Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Sagar Acharya
Ok. But this is a behavioral change right? How can a patch help in this case? Admins always protest the decision in almost every community if it isn't theirs. Am I suggesting something harmful here? It takes a minute to sign a release and this improves security. It makes sure that user gets the

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Laslo Hunhold
On Sat, 17 Apr 2021 07:45:16 +0200 (CEST) Sagar Acharya wrote: Dear Sagar, > Ok. But this is a behavioral change right? How can a patch help in > this case? > > Admins always protest the decision in almost every community if it > isn't theirs. Am I suggesting something harmful here? It takes a

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Laslo Hunhold
On Wed, 14 Apr 2021 09:05:01 +0300 Sergey Matveev wrote: Dear Sergey, > If we a talking here about checking software integrity, then speed is > important. Millions of people check the hash of downloaded files -- if > it is slow, then huge quantity of time/energy is wasted. Less time you > spent

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Mattias Andrée
On Sat, 17 Apr 2021 16:30:15 +0200 Laslo Hunhold wrote: > On Wed, 14 Apr 2021 09:05:01 +0300 > Sergey Matveev wrote: > > Dear Sergey, > > > If we a talking here about checking software integrity, then speed is > > important. Millions of people check the hash of downloaded files -- if > > it is

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Sergey Matveev
Greetings! *** Laslo Hunhold [2021-04-17 16:30]: >we would save much more energy by banning autohell, Rust, bloated >electron-apps and Qt. Well, I can only fully agree with that! My comment about hash functions performance was only related to defective idea that slowing them down will help us wit

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Laslo Hunhold
On Sat, 17 Apr 2021 17:42:50 +0200 Mattias Andrée wrote: Dear Mattias, > I've completely ignored Rust. What's the problem with it? in regard to my argument: It has abysmal compile times and the compiler is extremely bloated. In general though, I see multiple issues with it: The crate-system co

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Sergey Matveev
*** Laslo Hunhold [2021-04-17 17:57]: >in regard to my argument: It has abysmal compile times and the compiler >is extremely bloated. Also it has bootstrap problem: officially there is no way to build Rust, except for downloading some binaries for you platform from the Internet. LLVM/Clang, GCC --

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Mattias Andrée
This self-hosted nonsense is ludicrous. It's understandable for C compilers, it's an old language that everyone has a compiler for and there are many implementations, and even if you wrote it in assembly, you will just shift the problem to the assembler. So there must be one blessed language, and C

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Hiltjo Posthuma
On Wed, Apr 14, 2021 at 09:05:01AM +0300, Sergey Matveev wrote: > *** Markus Wichmann [2021-04-14 06:03]: > >I don't care about the speed of a hash function. > > If we a talking here about checking software integrity, then speed is > important. Millions of people check the hash of downloaded files

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Sergey Matveev
*** Hiltjo Posthuma [2021-04-17 19:13]: >Generating hashes for all dl.suckless tarball files (287 files) takes 0.75 >seconds in total, it is not an issue. Agreed of course. SHA2 is currently the best tradeoff. The only question could remain: SHA256 vs SHA512 (that is faster on 64-bit platforms).

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Sergey Matveev
*** Mattias Andrée [2021-04-17 18:57]: >This self-hosted nonsense is ludicrous. Not agree. >It's understandable for C compilers Rust, as far as I heard/remember, was written on OCaml, that itself was also written on some C -- so nothing prevents its bootstrapping too, unless its authors thought

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Mattias Andrée
On Sat, 17 Apr 2021 20:50:50 +0300 Sergey Matveev wrote: > *** Mattias Andrée [2021-04-17 18:57]: > >This self-hosted nonsense is ludicrous. > > Not agree. > > >It's understandable for C compilers > > Rust, as far as I heard/remember, was written on OCaml, that itself was > also written on

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Sergey Matveev
*** Mattias Andrée [2021-04-17 20:08]: >No one has an OCaml compiler. Same applies to Rust. And to Go too, but it is easy bootstrappable with the C compiler, taking just several minutes on modest hardware. Rust is like a JavaScript: just download it and run, because it is seems so convenient moder

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Mattias Andrée
On Sat, 17 Apr 2021 21:30:58 +0300 Sergey Matveev wrote: > *** Mattias Andrée [2021-04-17 20:08]: > >No one has an OCaml compiler. > > Same applies to Rust. > And to Go too, but it is easy bootstrappable with the C compiler, taking > just several minutes on modest hardware. Rust is like a Java

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Mattias Andrée
On Sat, 17 Apr 2021 20:38:51 +0200 Mattias Andrée wrote: > On Sat, 17 Apr 2021 21:30:58 +0300 > Sergey Matveev wrote: > > > *** Mattias Andrée [2021-04-17 20:08]: > > >No one has an OCaml compiler. > > > > Same applies to Rust. > > And to Go too, but it is easy bootstrappable with the C

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Sergey Matveev
*** Mattias Andrée [2021-04-17 20:41]: >you have to publish the last version >that wasn't self-hosted alongside the self-hosted version, Exactly! And my critique of Rust is that they have not bothered done that way, that is just an unacceptable (for me) careless work. Go as a comparison: Go 1.4 is

Re: [dev] Checksums and Sig files for release gzip

2021-04-17 Thread Sergey Matveev
*** Sergey Matveev [2021-04-17 20:47]: >>What is the preferred hash by Greta? >What is that? I was told offlist that (seems) you were refering to Greta Thunberg. I suppose she would blame us all, because we are using cryptographic hash functions for the things where simpler, cheaper and faster spe