On Tue, 18 May 2010 10:08:17 +0000 (UTC), Philipp Kern <tr...@philkern.de>
wrote:
> So you present that as universal facts as if you've booked the truth
> (possibly a bad translation of a German saying).
No,.. and normally I would simply shut up, as I'm not even DD... but this
here breaks simply so much which I believe in and contradicts so many
proven paradigms, that I prefer to raise up even if that means, that I
don't make any friends here.
> I think that feature is useful for all those who don't want to mess
> with ACLs.
Well I guess this already hints to it:
- groups, were intended to group different users together and not to rely
that only one users is in its own group (which is as far as I understood
what UPGs do, right?)
- If one wants more (collaboration stuff and that on): We have ACLs, which
are just intended for all that,... allowing finer grained access rules. And
I guess many collaborative issues are dealt with at a much higher level
than the fs anyway...
> If you are not allowed to use ACLs
That's no reason for UPGs to exist, is it?
All important filesystems support ACLs, right? All kernels in Debian and
do so, right? So technically, no problem.
So being "not allowed" probably means organisational issues, right? But
then talk to your admins.
What's done here is to abuse a system just to workaround something else
("don't have/want to ACLs), right?
> and don't have UPG
> with sane umasks collaboration is painful (see e.g. Debian infrastrure
> with all users being in group Debian and default umask 0022 which
> leads to wrong permissions in setgid directories,
> with ACLs being
> disallowed).
Was there any special reason for this?
> So indeed I got a script which does newgrp and
> setting the umask for me which I run whenever I want to do release
> tasks. But it would be more sane if the user wouldn't have to
> care about that.
- Even if I'd see a technical use case/benefit (that could not be gained
via other means that are intended for this),... I wouldn't do this as
default.
- There are probably many unpredictable side effects (see what Peter has
noted) and the need to hack around stuff which is perfectly ok as it is (I
guess this is going to be done e.g. in ssh).
And - for me most important - it shows some evil trends:
- We more or less start forcing users to go a special way (in this case
"using UPGs").
I know you'll say that everybody can simply go back, but if this like
changing unrelated packages go on, the day will come sooner than later
where this is not easily possible.
- We start sacrifice security.
Cheers,
Chris.
--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/1504291ecb28d8c42cad3ab73ad80...@imap.dd24.net
