Re: Getting ubuntu iso securely

[Rajeev Bhatta]

Hi, what is the need for a publicly available iso to be secured... All packages 
bundled are already publicly available...

Md5 files makes sense as it is necessary for maintaining the validity of the 
file download and not let users be tricked by a incorrect file being passed as 
a correct one.

I do agree with you that the instructions for validating the file should be 
available with the download.

Thanks

On Sep 11, 2015 12:18 PM, Rune Schjellerup Philosof  wrote:
>
> Hi 
>
> I am puzzled by the absence of a secure method of downloading the ubuntu 
> iso images. 
> www.ubuntu.com is not served over https and neither is releases.ubuntu.com. 
>
> None of the mirrors are using https. 
>
> Isn't this a major security flaw? 
>
> I know that there are md5sum files and they are gpg signed as well. And if 
> you search for it you might find 
> https://help.ubuntu.com/community/VerifyIsoHowto. 
> But on www.ubuntu.com there are no instructions reminding you to verify 
> the download. 
>
> -- 
> Ubuntu-devel-discuss mailing list 
> Ubuntu-devel-discuss@lists.ubuntu.com 
> Modify settings or unsubscribe at: 
> https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss 
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Re: Getting ubuntu iso securely

[rajeev bhatta]

It is not time consuming.. just for the user experience..  


 On Monday, 14 September 2015 9:39 PM, Ralf Mardorf 
<ralf.mard...@alice-dsl.net> wrote:
   

 On Mon, 14 Sep 2015 08:39:00 -0700, Ryein Goddard wrote:
>Probably a good idea to have something on the site reminding users to
>verify the download.  Especially something as important as the
>operating system.

Several times I put this issue in on *buntu mailing lists.

Even if the download buttons would link to the download site with the
signed checksums, instead of just downloading the image, while
automatically https://help.ubuntu.com/community/VerifyIsoHowto would
pop up too, then how do you expect that averaged users should get a key
they trust, that can be used to verify ownership of a key that claims
to be owned by Ubuntu?

It's a well-meant idea, but Rune Schjellerup Philosof, Rajeev Bhatta
and Ryein Goddard please be honest, how time consuming was it for you
to get a key you trust, that can be used to verify ownership of the
public Ubuntu key?

Do you expect that an averaged user who automatically needs to get
signed checksums provided by pushing a button, instead of visiting the
download site on her/his own, would like to go through the hassle that
comes with the web of trust?

Regards,
Ralf

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


  -- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Re: Updating "wallch" in the next Ubuntu release

[Rajeev Bhatta]

Hi Dor, 
I was agreeing with you that the latest package should be included in 15.10 version of ubuntu. And referring to the part that you are using a long term support release of ubuntu which was released in april of 2014 ( ubuntu releases long term release versions every two years ) and since these releases are meant to be stable versions the packages are not updated until complete testing is done. 
Installing a deb file does introduce a security risk, but the risk should be taken based on package stability itself. Installing deb files which are not in the repo sometimes is inevitable as the package may never be added to the official repos due to multiple reasons for example google chrome browser...so it is not that much of a risk.. 
Hopefully this time I was able to be more clear in my email.
Thanks
On Sep 5, 2015 11:28 PM, Dor <dor9...@gmail.com> wrote:Hi Rajeev,I didn't understand your first two sentences..Will the Ubuntu developers team add the recent version of "wallch" to the next version of Ubuntu 14 ?I'm not sure if I should install a package which is not from the official Ubuntu source.. (?)Doesn't that introduces a security risk to my system?Thank you!Regards,Dor.2015-09-04 21:58 GMT+03:00 Rajeev Bhatta <techie.rajeev@yahoo.in>:Hi Dor,

It would be good if the latest package is added to the upcoming version of ubuntu. One thing I notice is that you are running the lts version of ubuntu and as far as I understand the packages are slowly updated based on the stability of the packages and their impact to the os stability.

I am not sure if the latest package is available in 15.04 but you should be able to install the latest package from a deb package. I found a link to it in launchpad https://launchpad.net/~wallch/+archive/ubuntu/wallch-daily/+build/7835152/+files/wallch_4.187-0~211~ubuntu14.04.1_amd64.deb

Thanks

On Sep 4, 2015 9:31 PM, Dor <dor9990@gmail.com> wrote:
>
> Hi,
>
> I would like to ask the Ubuntu developers team to include the recent version of "wallch" in the next release of Ubuntu.
>
> My version of Ubuntu is:
> Ubuntu 14.04.3 LTS
>
> The version of "wallch" in Ubuntu software center (which I installed):
> wallch 4.0-0ubuntu4
>
> The recent version of "wallch" is:
> 4.187-0~213~ubuntu14.04.1
>
> This email was sent to you due to the following thread:
> http://ubuntuforums.org/showthread.php?t=2293348=13350049
>
> I'm asking to include the latest version of "wallch" because of the following bug, which I reported:
> https://bugs.launchpad.net/wallpaper-changer/+bug/1492179
>
> Thank you!
>
> Please someone reply to me so I would know that you received it.
>
> Regards,
> Dor.
>
>

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Re: Updating "wallch" in the next Ubuntu release

[Rajeev Bhatta]

Hi Dor, 

It would be good if the latest package is added to the upcoming version of 
ubuntu. One thing I notice is that you are running the lts version of ubuntu 
and as far as I understand the packages are slowly updated based on the 
stability of the packages and their impact to the os stability. 

I am not sure if the latest package is available in 15.04 but you should be 
able to install the latest package from a deb package. I found a link to it in 
launchpad 
https://launchpad.net/~wallch/+archive/ubuntu/wallch-daily/+build/7835152/+files/wallch_4.187-0~211~ubuntu14.04.1_amd64.deb
 

Thanks

On Sep 4, 2015 9:31 PM, Dor  wrote:
>
> Hi,
>
> I would like to ask the Ubuntu developers team to include the recent version 
> of "wallch" in the next release of Ubuntu.
>
> My version of Ubuntu is:
> Ubuntu 14.04.3 LTS
>
> The version of "wallch" in Ubuntu software center (which I installed):
> wallch 4.0-0ubuntu4
>
> The recent version of "wallch" is:
> 4.187-0~213~ubuntu14.04.1
>
> This email was sent to you due to the following thread:
> http://ubuntuforums.org/showthread.php?t=2293348=13350049
>
> I'm asking to include the latest version of "wallch" because of the following 
> bug, which I reported:
> https://bugs.launchpad.net/wallpaper-changer/+bug/1492179
>
> Thank you!
>
> Please someone reply to me so I would know that you received it.
>
> Regards,
> Dor.
>
>
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Ubuntu Release Sprint

[Rajeev Bhatta]

I think this is a great idea...

I am not very active in the group but this gives me an opportunity to be
part of the project and start contributing in any fashion I can.. I think
the community IRC support is great but probably we can use the google+
hangouts for that too as we can also share our desktops or documents.. it
makes support more social and personal, and also I think we can engage new
users much better. Using social networks will help market the great world
of open source and linux to a larger audience.

Just my 2 cents on the subject.

Thanks

Rajeev Bhatta
On Aug 16, 2012 11:31 AM, a.gra...@gmail.com javascript:_e({}, 'cvml',
'a.gra...@gmail.com'); a.gra...@gmail.com javascript:_e({}, 'cvml',
'a.gra...@gmail.com'); wrote:

 Hi,

 during the last UDS party, I had an idea to improve Ubuntu
 development, but I didn't know if it could be a good idea or a stupid
 one, so I talked to Daniel Holbach and David Planella about it and
 they were happy to hear about it and Daniel told me to talk about this
 directly to Mark (and I did it).

 Let's explain the basic idea.

 From an UDS and the next one, it would be useful to have a development
 sprint where people can talk about assigned UDS blueprints, at which
 point they are on their tasks, if they have any problems and if they
 will finish them within the next UDS.

 Of course Canonical cannot organize another meeting, it would be very
 expensive, so the idea is: why don't we use Google Hangout to organize
 the sprint? I has a limit of 10 people, I know, but we could select
 (for example) 5 from the community and 5 from Canonical. There would
 be parallel meeting and tracks, we would use the same blueprints used
 during the last UDS and we would add further notes. The attendees
 would be able to listen and watch the stream and make questions
 through the available chat.

 I've also created a wiki page with more informations and you can find
 it here: https://wiki.ubuntu.com/UbuntuReleaseSprint

 What do you think about? I know that Canonical is already organizing
 sprints and this could be a way to involve more the Ubuntu Community.

 Maybe we should schedule a session at next UDS to talk about this?

 I hope to get some feedback from you.

 Best regards,

 --
 Andrea Grandi - Nokia-DX/Tampere / Qt Ambassador
 Ubuntu Member: https://launchpad.net/~andreagrandi
 website: http://www.andreagrandi.it

 --
 ubuntu-devel mailing list
 ubuntu-devel@lists.ubuntu.com javascript:_e({}, 'cvml',
 'ubuntu-devel@lists.ubuntu.com');
 Modify settings or unsubscribe at:
 https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel



-- 
*
Rajeev Bhatta | Email: rajeev.bha...@gmail.com | Ph: (704) 759-6413
-- Connect with


*
-- 
ubuntu-devel mailing list
ubuntu-devel@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel