Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-08 Thread Eddie Chapman
Michael Orlitzky wrote: On Sun, 2024-04-07 at 15:07 +0200, Andreas K. Huettel wrote: tl;dr can we turn them back off in the profile? In any scenario where they are beneficial, there's a better place to put them. Easily doable with lzma, if there is consensus for it. Slightly more complex

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-08 Thread Michael Orlitzky
On Sun, 2024-04-07 at 15:07 +0200, Andreas K. Huettel wrote: > > tl;dr can we turn them back off in the profile? In any scenario where > > they are beneficial, there's a better place to put them. > > Easily doable with lzma, if there is consensus for it. > > Slightly more complex for zstd since t

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-07 Thread Michał Górny
On Mon, 2024-04-08 at 01:22 +0100, Alex Boag-Munroe wrote: > On Sun, 7 Apr 2024 at 22:09, Michael Orlitzky wrote: > > > What I am saying is that I want the freedom to not have things > > pointlessly enabled on my systems, because similar problems (and worse) > > happen all day every day. The less

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-07 Thread Alex Boag-Munroe
On Sun, 7 Apr 2024 at 22:09, Michael Orlitzky wrote: > What I am saying is that I want the freedom to not have things > pointlessly enabled on my systems, because similar problems (and worse) > happen all day every day. The less exposure I have, the better. The > liblzma backdoor was timely becau

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-07 Thread Michael Orlitzky
On Sun, 2024-04-07 at 16:48 +0200, Michał Górny wrote: > > So, what you're basically saying, is that the best Gentoo response right > now would be to frantically remove LZMA support everywhere? I'm sure > that would be so much better than our response of masking vulnerable > versions and issuing

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-07 Thread Michał Górny
On Sun, 2024-04-07 at 08:51 -0400, Michael Orlitzky wrote: > On Sun, 2024-04-07 at 14:35 +0200, Andreas K. Huettel wrote: > > > > Uhh, I dont really remember, I think some Chinese-sounding guy asked > > me for it... (j/k) > > It is remarkably bad timing. How it looks: Gentoo's response to the xz

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-07 Thread Andreas K. Huettel
Am Sonntag, 7. April 2024, 14:51:55 CEST schrieb Michael Orlitzky: > On Sun, 2024-04-07 at 14:35 +0200, Andreas K. Huettel wrote: > > > > Uhh, I dont really remember, I think some Chinese-sounding guy asked > > me for it... (j/k) > > It is remarkably bad timing. How it looks: Gentoo's response t

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-07 Thread Michael Orlitzky
On Sun, 2024-04-07 at 14:35 +0200, Andreas K. Huettel wrote: > > Uhh, I dont really remember, I think some Chinese-sounding guy asked > me for it... (j/k) It is remarkably bad timing. How it looks: Gentoo's response to the xz incident is to have me rebuild my entire system with everything that c

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-07 Thread Andreas K. Huettel
Am Sonntag, 7. April 2024, 04:03:01 CEST schrieb Michael Orlitzky: > On Sat, 2024-04-06 at 17:06 +0200, Andreas K. Huettel wrote: > > Hi all, > > > > so here's a small update on the state of the 23.0 profiles: > > > > Why was this silently added to make.defaults for all 23.0 profiles? > > > #

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-07 Thread Andreas K. Huettel
> > Most 17.x profiles have been downgraded to "exp". > > I could imagine there is a reason to downgrade those back to 'exp', > could you elaborate a bit on that? > > Isn't it bit strange that a 'stable' profiles gets downgraded back to > 'exp'? Then again, I am not sure about the implications

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-07 Thread Florian Schmaus
On 06/04/2024 17.06, Andreas K. Huettel wrote: Hi all, so here's a small update on the state of the 23.0 profiles: Thanks for the update and the work on the 23.0 profiles. :) Most 17.x profiles have been downgraded to "exp". I could imagine there is a reason to downgrade those back to 'ex

Re: [gentoo-dev] Update on the 23.0 profiles

2024-04-06 Thread Michael Orlitzky
On Sat, 2024-04-06 at 17:06 +0200, Andreas K. Huettel wrote: > Hi all, > > so here's a small update on the state of the 23.0 profiles: > Why was this silently added to make.defaults for all 23.0 profiles? > # This just makes sense nowadays, if only for distfiles... > USE="lzma zstd"