Re: [gentoo-dev] Project Sunrise resumed again (was Resignation)

[Patrick Lauer]

On Thu, 2006-08-03 at 18:21 +0200, Carsten Lohrke wrote:
> The difference is that I argue, while you accuse me to play false. I consider
> this as ad hominem and together with all this "FUD" and "BS" calling, in
> contrary to my email, inflammatory.
... and that is inflammatory :-)

> > > I'd appreciate, if you would try to have a controversial
> > > discussion, without starting to loose your manners.
> >
> > And I'd appreciate a less condescending tone.
>
> This wasn't meant condescending, but a true request. Because it's not the
> first time you react this way, when you dislike another ones opinion. It is
> as annoying as Ciaran's habit to make statements without backing them up -
> even when asked to do so.
I think it's a language barrier - as you (and I) are not native english speakers we tend to put a different emphasis on words.
What may look perfectly polite to you could be a big insult to a french
or japanese speaker ...

That being said, I'd interpret what you've written as mildly
condescending too.


> > 3) Assumption that sunrise will just be a dumping ground, without any
> > form of maintainance is implicit here- if it becomes as such, already
> > was stated it would get wedgied by the council.  So that leaves the
> > angle of "they don't have a security team", which implies to actually
> > handle nuking vulnerable ebuilds, one has to have a security team
> > (obviously false).
>
> Dumping ground or not. It's easy to miss vulnerability notices. Especially, if
> you don't have guys who expclicitly care for it. And you need a security team
> to announce issue to the user base. I wouldn't use Gentoo, if we not had such
> a hard and good working security team.
>
I wonder if all inofficial overlays and bugs are always updated?
Sunrise is still young, but the way they've handled bugreports makes me
quite confident that they'll be able to handle security issues when they
have reached a stable and sustainable size. 

> > Besides... frankly it's kind of BS to push the vuln angle onto sunrise
> > when gentoo can't even clean out years old vulnerable packages from
> > gentoo-x86 (that doesn't absolve sunrise from having to watch it, nor
> > a potshot at the understaffed security team, merely that double
> > standards suck).
>
> Interesting to see you state this. Because this is a far more serious problem,
> than supporting "everything" possible; And Sunrise won't fix this either - if
> not the opposite. One of the goals of Sunrise is to recruit new devs. But we
> don't need new devs to add new packages primarily, we more to maintain
> existing and not so fancy stuff and to clean out the tree.
>
How do you train devs?
Also, who is only working on the things he did when he initially became
dev?

[snip]
> Your list is rubbish. There're stable versions for all security wise supported
> architectures and the relevant GLSA's. If users don't use them, it's their
> local problem.
If users use sunrise it's their local problem, too. 
>
> > > > And... just cause I'm mildly sick of this bullshit,
> > >
> > > And I'm sick of people, who miss the point.
> >
> > As stated above, be concise then.  Your points came out of pretty
> > much nowhere, poorly communicated, and rather vague in actually
> > backing them up.  Which... at least from the "backing up the
> > complaints", has been the theme for the screaming folk thus far.
>
> Do I have to learn you to read? See above.
^^ that is really condescending. 


> > So someone goes and breaks something in gentoo-x86 that breaks
> > something for sunrise.  Fine, it's sunrises' mess to clean up; they've
> > volunteered to do this work, I don't see how you can claim it as a
> > negative when they've accepted it as part of _their_ work.
>
> The problems will pile up in bugs.g.o and "usally" with the wrong addressee.
> This has been every now and then the case with other overlays as well as
> users of distros building on Gentoo. I can live with that to a degree. But
> when we do this mess ourselves, it get's highly annoying.
Hmmm?
The problem with most other overlays is that they also may have updated
or patched versions of in-tree applications. Most problems that you
claim should not happen in sunrise.

> > Granted, they may give you the finger and quit, or your remaining
> > fellow devs may rightfully boot you for playing games, but the point
> > stands- they stepped up to do the work, including cleaning up
> > anything y'all may break for them.
>
> You're doing it again. No I'm not playig games with you. I have reasonable
> complaints and consider this sort of overlay a failure. Then an extra
> development tree would be much better.

I still fail to see what your issues with it are. All the points you
stated are either invalid or not an issue from my p.o.v.

>
> > You're not limited- they're the ones limited via trying to not step on
> > gentoo-x86's toes.  How is that a negative then?
>
> I fear for the security of our user base, especially the lazy, uneducated
> ricers and how this wll reflect on Gentoo's reputation as a whole.
What is Gentoo's reputation? I mean ... people have said this a few
times, but has anyone just asked a random subset of linux users how they
see Gentoo?

I guess having a reputation of being bleeding edge, having fast-paced
development (with many transient bugs because of the rapid pace of
change) and being really easy to use conflicts really hard with Sunrise,
right?

> I fear
> more annoying, invalid bug reports. I don't see any benefit for the existing
> tree or Gentoo as a whole.
So ignore it. You don't have to use it, but you're trying to limit other
devs and users (who may become devs) in their freedom to work on any
aspect of gentoo they like. 
Ebuilds rotting for years in bugzilla (and bugzilla can be quite
confusing to use) can not be better than a maintained overlay where
people even review ebuilds for mistakes. I wonder why you're implicitly
advocating the worse policy, that (from my point of view) is silly and
more damaging to Gentoo, if anything is getting damaged at all.

I don't see any benefits in not supporting (or just passively ignoring)
sunrise. If it fails you can still pull the plug, but until now it has
been quite successful in finding motivated users and putting them to
use. Granted, communication has been difficult,but the reactions from
some devs look really bizzare and extreme to me.
(Just food for thought - you shut down sunrise. I pick up the pieces,
host it on my hardware and do what I want. You can't stop me, you can't
influence my policies, you haven't gained a thing. Users still use The
Overlay Formerly Known as Sunrise and complain that Gentoo sucks
(because that overlay has wrecked their machine, I'm a mean bastard
after all! 
That's why you should keep Sunrise running and controllable by Gentoo
people.)


Have fun,

Patrick
-- 
Stand still, and let the rest of the universe move