Bug#1029942: ITP: python-lua -- library for using Lua scripts from Python

2023-01-29 Thread Bas Wijnen
Package: wnpp Severity: wishlist Owner: Bas Wijnen X-Debbugs-Cc: debian-devel@lists.debian.org, wij...@debian.org * Package name: python-lua Version : 0.4 Upstream Contact: Bas Wijnen * URL : https://github.com/wijnen/python-lua * License : AGPL3

Re: Bug#1010013: ITP: python-websocketd -- Python module for creating a http server which uses WebSockets

2022-04-22 Thread Bas Wijnen
Hi, On Fri, Apr 22, 2022 at 05:56:08PM +0200, Andrej Shadura wrote: > I don’t want to discourage you from packaging this, but unless I’m mistaken, > this will be at least the third Websocket client package for Python, and at > least the third Websocket server in Python 🙂 Yes, I'm not surprised. I

Bug#1010013: ITP: python-websocketd -- Python module for creating a http server which uses WebSockets

2022-04-22 Thread Bas Wijnen
Package: wnpp Severity: wishlist Owner: Bas Wijnen X-Debbugs-Cc: debian-devel@lists.debian.org, wij...@debian.org * Package name: python-websocketd Version : 0.2 Upstream Author : Bas Wijnen * URL : https://github.com/wijnen/python-websocketd * License

Bug#1010012: ITP: python-network -- Python module for easy networking

2022-04-22 Thread Bas Wijnen
Package: wnpp Severity: wishlist Owner: Bas Wijnen X-Debbugs-Cc: debian-devel@lists.debian.org, wij...@debian.org * Package name: python-network Version : 0.2 Upstream Author : Bas Wijnen * URL : https://github.com/wijnen/python-network * License : AGPL3

Bug#1010010: ITP: python-fhs -- Python module for using the FHS and XDG basedir paths.

2022-04-22 Thread Bas Wijnen
Package: wnpp Severity: wishlist Owner: Bas Wijnen X-Debbugs-Cc: debian-devel@lists.debian.org, wij...@debian.org * Package name: python-fhs Version : 1.0 Upstream Author : Bas Wijnen * URL : https://github.com/wijnen/python-fhs * License : AGPL3

Bug#930723: ITP: arduino-sanguino -- atmega644 files for use with Arduino

2019-06-19 Thread Bas Wijnen
Package: wnpp Severity: wishlist Owner: 3-D printer team <3dprinter-gene...@alioth-lists.debian.net> * Package name: arduino-sanguino Version : 1.0.0 Upstream Author : Kristian Sloth Lauszus * URL : http://lauszus.github.io/Sanguino/ * License : GPL-3+ Progra

Re: Why do we list individual copyright holders?

2018-01-01 Thread Dr. Bas Wijnen
On Mon, Jan 01, 2018 at 07:43:06PM +0100, Vincent Bernat wrote: > ❦ 1 janvier 2018 17:47 +0100, Jonas Smedegaard  : > > >> I have very little time for Debian. Each time I update a package, I have > >> to bump Standards-Version and fix new Lintian warnings. I would > >> appreciate if we would ass

Re: salsa.debian.org (git.debian.org replacement) going into beta

2017-12-29 Thread Dr. Bas Wijnen
On Fri, Dec 29, 2017 at 10:43:58PM +0100, Alexander Wirt wrote: > On Fri, 29 Dec 2017, Philipp Kern wrote: > > Put a mapping into a git repository that DDs can push to? Make sure that > > it is fast-forwarded always? Then let people deal with it? > I am currently working on such a mapping. I appr

Re: ISO download difficult (was: Debian Stretch new user report (vs Linux Mint))

2017-12-29 Thread Dr. Bas Wijnen
On Fri, Dec 29, 2017 at 07:18:57PM +0100, Adam Borowski wrote: > On Fri, Dec 29, 2017 at 05:57:21PM +, Dr. Bas Wijnen wrote: > > So we need to decide what we want. I think there probably is consensus > > about: > > > > - We want people with non-free hardware to

Re: ISO download difficult (was: Debian Stretch new user report (vs Linux Mint))

2017-12-29 Thread Dr. Bas Wijnen
On Thu, Dec 28, 2017 at 10:13:52AM +0500, Andrey Rahmatullin wrote: > On Wed, Dec 27, 2017 at 11:00:38PM +0100, Toni Mueller wrote: > > they will most likely simply not understand the point, and what makes > > free hardware so much better. > > > massively encourage users to use non-free hardware

Re: Whether remotely running software is considered "software" for Debian.

2017-08-31 Thread Dr. Bas Wijnen
On Thu, Aug 31, 2017 at 11:16:36AM +0200, Ansgar Burchardt wrote: > python-digitalocean, ruby-azure*, waagent, twittering-mode, > probably HBCI clients, python3-googleapi, > python3-pyicloud, python-yowsup, youtube-dl, > libgfbgraph-0.2-dev Thank you for this list. I removed servers that cannot r

Re: Whether remotely running software is considered "software" for Debian.

2017-08-31 Thread Dr. Bas Wijnen
On Mon, Aug 28, 2017 at 09:15:01AM -0400, The Wanderer wrote: > On 2017-08-28 at 07:59, Dr. Bas Wijnen wrote: > > I think if someone wants to write a client with the purpose of > > interacting with a non-free service, that client should go in contrib > > and there is nothin

Re: Whether remotely running software is considered "software" for Debian.

2017-08-28 Thread Dr. Bas Wijnen
Thanks Philipp, unlike the mail I responded to a few minutes ago, yours is constructive and I'm happy to continue discussing this with you. On Mon, Aug 28, 2017 at 12:31:15PM +0200, Philipp Kern wrote: > On 08/27/2017 12:20 PM, Dr. Bas Wijnen wrote: > > On Sat, Aug 19, 2017 at 06

Re: Whether remotely running software is considered "software" for Debian.

2017-08-28 Thread Dr. Bas Wijnen
I'm getting tired of this. You keep avoiding my questions and changing the subject. Unless you start answering my questions, I'm going to stop responding. On Mon, Aug 28, 2017 at 02:21:01PM +0500, Andrey Rahmatullin wrote: > On Mon, Aug 28, 2017 at 08:55:43AM +0000, Dr. Bas

Re: Whether remotely running software is considered "software" for Debian.

2017-08-28 Thread Dr. Bas Wijnen
On Mon, Aug 28, 2017 at 12:29:07PM +0500, Andrey Rahmatullin wrote: > On Mon, Aug 28, 2017 at 06:58:50AM +, Dr. Bas Wijnen wrote: > > Are you saying that a Debian system where only main is enabled is unsafe? > [...] > > If that is correct, it is a huge problem that that is

Re: Whether remotely running software is considered "software" for Debian.

2017-08-28 Thread Dr. Bas Wijnen
On Sun, Aug 27, 2017 at 04:00:54PM +0500, Andrey Rahmatullin wrote: > On Sun, Aug 27, 2017 at 10:20:27AM +, Dr. Bas Wijnen wrote: > > Let me put it differently then: for me, one of the major benefits of Debian > > over (most of) our derivatives is that I can set the system u

Re: Whether remotely running software is considered "software" for Debian.

2017-08-27 Thread Dr. Bas Wijnen
On Sat, Aug 19, 2017 at 06:21:23PM +0200, Philipp Kern wrote: > On 08/18/2017 10:36 AM, Dr. Bas Wijnen wrote: > > Consider the following: unrar-nonfree contains some software which is > > non-free > > and can therefore not be in main. The reason we don't put it in mai

Re: Whether remotely running software is considered "software" for Debian.

2017-08-18 Thread Dr. Bas Wijnen
On Tue, Aug 15, 2017 at 08:46:43AM +1000, Ben Finney wrote: > The language is clear that it is talking about dependency in the sense > of requiring the program installed on the system in order for the > program to build or execute. I think the mention of package dependencies is an incomplete list

Re: Whether remotely running software is considered "software" for Debian.

2017-08-14 Thread Dr. Bas Wijnen
On Mon, Aug 14, 2017 at 08:58:00AM +1000, Ben Finney wrote: > "Dr. Bas Wijnen" writes: > > > What seems to be the dispute is whether software that runs on a remote > > system is still "software" for the purpose of our rules. > > That is not in disp

Whether remotely running software is considered "software" for Debian.

2017-08-12 Thread Dr. Bas Wijnen
Note: this post is not about certspotter at all, so I'm not Cc'ing the bug and changed the Subject line. On Wed, Aug 09, 2017 at 05:30:19PM -0400, Jonas Smedegaard wrote: > Stuff like s3cmd are tools connecting to cloud services. Arguably > usable to have tools to free data from the clouds. Whi

Re: Let's enable AppArmor by default (why not?)

2017-08-06 Thread Dr. Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, Aug 05, 2017 at 06:28:20PM +0200, Christoph Biedl wrote: > intrigeri wrote... > > > tl;dr: I hereby propose we enable AppArmor by default in testing/sid, > > and decide one year later if we want to keep it this way in the > > Buster release. >

Re: [Pkg-dns-devel] Bug#833309: "Browserified" stuff (knot-resolver-module-http: please package embedded epoch.js separately)

2016-10-24 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, Oct 21, 2016 at 07:26:43AM +0200, Vincent Bernat wrote: > It would be as easy for the security team to modify the unminified version > than the "upper" upstream version of the source. The release team has just decided that "browserified" files

Re: [Pkg-dns-devel] Bug#833309: "Browserified" stuff (knot-resolver-module-http: please package embedded epoch.js separately)

2016-10-20 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Oct 19, 2016 at 09:07:26AM +0200, Vincent Bernat wrote: > gulp is just a glorified make and doesn't compile anything on its own. If make wouldn't be in main, any program using it in its build process would also not be allowed in main. The opt

Re: [Pkg-dns-devel] Bug#833309: "Browserified" stuff (knot-resolver-module-http: please package embedded epoch.js separately)

2016-10-14 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, Oct 14, 2016 at 10:49:06AM +0200, W. Martin Borgert wrote: > On 2016-10-13 22:39, Joerg Jaspert wrote: > > On 14458 March 1977, W. Martin Borgert wrote: > > > If I package a compiler and put y.tab.c in the package, drop > > > grammar.y in d/m-s

Re: [Pkg-dns-devel] Bug#833309: "Browserified" stuff (knot-resolver-module-http: please package embedded epoch.js separately)

2016-10-12 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Oct 12, 2016 at 10:09:12PM +0200, Martín Ferrari wrote: > On 12/10/16 21:41, Vincent Bernat wrote: > >> I don't think that shipping a binary compiled upstream should be > >> allowed, so where's the line drawn? Technically it would be allowed,

Re: "Browserified" stuff

2016-10-10 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Oct 10, 2016 at 03:08:17PM +0200, Martín Ferrari wrote: > Prometheus being in contrib basically means the work I have done for the > past year is worthless, as users could as well just grab unofficial > packages from other places. I am not sayi

Re[2]: Browserified files and DFSG

2016-07-11 Thread Bas Wijnen
July 11 2016 9:57 AM, "Pirate Praveen" wrote: >> Yet it is built with a tool not in Debian, from a different form of the >> work that upstream actually uses for reading and modifying — the source >> form of the work. So that compiled form is not the source form of the >> work. > > There is a rea

Re: using whiptail and translated strings from arbitrary scripts

2016-04-27 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Apr 27, 2016 at 02:28:22PM +0200, Daniel Pocock wrote: > If I use this method, can the strings be translated easily by the > Debian translators just like the strings for po-debconf/maintainer > scripts? > > Or is there some additional Debian-s

Re: Packaging of static libraries

2016-04-19 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Apr 19, 2016 at 10:13:28PM +0200, Vincent Danjean wrote: > The initial argument was: > > We in Debian are in a good position to defend our users from the > > fallout from this problem. We could change our default compiler > > options to favour

Re: Packaging of static libraries

2016-04-19 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, Apr 14, 2016 at 02:57:00PM +0200, Vincent Danjean wrote: > > If users have such specialized needs, I think it is not only reasonable that > > they build their own versions of their libraries; I expect them to prefer > > that. > > So we should

Re: Packaging of static libraries

2016-04-13 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Apr 13, 2016 at 05:17:54PM +0200, Marco d'Itri wrote: > On Apr 13, Ian Jackson wrote: > > We in Debian are in a good position to defend our users from the > > fallout from this problem. We could change our default compiler > > options to favo

Re: Packaging of static libraries

2016-04-11 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Apr 11, 2016 at 03:25:46PM +0900, Mike Hommey wrote: > > What uses require PIC static libraries that cannot be satisfied by building > > -static --whole-archive ? > > https://wiki.debian.org/Hardening#DEB_BUILD_HARDENING_PIE_.28gcc.2Fg.2B-.2B-

Re: Packaging of static libraries

2016-04-10 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Apr 10, 2016 at 09:06:50PM +0500, Andrey Rahmatullin wrote: > On Sun, Apr 10, 2016 at 05:57:16PM +0200, Andreas Tille wrote: > > > > whether it is advisable to try hard to provide static libraries even if > > > > upstream build system does not

Re: Mass Bug Filing: Missing Build-Depends: graphviz

2016-03-22 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Mar 22, 2016 at 09:26:45PM +0100, Santiago Vila wrote: > I think the issue is not really whether HAVE_DOT=yes is good or not > in general, but whether this is an issue that should be decided on a > per package basis or not. I agree, that is wh

Re: Mass Bug Filing: Missing Build-Depends: graphviz

2016-03-22 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Mar 22, 2016 at 05:04:50PM +0100, Santiago Vila wrote: > So the number of affected packages if the default HAVE_DOT is changed > to "no" would be quite low. > > If, instead, doxygen is changed to depend on graphviz, there would be > nothing to

Re: Bug#818900: [Lua Policy] integrate debian's lua modules into Debian's Luarocks

2016-03-21 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Mar 21, 2016 at 02:37:44PM +, lumin wrote: > When I'm dealing with one of my ITP's I found that this is > a noticeable problem to Debian's lua packages. And I think > this may require some changes to our lua policy, or the dh-lua > scripts.

Re: Mass Bug Filing: Missing Build-Depends: graphviz

2016-03-21 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Mar 21, 2016 at 11:26:16AM +0100, Santiago Vila wrote: > > Yes, so that's a bug in those programs, not in doxygen. It would be > > "fixed" by > > adding graphviz as a Depends to doxygen, but that would be incorrect. > > Please note that it i

Re: Mass Bug Filing: Missing Build-Depends: graphviz

2016-03-20 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Mar 20, 2016 at 08:07:55PM +0100, Adam Borowski wrote: > On Sun, Mar 20, 2016 at 06:51:23PM +0000, Bas Wijnen wrote: > > That also means that programs calling dot will need graphviz in their > > Build-Depends, no matter what

Re: Mass Bug Filing: Missing Build-Depends: graphviz

2016-03-20 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I think you are mistaken about a few things. On Sun, Mar 20, 2016 at 06:04:55PM +0100, Santiago Vila wrote: > The maintainer points out that the default value for HAVE_DOT is NO, > so he's reluctant to add the build-dependency. If the program can be

Re: How to deal with "assets" packages shadowing real upstream

2016-03-09 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Mar 09, 2016 at 11:37:12AM +0100, IOhannes m zmölnig (Debian/GNU) wrote: > i think that §4.13 does not cover the original issue of jonas at all, as > it's about something different: using convenience copies instead of the > system provided pack

Re: How to deal with "assets" packages shadowing real upstream

2016-03-08 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Mar 08, 2016 at 02:14:10PM +, Jonathan Dowland wrote: > On Fri, Feb 26, 2016 at 07:59:29PM +0100, Jonas Smedegaard wrote: > > I personally feel it is a bug to not track the true upstream of a > > project, but that seems not part of our Pol

Re: How to deal with "assets" packages shadowing real upstream

2016-03-08 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Mar 07, 2016 at 03:12:10PM +0100, Jonas Smedegaard wrote: > Oh - I just discovered that this _is_ covered by Policy §4.13 already. Reading that again, I see that it says code copies are acceptable if the code is meant to be used that way (with

Re: Can "PDB" license be considered free ?

2016-03-07 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Mar 07, 2016 at 04:38:55PM -0600, Don Armstrong wrote: > On Mon, 07 Mar 2016, Peter Rice wrote: > > The conclusion was that scientific data (SwissProt, PDB, etc.) are > > scientific facts and it is not reasonable to require permission to > > ch

Re: HTTPS in DEP-5

2016-03-06 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Mar 06, 2016 at 08:13:49PM +, Ben Hutchings wrote: > On Sun, 2016-03-06 at 19:19 +0000, Bas Wijnen wrote: > > On Sun, Mar 06, 2016 at 07:35:57PM +0100, Jakub Wilk wrote: > > > > > > So, what we're going to

Re: HTTPS in DEP-5

2016-03-06 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Mar 06, 2016 at 07:35:57PM +0100, Jakub Wilk wrote: > So, what we're going to do about it? I see the following options: > > B) Fix the spec to allow the HTTPS URL; fix the HTTP-only consumers. That. Https is good for our users. Even if the

Re: Making Debian ports less burdensome

2016-02-26 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, On Fri, Feb 26, 2016 at 09:02:48PM +, Steven Chamberlain wrote: > > Removing the package from the breaking port is an option, and it > > should be easy to trigger, but it should not be automatic. If we make > > the process easy and the mainta

Re: How to deal with "assets" packages shadowing real upstream

2016-02-26 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, On Fri, Feb 26, 2016 at 07:59:29PM +0100, Jonas Smedegaard wrote: > Do we favor tracking the true upstreams when packaging for Debian? There was some discussion about this on the list recently, but this is a question that didn't really come up, A

Re: Making Debian ports less burdensome

2016-02-26 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I like your suggestions in general, but am a bit worried about the results of this: On Thu, Feb 25, 2016 at 05:41:57PM +, Steven Chamberlain wrote: > * If left unfixed, the bugs should trigger an auto-removal from > unstable so that the

Re: another mount issue on jessie

2016-02-09 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Feb 09, 2016 at 10:38:26AM -0700, Sebastian Kuzminsky wrote: > On another Jessie machine I had to apply the same workaround to some > additional services. I identified the services that needed the workaround > by grepping for 'PrivateTmp' in /

Re: chromium disabling use of shared libs, BoringSSL

2016-02-09 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Thanks for pursuing this, Daniel, and for being civil while doing so. On Tue, Feb 09, 2016 at 05:47:46PM +0100, Daniel Pocock wrote: > Chromium upstream are keen to discourage use of shared libraries on the > system and encourage packagers to bundle t

Re: Statically linked library in libdevel packages? (Was: Status of teem package (packaging moved from svn to git))

2016-01-29 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, Jan 29, 2016 at 06:03:26PM +0100, Dimitri John Ledkov wrote: > Imho, if static libraries, are shipped we should be conservative about > them (e.g. do it pretty much for libc only to compile minimal > freestanding bootloaders and that's about it

Re: Statically linked library in libdevel packages? (Was: Status of teem package (packaging moved from svn to git))

2016-01-28 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, Jan 28, 2016 at 01:38:11PM +, Ian Jackson wrote: > Andreas Tille writes ("Statically linked library in libdevel packages? (Was: > Status of teem package (packaging moved from svn to git))"): > > I came across this question since policy say

Re: Libre graphics could become the standard if we push right now

2016-01-19 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Jan 19, 2016 at 06:57:43PM +0100, gaffa wrote: > It's an MIT license: > > https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/firmware/WHENCE#n758 That's a fine license as far as the DFSG is concerned, but as long as the

Re: support for merged /usr in Debian

2016-01-16 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, Jan 16, 2016 at 04:09:00PM +0100, Marc Haber wrote: > It would help to be friendly to each other. No CoC needed by that, > it's just basic common sense. The meaning of "friendly" and "common sense" is different for different people. If you wri

Defaults and virtual package rules (was: default softphone in Debian stretch)

2016-01-16 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, Jan 16, 2016 at 01:48:46PM +0100, Daniel Pocock wrote: > On 15/01/16 14:20, Bas Wijnen wrote: > > On Fri, Jan 15, 2016 at 11:08:35AM +0100, Daniel Pocock wrote: > >> On 15/01/16 04:00, Paul Wise wrote: > >>> O

Re: default softphone in Debian stretch

2016-01-15 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, Jan 15, 2016 at 11:08:35AM +0100, Daniel Pocock wrote: > > > On 15/01/16 04:00, Paul Wise wrote: > > On Tue, Jan 12, 2016 at 5:42 PM, Daniel Pocock wrote: > > > >> default softphone in Debian[1] > > > > It should be up to the user what comm

Re: Going ahead with non-free-firmware

2016-01-10 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Jan 10, 2016 at 02:09:24AM +0100, Philippe Cerfon wrote: > On Sun, Jan 10, 2016 at 1:11 AM, Josh Triplett wrote: > > They will if people care as much about that separation as they do about > > separating firmware. > > Which effectively still

Bug#809705: general: let people use non-free software but opt-out of non-open software

2016-01-04 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Jan 04, 2016 at 07:45:37AM +, Niels Thykier wrote: > Philippe Cerfon: > > On Sun, Jan 3, 2016 at 7:35 AM, Christian PERRIER > > wrote: > >> Discussing infrastructure changes like what you're proposing (which I > >> have no advice about) s

Re: Security concerns with minified javascript code

2015-09-03 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, Sep 03, 2015 at 08:47:11AM +0200, Vincent Bernat wrote: > Without minification, we'll just ship packages that people won't > use. Why would I run a crippled installation of Wordpress that will > drive of part of my users to another competitor?

Re: Security concerns with minified javascript code

2015-09-02 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Sep 02, 2015 at 07:33:10PM +0100, Neil Williams wrote: > On Wed, 2 Sep 2015 13:33:57 -0400 > Marvin Renich wrote: > > > * Ben Hutchings [150902 10:12]: > > > My preferred form is a git repository of code written in C, Python, > > > or some o

Re: Security concerns with minified javascript code

2015-08-31 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Aug 31, 2015 at 08:49:53AM +0200, Raphael Hertzog wrote: > On Sun, 30 Aug 2015, Bas Wijnen wrote: > > Why do you care that software is in main, if you evidently do not care about > > any of the rules we have for it? > &g

Re: Security concerns with minified javascript code

2015-08-30 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Aug 30, 2015 at 02:12:43PM +0200, Vincent Bernat wrote: > This is becoming quite a stretch. At this rate, we will fail to match > SC#2 because we ship previous versions of software and upstream is > unlikely to accept a patch against a non-curr

Re: Security concerns with minified javascript code

2015-08-30 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Aug 30, 2015 at 10:14:13AM +0200, Vincent Bernat wrote: > The build script determines the outcome of what will effectively run on > our users' machine. I fail to see how this is not an important > issue. You are correct, this is important. >

Re: Summary of the DebConf firmware discussion

2015-08-29 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 First of all, thanks for having this discussion. I think it is a serious problem. Debian is currently hard to install on many machines, and I very much dislike the idea of telling people to enable all of non-free because of some hardware. Installing

Re: Security concerns with minified javascript code

2015-08-27 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, Aug 27, 2015 at 04:14:53PM -0700, Russ Allbery wrote: > Bas Wijnen writes: > > > On the other hand, shipping packages that cannot be rebuilt with tools > > from Debian will also result in angry users. For me personal

Re: Security concerns with minified javascript code

2015-08-27 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Aug 26, 2015 at 07:35:01AM +0200, Vincent Bernat wrote: > ❦ 25 août 2015 22:37 GMT, Bas Wijnen  : > > >> We need to leave the Javascript ecosystem mature a bit more but in the > >> meantime, a bit of tolera

Re: Security concerns with minified javascript code

2015-08-25 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Aug 25, 2015 at 11:13:15PM +0200, Vincent Bernat wrote: > ❦ 25 août 2015 17:58 GMT, Bas Wijnen  : > > > I don't see why javascript minification would be different from C > > compilation > > in a way that wou

Re: Security concerns with minified javascript code

2015-08-25 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Aug 25, 2015 at 07:08:06PM +0100, Ian Jackson wrote: > Bas Wijnen writes ("Re: Security concerns with minified javascript code"): > > AFAIK Debian doesn't *require* generated files to be rebuilt. For > > example,

Re: Security concerns with minified javascript code

2015-08-25 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Aug 25, 2015 at 07:17:12PM +0200, Jonas Smedegaard wrote: > Quoting Scott Kitterman (2015-08-25 17:57:11) > > AFAIK we've only ever discussed the need to provide source. I don't > > know why there would be a requirement to reminify. > > I se

Re: certificate creation in postinst, potentially using letsencrypt script

2015-08-02 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Aug 02, 2015 at 05:44:06PM +0200, Christoph Anton Mitterer wrote: > Some ideas that pop up in my mind: > - Would be yet another location of privacy leak in Debian, where the > system automatically calls "home" to some more commercial than > com

Re: Packaging certain libraries as "end-user software"

2015-07-20 Thread Bas Wijnen
On Sun, Jul 19, 2015 at 11:06:45AM +0200, Eduard Bloch wrote: > > > It's less of a library than an environment used for research. Compiling > > > is just a required step to run your code, but applications are usually > > > not distributed in binary form. > > > > What is the benefit of providing a

Re: Packaging certain libraries as "end-user software"

2015-07-18 Thread Bas Wijnen
On Fri, Jul 17, 2015 at 05:30:04PM +0200, Ansgar Burchardt wrote: > It's less of a library than an environment used for research. Compiling > is just a required step to run your code, but applications are usually > not distributed in binary form. What is the benefit of providing a shared library a

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Bas Wijnen
Hi, On Thu, Jul 16, 2015 at 06:00:17PM +0200, Simon Richter wrote: > Am 16.07.2015 um 16:57 schrieb Don Armstrong: > > How easy would it be to modify the code so that it only gets the > > favorite icons when the site is actually visited? [Does it already try > > to update the icons when it visits

Re: The Spirit of Free Software, or The Reality

2015-07-15 Thread Bas Wijnen
On Wed, Jul 15, 2015 at 07:56:42PM +0100, Ian Jackson wrote: > Right. I find it disappointing to discover that in Debian we have > deliberately modified Iceweasl to make this problem worse, even if > only in a modest way. ... > And one thing we could easily do (well, easily from a technical point

Re: The Spirit of Free Software, or The Reality

2015-07-15 Thread Bas Wijnen
On Wed, Jul 15, 2015 at 01:26:16PM +0900, Mike Hommey wrote: > On Wed, Jul 15, 2015 at 03:51:42AM +0200, Bas Wijnen wrote: > > On Wed, Jul 15, 2015 at 01:06:28AM +0200, Jakub Wilk wrote: > > > POST > > > https://safebrowsing.google.com/safebrowsing/downloads?client=I

Re: The Spirit of Free Software, or The Reality

2015-07-14 Thread Bas Wijnen
On Wed, Jul 15, 2015 at 01:06:28AM +0200, Jakub Wilk wrote: > POST > https://safebrowsing.google.com/safebrowsing/downloads?client=Iceweasel&appver=38.1.0&pver=2.2&key=no-google-api-key > + a few dozens of GET requests to https://safebrowsing.google.com/ > > So nothing serious here. It's just cas

Re: The Spirit of Free Software, or The Reality

2015-07-14 Thread Bas Wijnen
On Tue, Jul 14, 2015 at 04:21:07PM +0200, Wouter Verhelst wrote: > On Mon, Jul 06, 2015 at 02:10:08PM +0800, Paul Wise wrote: > > Perhaps we could run everything in $PATH in virtual machines and log > > all network beyond localhost. > > I look forward to not reading your emails anymore ;-P > > (o

Re: Cluebat needed: Proper way to reference MathJax.js

2015-07-14 Thread Bas Wijnen
On Tue, Jul 14, 2015 at 05:56:56AM -0500, Dirk Eddelbuettel wrote: > | Can't you make a link in the directory of the file referencing it and use > | a non-absolute path, i.e. src="MathJax.js"? That should work both locally > and > | through a browser without any configuration, right? (Except tha

Re: Cluebat needed: Proper way to reference MathJax.js

2015-07-13 Thread Bas Wijnen
On Mon, Jul 13, 2015 at 08:01:48PM -0500, Dirk Eddelbuettel wrote: > | To make it work only when served by a webbrowser, use this: > | > | > > I think this is what I had in mind, thanks! > > | ...and make sure javascript-common is installed and in use by the > | web-server (all libjs-* pack

Re: Packaging certain libraries as "end-user software"

2015-07-09 Thread Bas Wijnen
Hi, On Thu, Jul 09, 2015 at 05:26:32PM +0200, Ansgar Burchardt wrote: > I'm wondering about the shared library packaging requirements in Policy > for the special case of scientific libraries that are not intended to be > used by applications, but are to be used by end-users directly, What does "t

Re: About the TC vote on libpam-systemd

2014-11-19 Thread Bas Wijnen
Hi, On Wed, Nov 19, 2014 at 12:40:00AM -0800, Keith Packard wrote: > > I'd like to apologize to the systemd maintainer team, and to Tollef in > particular for my TC vote on the libpam-systemd bug. > > The discussion on this issue was an excellent model of the Debian > community at work: Thank y

Re: debconf as a registry

2014-10-17 Thread Bas Wijnen
On Fri, Oct 17, 2014 at 03:51:04PM +0800, Thomas Goirand wrote: > On 10/17/2014 01:41 PM, Bas Wijnen wrote: > > Getting random packages from apt-cache rdepends debconf shows: > > > > - several packages that use debconf for questions that are only about > > actions

Re: debconf as a registry

2014-10-16 Thread Bas Wijnen
On Fri, Oct 17, 2014 at 12:37:27PM +0800, Thomas Goirand wrote: > On 10/17/2014 04:34 AM, Bas Wijnen wrote: > > So debconf needs to read configuration files, but it doesn't know how to > > parse them. So it does the only thing it can: it uses its cache. Which > >

Re: debconf as a registry

2014-10-16 Thread Bas Wijnen
nd it is the first ever perl program I wrote. So please don't insult me, but also don't hold back when you see things that need to be improved. :-) Thanks, Bas On Tue, Nov 26, 2013 at 06:16:19PM -0800, Russ Allbery wrote: > Bas Wijnen writes: > > > What this means, is tha

Re: apt-get install sysvinit-core removes gnome?

2014-10-16 Thread Bas Wijnen
On Thu, Oct 16, 2014 at 05:35:09PM +0100, Martin Read wrote: > mormegil@cocytus:~$ cat /etc/apt/apt.conf.d/00dontbeanidiot > Aptitude::ProblemResolver { > SolutionCost "priority, removals, canceled-actions"; > } That looks very useful, thanks! Bas signature.asc Description: Digital signature

Re: Any news about Blends in tasks selection (Was: Debian Installer Jessie Beta 2 release)

2014-10-16 Thread Bas Wijnen
Hello, On Thu, Oct 16, 2014 at 08:47:19AM +0200, Andreas Tille wrote: > > Would this use case also be a reason for creating a personal blend? Or > > even an official one? > > Jonas has answered this question. I'd like to add that I'm no fan of > "personal" things since you spoil the idea of for

Re: Any news about Blends in tasks selection (Was: Debian Installer Jessie Beta 2 release)

2014-10-15 Thread Bas Wijnen
Hi, On Wed, Oct 15, 2014 at 09:31:36AM +0200, Andreas Tille wrote: > You belong to a majority if I might conclude from my experience. I have > no idea whether I should feel responsible for this but I'm fighting on > several fronts like the extensive documentation[1] and countless > talks[2] as we

Re: Any news about Blends in tasks selection (Was: Debian Installer Jessie Beta 2 release)

2014-10-14 Thread Bas Wijnen
On Tue, Oct 14, 2014 at 11:20:02AM +0200, Andreas Tille wrote: > I admit I expected *you* to know about Blends for a while - but > considering the video recorded quote I think I was not wrong using this > chance to point this out for other readers of this mail as it is really > a fact that I always

Re: piece of mind (Re: Moderated posts?)

2014-10-12 Thread Bas Wijnen
[Moving this to -project, where it belongs; please follow up only there, not on -user or -devel.] On Sun, Oct 12, 2014 at 06:18:01PM +0200, lee wrote: > Why doesn't Debian just do a GR on this issue? Because for a GR, a member of Debian has to request it and it needs to be seconded by at least 5

Re: what free software is about/and supporting nonfree?, maybe add to clause 5?

2014-10-12 Thread Bas Wijnen
On Sun, Oct 12, 2014 at 04:33:46AM +0200, Michael Ole Olsen wrote: > there is nothing wrong with urging people to reconsider if non-free is > really what they want +1. > We shouldn't even be supporting non-free by hosting it, yet we do That is not our reason for hosting it. We are hosting it to

Re: systemd-fsck?

2014-05-12 Thread Bas Wijnen
On Mon, May 12, 2014 at 07:01:14PM -0700, Russ Allbery wrote: > Dependency-based boot, the change to /bin/sh, and UUID-based mounting were > all not drop-in replacements by that criteria. Note that also none of them were forced on existing installations. The change of /bin/sh to dash (which is wh

Re: systemd-fsck?

2014-05-12 Thread Bas Wijnen
On Mon, May 12, 2014 at 11:21:15AM -0700, Josh Triplett wrote: > > In other words: what isn't handled properly? What should happen, and what > > does > > happen? > > Consider a system which has systemd installed, systemd-sysv *not* installed, > and systemd used as PID 1 via init=/bin/systemd. S

Re: systemd-fsck?

2014-05-12 Thread Bas Wijnen
On Mon, May 12, 2014 at 09:19:40AM -0700, Josh Triplett wrote: > Having libpam-systemd depend on "systemd-shim | systemd-sysv" will not > properly > handle systems that already have systemd installed but not systemd-sysv. I don't think I understand what you mean. What does "having systemd instal

Re: systemd-fsck?

2014-05-12 Thread Bas Wijnen
On Mon, May 12, 2014 at 11:54:43AM +0200, Josselin Mouette wrote: > Systemd is the default init system for jessie, and it should be listed > as the first alternative. Can you please explain what is wrong with my reasoning? A default is only relevant at the time the functionality is first installe

Re: systemd pulled in automatically

2014-05-11 Thread Bas Wijnen
On Sun, May 11, 2014 at 08:20:33PM +0200, Svante Signell wrote: > Can we please separate the bugs in this thread: This one is about > dirnmgr not network-manager and gdm3 dragging in systemd as init > default, #747535. Speaking of that, I made a suggestion that AFAIK fixes the issue, which isn't i

Re: systemd-fsck?

2014-05-10 Thread Bas Wijnen
I think this is a good example of how not to respond to reports, as we recently discussed on this list. Even though most parts are excellent. :-) On Sat, May 10, 2014 at 03:36:26PM +0200, Laurent Bigonville wrote: > The root cause of this bug is [...] This part is useful. > So please get dirmng

Re: systemd-fsck?

2014-05-09 Thread Bas Wijnen
On Fri, May 09, 2014 at 10:37:03PM +0200, Tollef Fog Heen wrote: > It and upstart (and any other providers of /sbin/init) should also grow > critical debconf warnings if you install them and you were previously using > systemd as your init so it's symmetric. Nobody is suggesting that systemd shoul

Re: systemd-fsck?

2014-05-09 Thread Bas Wijnen
On Fri, May 09, 2014 at 10:56:43AM -0700, Steve Langasek wrote: > The default hasn't changed; sysvinit still lists sysvinit-core as the first > alternative for its pre-dependency on /sbin/init. What is forcing > systemd-sysv onto users systems in advance of this change? Also, if the order of depe

Re: Ghostscript licensing changed to AGPL

2014-05-07 Thread Bas Wijnen
On Wed, May 07, 2014 at 10:48:46PM +0200, Jean-Christophe Dubacq wrote: > texlive-bin uses the software (gs), As you, yourself, said, the > difference between the AGPL and the GPL is that the AGPL protects the > user, not only the people that download the software. This means that by > some interpr

Re: Non-source Javascript files in upstream source

2014-05-07 Thread Bas Wijnen
On Wed, May 07, 2014 at 05:18:36PM +1000, Ben Finney wrote: > the problem is for the package maintainer to assert that *is* the > corresponding source for a particular work. > > We should not, IMO, accept such an assertion without an independently > verifiable guarantee that can be automated for e

  1   2   >