Re: [gentoo-dev] Abuse by gentoo developer

[Mauricio Lima PIlla]

http://www.gentoo.org/proj/en/devrel/policy.xml

"Developer relations should only be involved in a conflict when other
attempts to solve the issue have failed. Developers should attempt
polite discussion relating to the matter at hand to resolve conflict
between themselves. Developers within a single top level project (TLP)
engaged in conflict may wish to consult with the TLP manager. Although
TLP managers are not necessarily qualified to resolve personal disputes,
technical issues resulting in conflict can often be resolved within the
TLP without developer relations involvement. Personal issues should be
brought to the ombudsman via ombudsman@g.o. Developer relations
may get involved when the above methods have failed. For resolution of
technical conflicts spanning more than one TLP, see the section entitled
'Presenting information to management.'"


On Qua, 2005-07-20 at 01:32 +0000, Casey Allen Shobe wrote:
> Hello all, I'm sorry to bring this here, but I don't know where else
> to take it, and feel that I was treated really unfairly.
>
> As you know, I recently inquired about ebuild development on this
> list, and mentioned vpopmail.  Jory Pratt answered my mail and
> suggested that I submit a patch.
>
> I then spent some time working on the ebuild, and in doing so,
> discovered that the postgres support in vpopmail was not very good
> at all, so I wrote back to Jory, and said that I was going to hold
> off working on the ebuild since I am currently working with the
> vpopmail team to improve vpopmail itself.  Jory wrote this rather
> rude reply:
>
> -------------------
> Casey Allen Shobe wrote:
> > Well I patched the ebuild and got it working, but I'm so terribly
> > disappointed with vpopmail's horrible postgresql support that I
> > don't think I'll be using it at all until I rewrite it. :P
> >
> > Ah well, thanks anyways.  I'll let you know when/if they let me
> > fix vpopmail (already posted about it on the list).
>
> The will not allow it and I will not allow someone to go fooling in
> an ebuild I maintain. Not trying to be an ass here but we have
> something called respect for others when it comes to the tree and
> what they maintain.
> >
> > One suggestion for you, some servers (i.e. qmail-smptd) runs as a
> > non-root user, so they will fail to authenticate
> > unless /var/vpopmail/bin/vchkpw is SUID.  I have a script that
> > runs once a minute on my machines and makes this file +s if it's
> > not because I've dealt with this problem so much (mail server
> > breaks every time I rebuild vpopmail).
>
> Default install is setup as setuid seeing we know this already.
> Useless info like this tells me you do not understand the
> permissions that are being set in the ebuild.
> >
> > I would strongly recommend doing chmod +s /var/vpopmail/bin/vchkpw
> > in the ebuild, and then if the end user doesn't want it SUID, then
> > that's what FEATURES=suidctl is for.
>
> This is not how we can handle this the user should have already read
> up on how to setup vpopmail before ever installing it, which means
> they would already know that SUID is required.
> -------------------
>
> So, I wrote the following response, which I feel was courteous
> enough given the situation:
>
> -------------------
> On Tuesday 19 July 2005 16:09, you wrote:
> > The will not allow it and I will not allow someone to go fooling
> > in an ebuild I maintain. Not trying to be an ass here but we have
> > something called respect for others when it comes to the tree and
> > what they maintain.
>
> Umm look, you ARE being an ass, and I don't appreciate it as I'm
> only trying to help.
>
> A> I was simply offering you help - adding support for a postgres
> use flag to the ebuild that called appropriate configure options
> and such.  I have no intent of hacking up vpopmail source outside
> of the main distribution.
>
> B> You are not one to say whether the vpopmail team will or will not
> accept my patches - I believe they will as my intent is to make
> vpopmail a better product, and members of their development team
> have already been welcoming and helpful in discussing the best way
> to redesign things.  It's no secret to the vpopmail team that the
> postgresql support is lacking flexibility and has some bugs, and is
> simply hacked together quickly by people who wanted it to work, and
> didn't care much for ease of use or configurability.  Try it
> yourself, I'm sure you'll be disappointed.  It's simply not as
> configurable as the mysql option, and neither mysql or postgresql
> allow customizing the backend table format without editing i.e.
> vpgsql.h for postgres.
>
> > Default install is setup as setuid seeing we know this already.
> > Useless info like this tells me you do not understand the
> > permissions that are being set in the ebuild.
>
> Umm, no it's not, and it's not useless info.  I reported the bug to
> the gentoo-dev list some months ago, but should have probably used
> bugs.gentoo.org instead.  In any case, it's certainly not installed
> setuid by default:
>
> # emerge -va vpopmail && ls -l /var/vpopmail/bin/vchkpw
>
> These are the packages that I would merge, in order:
>
> Calculating dependencies ...done!
> [ebuild   R   ] net-mail/vpopmail-5.4.6-r1  +clearpasswd -ipalias
> -mysql -postgres 0 kB [1]
> [...]
> >>> net-mail/vpopmail-5.4.6-r1 merged.
> [...]
> -rwx--x--x  1 root root 85036 Jul 19 23:53 /var/vpopmail/bin/vchkpw*
>
> So stop telling me my info is useless, when it's obviously not.
>
> > This is not how we can handle this the user should have already
> > read up on how to setup vpopmail before ever installing it, which
> > means they would already know that SUID is required.
>
> As SUID is required for qmail-smtpd, vchkpw should indeed be
> installed SUID by default unless overridden by using suidctl.  This
> is NOT the case now.
> -------------------
>
> I then received this lovely mail from Jory:
>
> -------------------
> You want to curse me and tell me you think your gonna go playing in
> my vpopmail ebuild you can take your bullshit upstream I am black
> listing you on my filters so I do not need to read your bullshit
> you do not understand the full picture if you did you would know
> vpopmail works with more then just qmail you dumb ass. So have a
> nice Day chow!!
> -------------------
>
> Umm look I'm just trying to help here, and I really feel like I've
> been treated very unfairly by this developer.  I'm working hard to
> try to make vpopmail AND gentoo better products, I'd really
> appreciate not being told on things I know very well that I'm right
> about, and getting severe reactions like this when I prove that my
> statements were indeed correct and that I'm only trying to help.
>
> I really feel that this response whas wholly unjustified, and that I
> did nothing to warrant it.  Please advise.
>
> Cheers,
> --
> Casey Allen Shobe | http://casey.shobe.info
> cshobe@×××××××××××××.com | cell 425-443-4653
> AIM & Yahoo:  SomeLinuxGuy | ICQ:  1494523
> SeattleServer.com, Inc. | http://www.seattleserver.com
-- 
Mauricio Lima Pilla                           pilla@××××××××××.br
ESIN/UCPEL
http://g3pd.ucpel.tche.br/~pilla

"I'm just very selective about the reality I choose to accept."
                                                        -- Calvin

-- 
gentoo-dev@g.o mailing list