use the standard of the 
existing tree when compared to existing glsas- note that there may be 
vulns that gentoo doesn't have glsas for, or vulns that are in the 
security pipeline and haven't yet been issued as a glsa (since gentoo 
issues it after porting).

285 versions out of 24637 vulnerable (~1 out of every 86 vuln)
115 packages out of 11251 vulnreable (~1 out of every 98 vuln)

http://gentooexperimental.org/~ferringb/vuln.log

So... if that's the standard you want to hold them to, fine, state 
so- they may agree to it (although admittedly such a standard is 
stupid, there should be _no_ vuln packages).

Don't automatically assume they'll be worse however, let alone assume 
that gentoo-x86 is perfect (again, no double standards).


> > And... just cause I'm mildly sick of this bullshit,
> 
> And I'm sick of people, who miss the point.

As stated above, be concise then.  Your points came out of pretty 
much nowhere, poorly communicated, and rather vague in actually 
backing them up.  Which... at least from the "backing up the 
complaints", has been the theme for the screaming folk thus far.

If people are missing the point, there are two possibilities- either 
A) everyone else is a moron and too stupid to understand your 
points, or more likely B) you're communicating poorly.

Assuming that the other party is the idiot (a) when more likely then 
not it's you (B) isn't really a good way to try and get your say.


> > > 2) issues with eclass changes which will result in bug spam
> >
> > You're not supposed to change the exposed api of eclasses in the tree
> > (something y'all do violate I might add, which is a seperate QA
> > matter).  Same issue applies to the 'official' overlays offered by
> > devs also, and to the tree in general.
> 
> We can change eclasses all the time, assuming all relevant ebuilds in the 
> tree 
> get adjusted - just that no one cares for any overlay.

No, actually you cannot.

Just because you update the tree doesn't mean you're not going and 
breaking binpkgs, or the vdb installation.

Read glep33 if you want the sordid back history and solution to it.

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Lance Albertson]

Brian Harring wrote:
> On Wed, Aug 02, 2006 at 08:05:15PM +0200, Carsten Lohrke wrote:
>> First I'd like to state that I do offer my opinion. You don't have to like 
>> it, 
>> but disqualifying it as flaming, while exactly doing this yourself, 
>> disqualifies you.
> 
> *cough*.  bit hypocritical for you to lecture me about viewing 
> your statements as 'flaming', and in the same breath label 
> my own as 'flaming' ;)
> 
> Why am I pointing this out?  My initial points were that of "why the 
> double standard", with you providing an apt example (while that's 
> barbed, you did provide a perfect refresher of the definition).
> 
> 
>> I'd appreciate, if you would try to have a controversial 
>> discussion, without starting to loose your manners.
> 
> And I'd appreciate a less condescending tone.

Can you two please stop with this child-like circle of blame? Its really
starting to get old. You don't need to have the last word on every
argument (either of you). If neither of you can agree, then just agree
to disagree. *gasp* Yes, that is an option in a technical debate. No
matter what either of you two think is technically right, you're both
right and both wrong.

/me goes back to lurking

-- 
Lance Albertson <[EMAIL PROTECTED]>
Gentoo Infrastructure | Operations Manager

---
GPG Public Key:  
Key fingerprint: 0423 92F3 544A 1282 5AB1  4D07 416F A15D 27F4 B742

ramereth/irc.freenode.net



signature.asc
Description: OpenPGP digital signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Lance Albertson]

Brian Harring wrote:
> On Wed, Aug 02, 2006 at 08:05:15PM +0200, Carsten Lohrke wrote:

>> Local overlays are fine as the user exactly knows what he does in his 
>> private 
>> overlay (and hopefully follows eclass changes), development overlays are 
>> fine 
>> (assuming the group of people controls the releavant overlays as well), 
>> overlays like Sunrise are problematic, not to use such anal words as you do.
> 
> Why are they problematic?  Because of your assumption that they won't 
> maintain it?
> 
> It's the same thing as gentoo-x86 (I will keep stating that till it's 
> grilled into peoples heads also), this is _not_ a new issue so why are 
> people leveling issues of gentoo-x86 as new issues of sunrise?
> 
> So someone goes and breaks something in gentoo-x86 that breaks 
> something for sunrise.  Fine, it's sunrises' mess to clean up; they've 
> volunteered to do this work, I don't see how you can claim it as a 
> negative when they've accepted it as part of _their_ work.

I think the point a lot of people are concerned about are packages that
contain libraries or other dependencies that reside in the sunrise tree.
There's a good chance that a package in the regular tree will link
against a package from sunrise, the user will have no idea or forget
that they installed that app from sunrise (and the dep exists), and a
bug arises. Who's fault is it? Is it the package maintainer in the
regular tree, or sunrise? How do you stop excessive bug traffic for
issues like this?

Another issue I think people are ignoring here is the fact that sunrise
isn't focused on a particular part of the tree. I think Ciaran made a
point earlier (that was probably ignored) about the fact of why we have
herds in the regular tree. They aren't perfect, but they still do a
decent job of gathering people who have a good understand about a
certain group of packages. I have a hard time believing that the same
type of quality exists with the number of devs working on it. The
difference between sunrise and say the php overlay is the fact that
sunrise isn't focused on a set of packages (just ones that people want
that aren't in the tree) compared to a focused set for a specific
purpose (php).

The more I think about it, I think there needs to be a separation
between "a sandbox for users to hone their ebuild skills" and "these
packages aren't in the tree yet, lets make the available somewhere
else". Perhaps the better solution is to have the herds manage their own
set of overlays must like php does. I imagine many herds won't have a
need for it, while others would (and probably already using it). What's
the real purpose of sunrise then? The sandbox/learning ground? Or a
place for ebuilds that are stuck in bugs? The sunrise project has been
fighting on the grounds of learning aspect, but most of the people are
having issues with the ebuild stomping ground side. If I remember right,
the primary reason the council voted to re-enact sunrise was because of
the learning side of it. I don't doubt that (if done right) would be a
great thing, but I have concerns on the implementation of the latter.

For an example:

To me, it would work better if the netmon herd brought on a user to help
with the netmon overlay. They would get specific 'training' on working
on netmon ebuilds. They could have done the 'bootcamp' at sunrise
initially, then moved onto the herd overlay for something a bit more
organized and better maintained. This would produce a part of the QA
that some people are in a fuss about, and some better organization.
Heck, maybe even some interaction with the sunrise group and netmon herd
would be great so that the education continues, but on other watchful eyes.

Basically, it boils down to organization of ebuilds and how they are
being watched. A group that watches all isn't a good idea to me, my idea
above makes more sense.

Anyways, I've been trying to keep quiet on this issue and decided I
could interject here :)

Cheers-

-- 
Lance Albertson <[EMAIL PROTECTED]>
Gentoo Infrastructure | Operations Manager

---
GPG Public Key:  
Key fingerprint: 0423 92F3 544A 1282 5AB1  4D07 416F A15D 27F4 B742

ramereth/irc.freenode.net



signature.asc
Description: OpenPGP digital signature

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Brian Harring]

On Wed, Aug 02, 2006 at 10:27:04PM -0500, Lance Albertson wrote:
> Brian Harring wrote:
> > On Wed, Aug 02, 2006 at 08:05:15PM +0200, Carsten Lohrke wrote:
> 
> >> Local overlays are fine as the user exactly knows what he does in his 
> >> private 
> >> overlay (and hopefully follows eclass changes), development overlays are 
> >> fine 
> >> (assuming the group of people controls the releavant overlays as well), 
> >> overlays like Sunrise are problematic, not to use such anal words as you 
> >> do.
> > 
> > Why are they problematic?  Because of your assumption that they won't 
> > maintain it?
> > 
> > It's the same thing as gentoo-x86 (I will keep stating that till it's 
> > grilled into peoples heads also), this is _not_ a new issue so why are 
> > people leveling issues of gentoo-x86 as new issues of sunrise?
> > 
> > So someone goes and breaks something in gentoo-x86 that breaks 
> > something for sunrise.  Fine, it's sunrises' mess to clean up; they've 
> > volunteered to do this work, I don't see how you can claim it as a 
> > negative when they've accepted it as part of _their_ work.
> 
> I think the point a lot of people are concerned about are packages that
> contain libraries or other dependencies that reside in the sunrise tree.
> There's a good chance that a package in the regular tree will link
> against a package from sunrise, the user will have no idea or forget
> that they installed that app from sunrise (and the dep exists), and a
> bug arises.

http://www.gentoo-sunrise.org/sunrise/wiki/SunriseFaq

Specifically, for those who haven't done their reading, look for the 
"Can I commit everything I like to the overlay", specifically the 
rules involved for what goes in.

The short and skiny is that the arguement of "they'll have some 
package that breaks my package" is kind of daft- sunrise won't hold 
version bumps for packages in the tree (one exception to this is 
maintainer-needed that has sat, perhaps they can clarify that corner 
case).

For the maintainer-wanted, the developer who pulls the package in 
*should* be lifting from sunrise already.  Why?  Because whats there 
has actually been exposed to users, rather then them relying on a 
simple eyeballing of the ebuild from bugzilla instead.

That leaves the "will link against a package from sunrise"... covered 
the potentials above, the remaining case is a package in the tree 
linking against a maintainer-needed ebuild.

Funny thing, that's actually a bug in the developers package.  Daft I 
know, but it's actually a *good* thing to smoke those out, there 
should be no unstated linkage (if it ain't in the deps, it's 
a bug to use/link to it).


> Who's fault is it? Is it the package maintainer in the
> regular tree, or sunrise?

> How do you stop excessive bug traffic for issues like this?

Assumption is that there will be excessive bug traffic for issues like 
that.  Rules above imo lay it out well enough I don't think it'll 
occur at the level of "excessive".  Basically, sky is falling 
predictions- no one has hard facts since this is hypothetical, so it 
would be *nice* if people would at least recognize that they may be 
barking at a minimal issue.

*Plus*, with sunrise under gentoos thumb if it proves to be more 
trouble then it's worth, the plug can be pulled- that's the trade of 
it being official, they get hosting, y'all get an actual say in what 
they do.

If they do it externally, ain't much you can do- can't demand they do 
something (result of that if it were me would be a mooning), stuck 
requesting them to do what _y'all_ want.


> Another issue I think people are ignoring here is the fact that sunrise
> isn't focused on a particular part of the tree. I think Ciaran made a
> point earlier (that was probably ignored) about the fact of why we have
> herds in the regular tree. They aren't perfect, but they still do a
> decent job of gathering people who have a good understand about a
> certain group of packages. I have a hard time believing that the same
> type of quality exists with the number of devs working on it. The
> difference between sunrise and say the php overlay is the fact that
> sunrise isn't focused on a set of packages (just ones that people want
> that aren't in the tree) compared to a focused set for a specific
> purpose (php).

What is sunrises reason for existance?

It's meant to hold ebuilds that _rot_ in bugzilla in a place where 
people can work on them as needed, and folks who need the packages can 
use them.  They may get bit in the ass since it's a fairly raw repo 
(despite reviewed branch), but the purpose here is different; it's not 
intended as a dumping ground (and if it becomes one, council has 
stated their intentions), it's intended as a repo for people to get at 
the ebuilds in an easier way, and improve those ebuilds if there is 
interest.


> The more I think about it, I think there needs to be a separation
> between "a sandbox for users to hone their ebuild skills" and "these
> packages are

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Donnie Berkholz]

Lance Albertson wrote:

I think the point a lot of people are concerned about are packages that
contain libraries or other dependencies that reside in the sunrise tree.
There's a good chance that a package in the regular tree will link
against a package from sunrise, the user will have no idea or forget
that they installed that app from sunrise (and the dep exists), and a
bug arises. Who's fault is it? Is it the package maintainer in the
regular tree, or sunrise? How do you stop excessive bug traffic for
issues like this?


You create `emerge --info` output that details any packages on the 
system installed from an overlay.


Thanks,
Donnie
--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Roy Bamford]

On 2006.08.03 04:27, Lance Albertson wrote:
[snip]


There's a good chance that a package in the regular tree will link
against a package from sunrise, the user will have no idea or forget
that they installed that app from sunrise (and the dep exists), and a
bug arises.

[snip]


Anyways, I've been trying to keep quiet on this issue and decided I
could interject here :)

Cheers-

--
Lance Albertson <[EMAIL PROTECTED]>
Gentoo Infrastructure | Operations Manager

---
GPG Public Key:  
Key fingerprint: 0423 92F3 544A 1282 5AB1  4D07 416F A15D 27F4 B742

ramereth/irc.freenode.net



How can that happen ?
Devs working on the regular tree should not have any third party  
overlays installed in the test environment so their ebuild should fail  
testing because it can't resolve the dependancy lurking in the overlay.


What an I missing ?

Regards,

Roy Bamford

--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Bryan Ãstergaard]

On Thu, Aug 03, 2006 at 10:46:22AM +0100, Roy Bamford wrote:
> On 2006.08.03 04:27, Lance Albertson wrote:
> [snip]
> 
> >There's a good chance that a package in the regular tree will link
> >against a package from sunrise, the user will have no idea or forget
> >that they installed that app from sunrise (and the dep exists), and a
> >bug arises.
> [snip]
> >
> >Anyways, I've been trying to keep quiet on this issue and decided I
> >could interject here :)
> >
> >Cheers-
> >
> >--
> >Lance Albertson <[EMAIL PROTECTED]>
> >Gentoo Infrastructure | Operations Manager
> >
> >---
> >GPG Public Key:  
> >Key fingerprint: 0423 92F3 544A 1282 5AB1  4D07 416F A15D 27F4 B742
> >
> >ramereth/irc.freenode.net
> >
> 
> How can that happen ?
> Devs working on the regular tree should not have any third party  
> overlays installed in the test environment so their ebuild should fail  
> testing because it can't resolve the dependancy lurking in the overlay.
> 
> What an I missing ?
> 
Automatic dependencies. Eg. configure picking up fooapp being installed
and enabling support for it without the ebuild explicitly
enabling/disabling it. Of course, this would be a bug in the ebuild and
should be fixed.

Regards,
Bryan Østergaard
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Sune Kloppenborg Jeppesen]

On Thursday 03 August 2006 04:56, Brian Harring wrote:

> Besides... frankly it's kind of BS to push the vuln angle onto sunrise
> when gentoo can't even clean out years old vulnerable packages from
> gentoo-x86 (that doesn't absolve sunrise from having to watch it, nor
> a potshot at the understaffed security team, merely that double
> standards suck).
Just to clarify: AFAIR it has never been policy to remove vulnerable ebuilds. 

The Security Team leaves that up to the maintainers. For some issues it does 
make sense to keep vulnerable ebuilds in the tree (ie. latest Apache (GLSA 
200608-01, when not using mod_rewrite).

-- 
Sune Kloppenborg Jeppesen (Jaervosz)
Operational Manager
Gentoo Linux Security Team
http://security.gentoo.org
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Carsten Lohrke]

On Thursday 03 August 2006 04:56, Brian Harring wrote:
> *cough*.  bit hypocritical for you to lecture me about viewing
> your statements as 'flaming', and in the same breath label
> my own as 'flaming' ;)
>
> Why am I pointing this out?  My initial points were that of "why the
> double standard", with you providing an apt example (while that's
> barbed, you did provide a perfect refresher of the definition).

The difference is that I argue, while you accuse me to play false. I consider 
this as ad hominem and together with all this "FUD" and "BS" calling, in 
contrary to my email, inflammatory.


> > I'd appreciate, if you would try to have a controversial
> > discussion, without starting to loose your manners.
>
> And I'd appreciate a less condescending tone.

This wasn't meant condescending, but a true request. Because it's not the 
first time you react this way, when you dislike another ones opinion. It is 
as annoying as Ciaran's habit to make statements without backing them up - 
even when asked to do so.


> You wrote 'no security'.  That's pretty fricking vague, can cover
> everything from no verification of sync'd contents, to their vcs
> security, to their screening processes, to vulns in their packages.

I wrote that you should read my replies in the initial thread.


> If you wanted to home in vulns in the source (which isn't security as
> much as 'vulnerabilities in the source'), be explicit.

I was.


> Now on to the real points (yay)...
>
> > My point isn't that
> > people add malicious ebuilds to the overlay. There're more subtle methods
> > anyway, given that the tree still isn't signed. I wrote about
> > vulnerablities in the upstream software, neither having a security team
> > backing them up nor GLSA's to be written.
>
> 1) same issue with the ebuilds sitting in bugzilla, going to hunt
> through bugzie marking each submitted ebuild when a security bug hits?
>
> 2) Response to that is that "there is no claim of support"- which is
> the same for sunrise.  Why are the rules different for sunrise then?

The difference is that people are using them in their local overlay and 
therefore - in contrary to the Sunrise overlay - a) are only exposed to the 
packges they _really_ want to use and b) are responsible for it themselves.

Aside of this I might add that I do add comments to bug reports, when I 
stumble about vulnerability notices and find relevant bug reports.


> 3) Assumption that sunrise will just be a dumping ground, without any
> form of maintainance is implicit here- if it becomes as such, already
> was stated it would get wedgied by the council.  So that leaves the
> angle of "they don't have a security team", which implies to actually
> handle nuking vulnerable ebuilds, one has to have a security team
> (obviously false).

Dumping ground or not. It's easy to miss vulnerability notices. Especially, if 
you don't have guys who expclicitly care for it. And you need a security team 
to announce issue to the user base. I wouldn't use Gentoo, if we not had such 
a hard and good working security team.


> Besides... frankly it's kind of BS to push the vuln angle onto sunrise
> when gentoo can't even clean out years old vulnerable packages from
> gentoo-x86 (that doesn't absolve sunrise from having to watch it, nor
> a potshot at the understaffed security team, merely that double
> standards suck).

Interesting to see you state this. Because this is a far more serious problem, 
than supporting "everything" possible; And Sunrise won't fix this either - if 
not the opposite. One of the goals of Sunrise is to recruit new devs. But we 
don't need new devs to add new packages primarily, we more to maintain 
existing and not so fancy stuff and to clean out the tree.


> You want to set a standard for 'em, fine, lets use the standard of the
> existing tree when compared to existing glsas- note that there may be
> vulns that gentoo doesn't have glsas for, or vulns that are in the
> security pipeline and haven't yet been issued as a glsa (since gentoo
> issues it after porting).
>
> 285 versions out of 24637 vulnerable (~1 out of every 86 vuln)
> 115 packages out of 11251 vulnreable (~1 out of every 98 vuln)
>
> http://gentooexperimental.org/~ferringb/vuln.log
>
> So... if that's the standard you want to hold them to, fine, state
> so- they may agree to it (although admittedly such a standard is
> stupid, there should be _no_ vuln packages).

Your list is rubbish. There're stable versions for all security wise supported 
architectures and the relevant GLSA's. If users don't use them, it's their 
local problem.


> > > And... just cause I'm mildly sick of this bullshit,
> >
> > And I'm sick of people, who miss the point.
>
> As stated above, be concise then.  Your points came out of pretty
> much nowhere, poorly communicated, and rather vague in actually
> backing them up.  Which... at least from the "backing up the
> complaints", has been the theme for the screaming folk thus far.

Do I have to 

Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Patrick Lauer]

On Thu, 2006-08-03 at 18:21 +0200, Carsten Lohrke wrote:
> The difference is that I argue, while you accuse me to play false. I consider 
> this as ad hominem and together with all this "FUD" and "BS" calling, in 
> contrary to my email, inflammatory.
... and that is inflammatory :-)

> > > I'd appreciate, if you would try to have a controversial
> > > discussion, without starting to loose your manners.
> >
> > And I'd appreciate a less condescending tone.
> 
> This wasn't meant condescending, but a true request. Because it's not the 
> first time you react this way, when you dislike another ones opinion. It is 
> as annoying as Ciaran's habit to make statements without backing them up - 
> even when asked to do so.
I think it's a language barrier - as you (and I) are not native english 
speakers we tend to put a different emphasis on words.
What may look perfectly polite to you could be a big insult to a french
or japanese speaker ...

That being said, I'd interpret what you've written as mildly
condescending too.


> > 3) Assumption that sunrise will just be a dumping ground, without any
> > form of maintainance is implicit here- if it becomes as such, already
> > was stated it would get wedgied by the council.  So that leaves the
> > angle of "they don't have a security team", which implies to actually
> > handle nuking vulnerable ebuilds, one has to have a security team
> > (obviously false).
> 
> Dumping ground or not. It's easy to miss vulnerability notices. Especially, 
> if 
> you don't have guys who expclicitly care for it. And you need a security team 
> to announce issue to the user base. I wouldn't use Gentoo, if we not had such 
> a hard and good working security team.
> 
I wonder if all inofficial overlays and bugs are always updated?
Sunrise is still young, but the way they've handled bugreports makes me
quite confident that they'll be able to handle security issues when they
have reached a stable and sustainable size. 

> > Besides... frankly it's kind of BS to push the vuln angle onto sunrise
> > when gentoo can't even clean out years old vulnerable packages from
> > gentoo-x86 (that doesn't absolve sunrise from having to watch it, nor
> > a potshot at the understaffed security team, merely that double
> > standards suck).
> 
> Interesting to see you state this. Because this is a far more serious 
> problem, 
> than supporting "everything" possible; And Sunrise won't fix this either - if 
> not the opposite. One of the goals of Sunrise is to recruit new devs. But we 
> don't need new devs to add new packages primarily, we more to maintain 
> existing and not so fancy stuff and to clean out the tree.
> 
How do you train devs?
Also, who is only working on the things he did when he initially became
dev?

[snip]
> Your list is rubbish. There're stable versions for all security wise 
> supported 
> architectures and the relevant GLSA's. If users don't use them, it's their 
> local problem.
If users use sunrise it's their local problem, too. 
> 
> > > > And... just cause I'm mildly sick of this bullshit,
> > >
> > > And I'm sick of people, who miss the point.
> >
> > As stated above, be concise then.  Your points came out of pretty
> > much nowhere, poorly communicated, and rather vague in actually
> > backing them up.  Which... at least from the "backing up the
> > complaints", has been the theme for the screaming folk thus far.
> 
> Do I have to learn you to read? See above.
^^ that is really condescending. 


> > So someone goes and breaks something in gentoo-x86 that breaks
> > something for sunrise.  Fine, it's sunrises' mess to clean up; they've
> > volunteered to do this work, I don't see how you can claim it as a
> > negative when they've accepted it as part of _their_ work.
> 
> The problems will pile up in bugs.g.o and "usally" with the wrong addressee. 
> This has been every now and then the case with other overlays as well as 
> users of distros building on Gentoo. I can live with that to a degree. But 
> when we do this mess ourselves, it get's highly annoying.
Hmmm?
The problem with most other overlays is that they also may have updated
or patched versions of in-tree applications. Most problems that you
claim should not happen in sunrise.

> > Granted, they may give you the finger and quit, or your remaining
> > fellow devs may rightfully boot you for playing games, but the point
> > stands- they stepped up to do the work, including cleaning up
> > anything y'all may break for them.
> 
> You're doing it again. No I'm not playig games with you. I have reasonable 
> complaints and consider this sort of overlay a failure. Then an extra 
> development tree would be much better.

I still fail to see what your issues with it are. All the points you
stated are either invalid or not an issue from my p.o.v.

> 
> > You're not limited- they're the ones limited via trying to not step on
> > gentoo-x86's toes.  How is that a negative then?
> 
> I fear for the security of our user base, especia