Re: F42 Change Proposal: Enable Drm Panic (system-wide)

2024-07-16 Thread Kilian Hanich via devel
Am 16.07.24 um 09:26 schrieb Barry: On 15 Jul 2024, at 18:29, Jocelyn Falempe wrote: I will also check if I can patch VT_CONSOLE, so that it can be disabled on the kernel command line, instead of compile time, to avoid this gap. I'm currently preparing a test kernel, so that you can test o

Re: [Java related] packaging Italian ID card middleware

2024-07-19 Thread Kilian Hanich via devel
Hello, I am just following this discussion out of interested and this is kinda off-topic, but I have a question: Why is that? Am 19.07.24 um 11:05 schrieb Marián Konček: Gradle is not a preferred build system in Fedora due to various problems with its distribution. Best Regards Kilian Hanic

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Kilian Hanich via devel
Am 28.07.24 um 16:36 schrieb Neal Gompa: On Sun, Jul 28, 2024 at 8:40 AM Chuck Anderson wrote: On Sun, Jul 28, 2024 at 12:49:51PM GMT, Arthur Bols via devel wrote: Sure. But why do those ports need to be open by default at all? What is the benefit of adding those extra 2 lines? Does it enhanc

Re: FedoraWorkstation default firewall rules unsafe

2024-07-28 Thread Kilian Hanich via devel
Am 28.07.24 um 13:20 schrieb Michael Catanzaro: On Sun, Jul 28 2024 at 11:37:15 AM +02:00:00, Arthur Bols via devel wrote: Aside that this does not contribute to the discussion at all, I believe it is reasonable to assume that the default firewall rules are strict enough to not open all ports a

Re: FedoraWorkstation default firewall rules unsafe

2024-07-29 Thread Kilian Hanich via devel
Am 29.07.24 um 09:58 schrieb Kamil Paral: On Sun, Jul 28, 2024 at 7:56 PM Kilian Hanich via devel wrote: Interesting position considering that Windows by default does block everything via its Firewall by default. And Windows normally isn't known to have great security defaults. On Wi

Re: just to let you know FESCo agreed to a preliminary injunction while we consider this issue

2024-02-01 Thread Kilian Hanich via devel
Am 01.02.24 um 17:44 schrieb Neal Gompa: That is not necessarily true. For your example about window placement, there is this:https://gitlab.freedesktop.org/wayland/wayland-protocols/-/merge_requests/264 Am 01.02.24 um 17:46 schrieb Neal Gompa: Sorry, I meant to point to this as well: https://

Re: just to let you know FESCo agreed to a preliminary injunction while we consider this issue

2024-02-09 Thread Kilian Hanich via devel
Am 09.02.24 um 18:28 schrieb Neal Gompa: On Fri, Feb 9, 2024 at 12:16 PM Roy Bekken wrote: On fredag 9. februar 2024 17:41:33 CET Neal Gompa wrote: On Fri, Feb 9, 2024 at 11:06 AM Roy Bekken wrote: On fredag 9. februar 2024 04:04:04 CET Steve Cossette wrote: I am not gonna reply to a

Re: just to let you know FESCo agreed to a preliminary injunction while we consider this issue

2024-02-10 Thread Kilian Hanich via devel
Am 10.02.24 um 09:47 schrieb Neal Gompa: Technically, turning off display sync completely is quite difficult right now since the actual driver stack in Linux underneath everything (both Wayland and X11) uses implicit sync right now (Linux kernel drivers, Mesa drivers, etc.). Interesting consid

Re: Three steps we could take to make supply chain attacks a bit harder

2024-03-30 Thread Kilian Hanich via devel
Am 30.03.24 um 15:44 schrieb Zbigniew Jędrzejewski-Szmek: Meson outclasses CMake in functionality, clarity, and brevity. I doesn't make sense to consider switching to CMake at this point. While I do agree on clarity and brevity, I don't on functionality. Meson doesn't allow you do create your

Re: Three steps we could take to make supply chain attacks a bit harder

2024-03-30 Thread Kilian Hanich via devel
Am 30.03.24 um 20:11 schrieb Kevin Kofler via devel: Or better: Do not execute tests to begin with! rm -rf test in %prep and NEVER run tests during builds. Even when the tests are all legitimate, all it does is slow down the build (e.g., compare glibc build times without and with tests) and every

Re: Three steps we could take to make supply chain attacks a bit harder

2024-03-31 Thread Kilian Hanich via devel
Am 31.03.24 um 21:19 schrieb Simon de Vlieger: I don't quite agree with you. Two factor authentication whether an actual second factor device or not does prevent credential stuffing which is a common attack method that is easy to perform. It is when people take databases of previously leaked pas

Re: Three steps we could take to make supply chain attacks a bit harder

2024-03-31 Thread Kilian Hanich via devel
Am 31.03.24 um 23:02 schrieb Scott Schmit: On Sun, Mar 31, 2024 at 04:09:36PM -0400, Ben Beasley wrote: On 3/31/24 2:12 PM, Kevin Kofler via devel wrote: But the fact is: What WOULD have stopped this attack: (one or more of:) * Deleting ALL unit tests in %prep (and then of course not trying to

Re: Three steps we could take to make supply chain attacks a bit harder

2024-04-02 Thread Kilian Hanich via devel
Am 02.04.24 um 10:22 schrieb Florian Weimer: - Can some wrappers be developed to make it both easier and safer? GCC already provides function multi-versioning/target clones as a higher-level interface. Also, upstreams should by default properly mark their stuffs with restrictive visibilitie

Re: F42 Change Proposal: Fedora Plasma Workstation (System-Wide)

2024-04-02 Thread Kilian Hanich via devel
Am 03.04.24 um 01:48 schrieb Kevin Fenzi: On Tue, Apr 02, 2024 at 04:06:45PM -0400, Steve Cossette wrote: Alright, so a substantial amount of information changed since the original submission of the change proposal. We aren't necessarily thinking of demoting Gnome. The overall spirit of the CP i

Re: F42 Change Proposal: Fedora Plasma Workstation (System-Wide)

2024-04-03 Thread Kilian Hanich via devel
Am 04.04.24 um 01:03 schrieb Kevin Kofler via devel: You make a good point there. The thing is, GNOME tries really hard to design for new users, whom they define as a user who has never before used a computer. Such users are basically on the edge of extinction. A paradigm that works great for som

Re: F42 Change Proposal: Fedora Plasma Workstation (System-Wide)

2024-04-03 Thread Kilian Hanich via devel
Am 04.04.24 um 01:46 schrieb Sam Varshavchik: This is not going to happen. There's going to be someone else, sitting next to them, who will be teaching the new user how to use a computer. And that someone will /also/ be familiar with traditional desktop concepts and paradigms. They, like the new

Re: F42 Change Proposal: Fedora Plasma Workstation (System-Wide)

2024-04-03 Thread Kilian Hanich via devel
Am 04.04.24 um 03:00 schrieb Gordon Messmer: I think this gets to the heart of the issue.  If we set aside subjective arguments about which desktop is better or more popular, only one of these desktops allows Fedora to publish a stable operating system which is a coherent whole, because only one

Re: convert everything to rpmautospec?

2024-04-08 Thread Kilian Hanich via devel
Am 08.04.24 um 14:55 schrieb Emmanuel Seyman: Well, you and Kevin see "salami tactics" (whatever that may be), FTR, I have no idea what "salami tactics" is. Since apperently multiple people don't know the term: https://en.wikipedia.org/wiki/Salami_slicing_tactics Regards Kilian --

Re: Three steps we could take to make supply chain attacks a bit harder

2024-04-17 Thread Kilian Hanich via devel
Am 17.04.24 um 23:34 schrieb Kevin Kofler via devel: And in my view, the fact that, in those implementations, there is no Treacherous Computing hardware preventing me from doing what I want with my own private key (e.g., just copying the same key to all my devices, as I can also do with TOTP) is

Re: 2FA policy for provenpackagers is now active

2024-06-24 Thread Kilian Hanich via devel
Am 24.06.24 um 09:48 schrieb Mattia Verga via devel: That said, even if the token is stored in the password manager, it is not cushy to be used with kerberos. I have been using 2FA for over a year now and I get used to, but it's clumsy to use it in Fedora infrastructure. I'd really like if we can

Re: 2FA policy for provenpackagers is now active

2024-06-24 Thread Kilian Hanich via devel
Am 24.06.24 um 13:53 schrieb Guinevere Larsen: On 6/24/24 5:08 AM, Miroslav Suchý wrote: Dne 24. 06. 24 v 9:48 dop. Mattia Verga via devel napsal(a): IMO, having the token stored in your password manager means going from 2FA to 1FA effectively ;-) if someone gets access to your password manager

Re: 2FA policy for provenpackagers is now active

2024-06-24 Thread Kilian Hanich via devel
Am 24.06.24 um 17:51 schrieb DJ Delorie: Kilian Hanich via devel writes: One could argue that the "password manager file" is the "something you have" thing. No, one cannot. The three factors in security are: 1. Something you know, which means other people do NOT know i

Re: Following up on: Three steps we could take to make supply chain attacks a bit harder

2024-06-26 Thread Kilian Hanich via devel
Am 27.06.24 um 02:03 schrieb Gordon Messmer: On 2024-06-24 10:34 PM, Alexander Bokovoy wrote: On Пан, 24 чэр 2024, Gordon Messmer wrote: (As a topic for later: the tirpc library exports functions with the same name as functions that appear in libc, so the behavior of erroring on duplicate symbo

Re: strawman proposal: homed directories for users

2024-10-09 Thread Kilian Hanich via devel
Am 09.10.24 um 17:12 schrieb Simo Sorce: Hence I am very curious where you think the security issues are? Sorry, I did not mean in any way to imply there are open security issue with systemd-homed, I meant only that we need to analyze the security assumptions in the context of making this a defa

Re: strawman proposal: homed directories for users

2024-10-08 Thread Kilian Hanich via devel
Am 08.10.24 um 17:32 schrieb Lennart Poettering: For example, I am fundamentally opposed to the model these systems generally pursue of turning UID numbers into centrally, organization-wide managed concepts. Wait a second, some organization have more than 70k people (and in this day and age, the

Re: RFC: Moving to -O3 for Fedora Linux

2024-10-31 Thread Kilian Hanich via devel
Am 31.10.24 um 19:02 schrieb Jakub Jelinek: On Thu, Oct 31, 2024 at 07:47:22PM +0200, drago01 wrote: Isn't instruction cache footprint already part of "performance" i.e if performance is improved it shouldn't matter and vice versa, or what am I missing? That is not how compilers work, ... T

Re: RFC: Moving to -O3 for Fedora Linux

2024-10-31 Thread Kilian Hanich via devel
Am 31.10.24 um 19:18 schrieb Jakub Jelinek: On Thu, Oct 31, 2024 at 07:14:08PM +0100, Kilian Hanich via devel wrote: While we are at it, please don't mix -O2 and -O3 while compiling the same program. This can break things and is really not fun to debug (and that's also the reason wh

Re: PSA: tuned breaks boot loader entries for systemd-boot

2024-11-06 Thread Kilian Hanich via devel
Am 06.11.24 um 11:32 schrieb Zbigniew Jędrzejewski-Szmek: That's not how standards work. It's behaviour undefined by the standard, i.e. undefined behaviour. If it isn't forbidden, or strictly defined, it's still standard compliant. I think we'll have to agree to disagree. If it's "undefined beha