Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-17 Thread Kamil Dudka
On Wednesday, March 16, 2022 1:06:34 PM CET Neal Gompa wrote: > > For completeness, here is a pull request by Miro Hrončok to change the > > packaging of curl to something that FESCO would like to have for the > > proposed Fedora change to be accepted: > > > > > > > >

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-16 Thread David Cantrell
On Wed, Mar 16, 2022 at 08:06:34AM -0400, Neal Gompa wrote: > On Wed, Mar 16, 2022 at 7:50 AM Kamil Dudka wrote: > > > > On Wednesday, March 16, 2022 10:01:10 AM CET Paul Howarth wrote: > > > On Tue, 22 Feb 2022 12:00:06 -0500 > > > Ben Cotton wrote: > > > > > > > > > >

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-16 Thread Neal Gompa
On Wed, Mar 16, 2022 at 7:50 AM Kamil Dudka wrote: > > On Wednesday, March 16, 2022 10:01:10 AM CET Paul Howarth wrote: > > On Tue, 22 Feb 2022 12:00:06 -0500 > > Ben Cotton wrote: > > > > > > > https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default > > > > > > == Summary == > > >

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-16 Thread Kamil Dudka
On Wednesday, March 16, 2022 10:01:10 AM CET Paul Howarth wrote: > On Tue, 22 Feb 2022 12:00:06 -0500 > Ben Cotton wrote: > > > > https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default > > > > == Summary == > > `libcurl-minimal` and `curl-minimal` will be installed by default > >

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-16 Thread Paul Howarth
On Tue, 22 Feb 2022 12:00:06 -0500 Ben Cotton wrote: > https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default > > == Summary == > `libcurl-minimal` and `curl-minimal` will be installed by default > instead of `libcurl` and `curl`. > The "minimal" variants provide only a subset of

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-13 Thread Matthew Miller
On Fri, Mar 11, 2022 at 09:52:41AM +0100, Petr Pisar wrote: > That misses the point that telnet is a protocol which e.g. prescribes how to > encode an end of line. Specifically this feature mismatches with the shell > environement we speak about. And because telnet is an underlying layer of > many

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-11 Thread Petr Pisar
V Thu, Mar 10, 2022 at 12:35:32PM -0500, Matthew Miller napsal(a): > On Thu, Mar 10, 2022 at 11:55:39AM +0100, Alex wrote: > > I have seen in https://lwn.net/Articles/887313/ that you plan to remove the > > "telnet" protocol from curl-minimal. > > I use `curl -v telnet://` almost every day for

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-11 Thread Daniel P . Berrangé
On Thu, Mar 10, 2022 at 07:07:09PM -0500, Nico Kadel-Garcia wrote: > On Thu, Mar 10, 2022 at 6:41 AM Paul Howarth wrote: > > > > On Thu, 10 Mar 2022 12:26:54 +0100 > > Vitaly Zaitsev via devel wrote: > > > > > On 10/03/2022 11:55, Alex wrote: > > > > May I suggest to leave at least the telnet

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Nico Kadel-Garcia
On Thu, Mar 10, 2022 at 6:41 AM Paul Howarth wrote: > > On Thu, 10 Mar 2022 12:26:54 +0100 > Vitaly Zaitsev via devel wrote: > > > On 10/03/2022 11:55, Alex wrote: > > > May I suggest to leave at least the telnet protocol in curl-minimal > > > for debugging purposes. > > > > Telnet is an

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Zbigniew Jędrzejewski-Szmek
On Thu, Mar 10, 2022 at 11:55:39AM +0100, Alex wrote: > Hi. > > I have seen in https://lwn.net/Articles/887313/ that you plan to remove the > "telnet" protocol from curl-minimal. > > I use `curl -v telnet://` almost every day for debugging purpose just > because curl is in the most systems

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Matthew Miller
On Thu, Mar 10, 2022 at 11:55:39AM +0100, Alex wrote: > I have seen in https://lwn.net/Articles/887313/ that you plan to remove the > "telnet" protocol from curl-minimal. > I use `curl -v telnet://` almost every day for debugging purpose just > because curl is in the most systems by default

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Michael Catanzaro
On Thu, Mar 10 2022 at 11:55:39 AM +0100, Alex wrote: I have seen in https://lwn.net/Articles/887313/ that you plan to remove the "telnet" protocol from curl-minimal. Next up: I see you're planning to remove the brotli compression support. I think that's actually used along with gzip for

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Alex
On Thu, 10 Mar 2022 14:10:17 +0100 Vitaly Zaitsev via devel wrote: > On 10/03/2022 13:47, Alex wrote: > > Here a example test. I know that this could be also done with https but > > it's a understandable example, IMHO. > > Better example: > openssl s_client -connect example.org:443 > Agree

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Vitaly Zaitsev via devel
On 10/03/2022 12:41, Paul Howarth wrote: I wonder, do you have the "telnet" program installed on your machine(s)? No. All my services use TLS. openssl s_client -connect example.org:443 -- Sincerely, Vitaly Zaitsev (vit...@easycoding.org) ___

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Vitaly Zaitsev via devel
On 10/03/2022 13:47, Alex wrote: Here a example test. I know that this could be also done with https but it's a understandable example, IMHO. Better example: openssl s_client -connect example.org:443 -- Sincerely, Vitaly Zaitsev (vit...@easycoding.org)

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Alex
On Thu, 10 Mar 2022 11:41:15 + Paul Howarth wrote: > On Thu, 10 Mar 2022 12:26:54 +0100 > Vitaly Zaitsev via devel wrote: > > > On 10/03/2022 11:55, Alex wrote: > > > May I suggest to leave at least the telnet protocol in curl-minimal > > > for debugging purposes. > > > > Telnet is an

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Neal Gompa
On Thu, Mar 10, 2022 at 7:09 AM Tom Hughes wrote: > > On 10/03/2022 11:51, Neal Gompa wrote: > > On Thu, Mar 10, 2022 at 6:49 AM Daniel P. Berrangé > > wrote: > > > >> Everyone has their own conflicting idea of what is 'minimal'. There's > >> no nice way to solve this problem in Fedora without

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Tom Hughes via devel
On 10/03/2022 11:51, Neal Gompa wrote: On Thu, Mar 10, 2022 at 6:49 AM Daniel P. Berrangé wrote: Everyone has their own conflicting idea of what is 'minimal'. There's no nice way to solve this problem in Fedora without curl upstream supporting dlopen modules per protoocol, allowing us to

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Neal Gompa
On Thu, Mar 10, 2022 at 6:49 AM Daniel P. Berrangé wrote: > > On Thu, Mar 10, 2022 at 12:26:54PM +0100, Vitaly Zaitsev via devel wrote: > > On 10/03/2022 11:55, Alex wrote: > > > May I suggest to leave at least the telnet protocol in curl-minimal for > > > debugging purposes. > > > > Telnet is an

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Daniel P . Berrangé
On Thu, Mar 10, 2022 at 12:26:54PM +0100, Vitaly Zaitsev via devel wrote: > On 10/03/2022 11:55, Alex wrote: > > May I suggest to leave at least the telnet protocol in curl-minimal for > > debugging purposes. > > Telnet is an extremely vulnerable protocol. It must be disable. > > If you need it,

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Ralf Corsépius
Am 10.03.22 um 12:26 schrieb Vitaly Zaitsev via devel: On 10/03/2022 11:55, Alex wrote: May I suggest to leave at least the telnet protocol in curl-minimal for debugging purposes. Telnet is an extremely vulnerable protocol. It must be disable. It should not be used on a regular basis, but

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Paul Howarth
On Thu, 10 Mar 2022 12:26:54 +0100 Vitaly Zaitsev via devel wrote: > On 10/03/2022 11:55, Alex wrote: > > May I suggest to leave at least the telnet protocol in curl-minimal > > for debugging purposes. > > Telnet is an extremely vulnerable protocol. It must be disable. > > If you need it,

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Vitaly Zaitsev via devel
On 10/03/2022 11:55, Alex wrote: May I suggest to leave at least the telnet protocol in curl-minimal for debugging purposes. Telnet is an extremely vulnerable protocol. It must be disable. If you need it, you can always install libcurl-full. -- Sincerely, Vitaly Zaitsev

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-10 Thread Alex
Hi. I have seen in https://lwn.net/Articles/887313/ that you plan to remove the "telnet" protocol from curl-minimal. I use `curl -v telnet://` almost every day for debugging purpose just because curl is in the most systems by default installed. I know that there are some other tools like

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-03 Thread Kamil Dudka
On Thursday, March 3, 2022 10:49:07 PM CET Richard W.M. Jones wrote: > (1) I don't deny that curl-minimal will reduce the size of some niche > containers, my point is this is not a worthwhile goal to pursue given > the costs. I am pretty sure there are Fedora installations not based on containers

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-03 Thread Demi Marie Obenour
On 3/3/22 16:49, Richard W.M. Jones wrote: > On Thu, Mar 03, 2022 at 08:14:20PM +0100, Kamil Dudka wrote: >> On Thursday, March 3, 2022 3:24:38 PM CET Richard W.M. Jones wrote: >>> On Thu, Mar 03, 2022 at 09:04:10AM +0100, Kamil Dudka wrote: The FTP protocol is still included in

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-03 Thread Richard W.M. Jones
On Thu, Mar 03, 2022 at 08:14:20PM +0100, Kamil Dudka wrote: > On Thursday, March 3, 2022 3:24:38 PM CET Richard W.M. Jones wrote: > > On Thu, Mar 03, 2022 at 09:04:10AM +0100, Kamil Dudka wrote: > > > The FTP protocol is still included in libcurl-minimal, so the protocol is > > > not going to

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-03 Thread Kamil Dudka
On Thursday, March 3, 2022 3:24:38 PM CET Richard W.M. Jones wrote: > On Thu, Mar 03, 2022 at 09:04:10AM +0100, Kamil Dudka wrote: > > The FTP protocol is still included in libcurl-minimal, so the protocol is > > not going to disappear with the proposed F37 change. On the other > > hand, it may

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-03 Thread Richard W.M. Jones
On Thu, Mar 03, 2022 at 09:04:10AM +0100, Kamil Dudka wrote: > On Thursday, March 3, 2022 7:07:34 AM CET Ralf Corsépius wrote: > > Am 24.02.22 um 19:35 schrieb Daniel P. Berrangé: > > > > > On Thu, Feb 24, 2022 at 07:16:26PM +0100, Ralf Corsépius wrote: > > > > > > > > > If someone is setting

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-03 Thread Kamil Dudka
On Thursday, March 3, 2022 7:07:34 AM CET Ralf Corsépius wrote: > Am 24.02.22 um 19:35 schrieb Daniel P. Berrangé: > > > On Thu, Feb 24, 2022 at 07:16:26PM +0100, Ralf Corsépius wrote: > > > > > If someone is setting up a personal private mirror, I struggle > > to understand a reason why they

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-03-02 Thread Ralf Corsépius
Am 24.02.22 um 19:35 schrieb Daniel P. Berrangé: On Thu, Feb 24, 2022 at 07:16:26PM +0100, Ralf Corsépius wrote: If someone is setting up a personal private mirror, I struggle to understand a reason why they would pick FTP over HTTP(S) today. Because an ftp server is much lighter and much

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-27 Thread Richard W.M. Jones
On Fri, Feb 25, 2022 at 09:05:50AM +0100, Kamil Dudka wrote: > On Thursday, February 24, 2022 3:37:56 PM CET Neal Gompa wrote: > > On Thu, Feb 24, 2022 at 8:58 AM Richard W.M. Jones > wrote: > > > On Thu, Feb 24, 2022 at 02:28:08PM +0100, Kamil Dudka wrote: > > > > On Thursday, February 24, 2022

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-25 Thread Panu Matilainen
On 2/24/22 16:37, Neal Gompa wrote: On Thu, Feb 24, 2022 at 8:58 AM Richard W.M. Jones wrote: On Thu, Feb 24, 2022 at 02:28:08PM +0100, Kamil Dudka wrote: On Thursday, February 24, 2022 1:35:38 PM CET Richard W.M. Jones wrote: Did you discuss modularising curl itself upstream? It was

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-25 Thread Kamil Dudka
On Thursday, February 24, 2022 3:37:56 PM CET Neal Gompa wrote: > On Thu, Feb 24, 2022 at 8:58 AM Richard W.M. Jones wrote: > > On Thu, Feb 24, 2022 at 02:28:08PM +0100, Kamil Dudka wrote: > > > On Thursday, February 24, 2022 1:35:38 PM CET Richard W.M. Jones wrote: > > > > Did you discuss

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-25 Thread Kamil Dudka
On Thursday, February 24, 2022 2:58:10 PM CET Richard W.M. Jones wrote: > On Thu, Feb 24, 2022 at 02:28:08PM +0100, Kamil Dudka wrote: > > On Thursday, February 24, 2022 1:35:38 PM CET Richard W.M. Jones wrote: > > > Did you discuss modularising curl itself upstream? > > > > It was added to their

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Chris Adams
Once upon a time, Vitaly Zaitsev via devel said: > Now we can drop FTP support from libcurl safely. I still disagree, since dnf is not the sole user of curl/libcurl. Making libcurl tiny for containers is one thing, but replacing a commonly-used command with an intentionally-limited version is

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Vitaly Zaitsev via devel
On 24/02/2022 19:05, Kevin Fenzi wrote: Odd. There shouldn't be any. Can you paste/post what you are seeing? Sorry, my bad. I've seen errors like "Timeout was reached for ftp.example.org". There are a lot of mirrors with ftp subdomain: - ftp.lysator.liu.se - ftp.nluug.nl - ftp.fau.de -

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Daniel P . Berrangé
On Thu, Feb 24, 2022 at 07:16:26PM +0100, Ralf Corsépius wrote: > > > Am 24.02.22 um 19:05 schrieb Kevin Fenzi: > > On Wed, Feb 23, 2022 at 10:19:33AM +0100, Vitaly Zaitsev via devel wrote: > > > On 22/02/2022 21:45, Peter Robinson wrote: > > > > Does it make sense to keep FTP with most browsers

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Ralf Corsépius
Am 24.02.22 um 19:05 schrieb Kevin Fenzi: On Wed, Feb 23, 2022 at 10:19:33AM +0100, Vitaly Zaitsev via devel wrote: On 22/02/2022 21:45, Peter Robinson wrote: Does it make sense to keep FTP with most browsers obsoleting the protocol due to lack of security? Many Fedora mirrors still use

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Kevin Fenzi
On Wed, Feb 23, 2022 at 10:19:33AM +0100, Vitaly Zaitsev via devel wrote: > On 22/02/2022 21:45, Peter Robinson wrote: > > Does it make sense to keep FTP with most browsers obsoleting the > > protocol due to lack of security? > > Many Fedora mirrors still use FTP. You can check metalink file.

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Neal Gompa
On Thu, Feb 24, 2022 at 8:58 AM Richard W.M. Jones wrote: > > On Thu, Feb 24, 2022 at 02:28:08PM +0100, Kamil Dudka wrote: > > On Thursday, February 24, 2022 1:35:38 PM CET Richard W.M. Jones wrote: > > > Did you discuss modularising curl itself upstream? > > > > It was added to their wish list

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Richard W.M. Jones
On Thu, Feb 24, 2022 at 02:28:08PM +0100, Kamil Dudka wrote: > On Thursday, February 24, 2022 1:35:38 PM CET Richard W.M. Jones wrote: > > Did you discuss modularising curl itself upstream? > > It was added to their wish list but I do not remember anybody working on it: > >

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Kamil Dudka
On Thursday, February 24, 2022 1:35:38 PM CET Richard W.M. Jones wrote: > Did you discuss modularising curl itself upstream? It was added to their wish list but I do not remember anybody working on it: https://github.com/curl/curl/commit/8204844f > That would be a better idea. Not

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Björn Persson
Kamil Dudka wrote: > There seems to be demand for libcurl with IDN support on minimal Fedora > installations, so I created a pull request to enable it in libcurl-minimal: > > https://src.fedoraproject.org/rpms/curl/pull-request/13 Thank you. Björn Persson pgp2ZEu96gtIM.pgp Description:

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Richard W.M. Jones
On Tue, Feb 22, 2022 at 12:00:06PM -0500, Ben Cotton wrote: > https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default > > == Summary == > `libcurl-minimal` and `curl-minimal` will be installed by default > instead of `libcurl` and `curl`. > The "minimal" variants provide only a subset of

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Vitaly Zaitsev via devel
On 22/02/2022 18:00, Ben Cotton wrote: The "minimal" variants provide only a subset of protocols (HTTP, HTTPS, FTP). The full versions can be explicitly requested as `libcurl-full` and `curl-full`. Let's also drop FTP support both from libcurl and dnf (including all ftp:// mirrors from

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-24 Thread Kamil Dudka
On Wednesday, February 23, 2022 7:01:26 PM CET Björn Persson wrote: > Zbigniew Jędrzejewski-Szmek wrote: > > According to ICANN [1], there were 8.3 mln IDN domains worldwide. > > And that's presumably only second-level domains. Nobody knows how many > non-ASCII subdomains exist under ASCII

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Peter Robinson
On Wed, Feb 23, 2022 at 7:00 PM Björn Persson wrote: > > Zbigniew Jędrzejewski-Szmek wrote: > > Apart from Dmitry, I don't think there were any opinions from folks > > who would be directly impacted. > > I don't know which programs use Curl so I can't tell whether I'd be > impacted. I understand

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Björn Persson
Zbigniew Jędrzejewski-Szmek wrote: > Apart from Dmitry, I don't think there were any opinions from folks > who would be directly impacted. I don't know which programs use Curl so I can't tell whether I'd be impacted. I understand that Yum uses it. Lack of IDNA in Yum would impact me if I had a

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Björn Persson
Zbigniew Jędrzejewski-Szmek wrote: > According to ICANN [1], there were 8.3 mln IDN domains worldwide. And that's presumably only second-level domains. Nobody knows how many non-ASCII subdomains exist under ASCII second-level domains, since domain holders define subdomains at will without telling

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Zbigniew Jędrzejewski-Szmek
On Wed, Feb 23, 2022 at 02:22:32PM +, Daniel P. Berrangé wrote: > On Wed, Feb 23, 2022 at 02:52:02PM +0100, Kamil Dudka wrote: > > On Wednesday, February 23, 2022 10:22:00 AM CET Dmitry Belyavskiy wrote: > > > Dear Kamil, > > > > > > On Wed, Feb 23, 2022 at 8:51 AM Kamil Dudka wrote: > > > >

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Daniel P . Berrangé
On Wed, Feb 23, 2022 at 02:52:02PM +0100, Kamil Dudka wrote: > On Wednesday, February 23, 2022 10:22:00 AM CET Dmitry Belyavskiy wrote: > > Dear Kamil, > > > > On Wed, Feb 23, 2022 at 8:51 AM Kamil Dudka wrote: > > > On Tuesday, February 22, 2022 10:50:06 PM CET Chris Adams wrote: > > > > Once

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Ewoud Kohl van Wijngaarden
On Wed, Feb 23, 2022 at 02:52:02PM +0100, Kamil Dudka wrote: On Wednesday, February 23, 2022 10:22:00 AM CET Dmitry Belyavskiy wrote: Dear Kamil, On Wed, Feb 23, 2022 at 8:51 AM Kamil Dudka wrote: > On Tuesday, February 22, 2022 10:50:06 PM CET Chris Adams wrote: > > Once upon a time,

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Kamil Dudka
On Wednesday, February 23, 2022 10:22:00 AM CET Dmitry Belyavskiy wrote: > Dear Kamil, > > On Wed, Feb 23, 2022 at 8:51 AM Kamil Dudka wrote: > > On Tuesday, February 22, 2022 10:50:06 PM CET Chris Adams wrote: > > > Once upon a time, Zbigniew Jędrzejewski-Szmek said: > > > > Yes. But how many

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Dominique Martinet
Zbigniew Jędrzejewski-Szmek wrote on Wed, Feb 23, 2022 at 10:44:12AM +0100: > According to ICANN [1], there were 8.3 mln IDN domains worldwide. I admit > that is more than I expected. According to verisgn [2], out of 364.6 mln > total, > i.e. around 2%. > Apparently .рф is fairly popular, with

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Zbigniew Jędrzejewski-Szmek
On Wed, Feb 23, 2022 at 08:51:10AM +0100, Kamil Dudka wrote: > On Tuesday, February 22, 2022 10:50:06 PM CET Chris Adams wrote: > > Once upon a time, Zbigniew Jędrzejewski-Szmek said: > > > > > Yes. But how many domains using idn are there? I worked on idn support > > > in systemd, but when

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Dmitry Belyavskiy
Dear Kamil, On Wed, Feb 23, 2022 at 8:51 AM Kamil Dudka wrote: > On Tuesday, February 22, 2022 10:50:06 PM CET Chris Adams wrote: > > Once upon a time, Zbigniew Jędrzejewski-Szmek said: > > > > > Yes. But how many domains using idn are there? I worked on idn support > > > in systemd, but

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Vitaly Zaitsev via devel
On 23/02/2022 08:46, Kamil Dudka wrote: Of course, each application that does not need FTP, can disable the protocol at run-time. But disabling it globally on default installations of Fedora would make this change too controversial. We can reconsider it later in case the initial change is

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-23 Thread Vitaly Zaitsev via devel
On 22/02/2022 21:45, Peter Robinson wrote: Does it make sense to keep FTP with most browsers obsoleting the protocol due to lack of security? Many Fedora mirrors still use FTP. You can check metalink file. -- Sincerely, Vitaly Zaitsev (vit...@easycoding.org)

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Kamil Dudka
On Tuesday, February 22, 2022 10:50:06 PM CET Chris Adams wrote: > Once upon a time, Zbigniew Jędrzejewski-Szmek said: > > > Yes. But how many domains using idn are there? I worked on idn support > > in systemd, but when preparing the description of this change I realized > > that I have _never_

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Kamil Dudka
On Tuesday, February 22, 2022 9:45:30 PM CET Peter Robinson wrote: > On Tue, Feb 22, 2022 at 5:00 PM Ben Cotton wrote: > > > > > > > https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default > > > > > > > > == Summary == > > `libcurl-minimal` and `curl-minimal` will be installed by default >

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Kamil Dudka
On Tuesday, February 22, 2022 10:47:40 PM CET Chris Adams wrote: > Once upon a time, Demi Marie Obenour said: > > > As mentioned above, the purpose of this change is to ensure that > > vulnerabilities in obscure protocols impact a smaller fraction of > > users. Right now, a vulnerability in an

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Demi Marie Obenour
On 2/22/22 16:47, Chris Adams wrote: > Once upon a time, Demi Marie Obenour said: >> As mentioned above, the purpose of this change is to ensure that >> vulnerabilities in obscure protocols impact a smaller fraction of >> users. Right now, a vulnerability in an obscure protocol impacts >> most

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Chris Adams
Once upon a time, Zbigniew Jędrzejewski-Szmek said: > Yes. But how many domains using idn are there? I worked on idn support > in systemd, but when preparing the description of this change I realized > that I have _never_ once used an idn domain outside of testing. > > And note that this is not

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Chris Adams
Once upon a time, Demi Marie Obenour said: > As mentioned above, the purpose of this change is to ensure that > vulnerabilities in obscure protocols impact a smaller fraction of > users. Right now, a vulnerability in an obscure protocol impacts > most users. With this change, it will only

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Peter Robinson
On Tue, Feb 22, 2022 at 5:00 PM Ben Cotton wrote: > > https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default > > == Summary == > `libcurl-minimal` and `curl-minimal` will be installed by default > instead of `libcurl` and `curl`. > The "minimal" variants provide only a subset of protocols

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Zbigniew Jędrzejewski-Szmek
On Tue, Feb 22, 2022 at 07:25:41PM +0100, Björn Persson wrote: > > `curl-minimal`+`libcurl-minimal` are compiled with various > > semi-obsolete protocols and infrequently-used features disabled: > > DICT, GOPHER, IMAP, LDAP, LDAPS, MQTT, NTLM, POP3, RTSP, SMB, SMTP, > > SFTP, SCP, TELNET, TFTP,

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Demi Marie Obenour
On 2/22/22 13:57, Chris Adams wrote: > Once upon a time, Ben Cotton said: >> Those infrequently used protocols are less tested than the common ones >> and are a source of security bugs. >> Most users are not using those protocols anyway, so disabling them >> reduces the bug and attack surface. >

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Chris Adams
Once upon a time, Ben Cotton said: > Those infrequently used protocols are less tested than the common ones > and are a source of security bugs. > Most users are not using those protocols anyway, so disabling them > reduces the bug and attack surface. This is a poor argument IMHO. If the

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Björn Persson
> `curl-minimal`+`libcurl-minimal` are compiled with various > semi-obsolete protocols and infrequently-used features disabled: > DICT, GOPHER, IMAP, LDAP, LDAPS, MQTT, NTLM, POP3, RTSP, SMB, SMTP, > SFTP, SCP, TELNET, TFTP, brotli compression, IDN2 names. Disabling IDNA makes libcurl-minimal

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Zbigniew Jędrzejewski-Szmek
On Tue, Feb 22, 2022 at 05:09:37PM +, Daniel P. Berrangé wrote: > On Tue, Feb 22, 2022 at 12:00:06PM -0500, Ben Cotton wrote: > > https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default > > > > == Summary == > > `libcurl-minimal` and `curl-minimal` will be installed by default > >

Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Daniel P . Berrangé
On Tue, Feb 22, 2022 at 12:00:06PM -0500, Ben Cotton wrote: > https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default > > == Summary == > `libcurl-minimal` and `curl-minimal` will be installed by default > instead of `libcurl` and `curl`. > The "minimal" variants provide only a subset of

F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Ben Cotton
https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default == Summary == `libcurl-minimal` and `curl-minimal` will be installed by default instead of `libcurl` and `curl`. The "minimal" variants provide only a subset of protocols (HTTP, HTTPS, FTP). The full versions can be explicitly

F37 Change: Curl-minimal as default (System-Wide Change proposal)

2022-02-22 Thread Ben Cotton
https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default == Summary == `libcurl-minimal` and `curl-minimal` will be installed by default instead of `libcurl` and `curl`. The "minimal" variants provide only a subset of protocols (HTTP, HTTPS, FTP). The full versions can be explicitly