Re: Referring bug #166718 and the initial groups issue to the TC

2004-04-01 Thread Raul Miller
On Thu, Apr 01, 2004 at 10:19:42PM -0500, Sam Hartman wrote: > Agreed. Traditionally, however, Unix has not been in the practice of > being easy to use. We should be careful, not hidebound. That depends. Once upon a time, security wasn't much of an issue, and ease of use for the casual user was

Re: Referring bug #166718 and the initial groups issue to the TC

2004-04-01 Thread Sam Hartman
> "Manoj" == Manoj Srivastava <[EMAIL PROTECTED]> writes: Manoj> On Wed, 31 Mar 2004 14:15:00 -0500 (EST), Sam Hartman Manoj> <[EMAIL PROTECTED]> said: Manoj> It seems to me that this ought to be local policy. Can Manoj> you explain to me how the proposed solutions take si

Re: policies for access to local resources

2004-04-01 Thread Raul Miller
On Thu, Apr 01, 2004 at 02:38:04PM +0200, Wichert Akkerman wrote: > This is largely orthogonal to the current issue, but it would be nice if > d-i had a 'select machine type' option where people could select between > 'private machine on private network', 'shared machine with trusted > users', 'sha

Re: Referring bug #166718 and the initial groups issue to the TC

2004-04-01 Thread Bdale Garbee
[EMAIL PROTECTED] (Sam Hartman) writes: > The problem is fairly simple. Some of our users actually want to use > their systems once they get it installed. ;-) > Perhaps when Debian and the FHS originally made this decision, users > could be expected to simply add themselves to groups if they n

Re: policies for access to local resources

2004-04-01 Thread Raul Miller
On Thu, Apr 01, 2004 at 02:38:04PM +0200, Wichert Akkerman wrote: > This is largely orthogonal to the current issue, but it would be nice if > d-i had a 'select machine type' option where people could select between > 'private machine on private network', 'shared machine with trusted > users', 'sha

Re: policies for access to local resources

2004-04-01 Thread Wichert Akkerman
Previously Raul Miller wrote: > However, it would probably be a good idea to give the people who have > security concerns an easy way of avoiding this solution when building > large sets of machines. This is largely orthogonal to the current issue, but it would be nice if d-i had a 'select machine

policies for access to local resources

2004-04-01 Thread Raul Miller
On Wed, 31 Mar 2004 14:15:00 -0500 (EST), Sam Hartman <[EMAIL PROTECTED]> said: > The proposal in bug #166718 and the bugs merged with it is for the > initial user to be added to some set of groups. Karl does not like > this proposal because it only solves the problem for the initial > user. Tha

Re: Referring bug #166718 and the initial groups issue to the TC

2004-04-01 Thread Wichert Akkerman
Previously Manoj Srivastava wrote: > Traditionally, UNIX has not been in the practice of > automatically adding users to groups, and I think we need to be > careful if we decide to break from universal practice. A problem is that is simply isn't possible to do it securely currently, which

Re: Referring bug #166718 and the initial groups issue to the TC

2004-04-01 Thread Manoj Srivastava
On Wed, 31 Mar 2004 14:15:00 -0500 (EST), Sam Hartman <[EMAIL PROTECTED]> said: > The problem is fairly simple. Some of our users actually want to > use their systems once they get it installed. Particularly, they'd > like to be able to do things like play sound, access their floppy > drives an