Re: [gentoo-dev] Finger GLEP

[Kurt Lieber <klieber@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1612 bytes --]

On Sun, Aug 10, 2003 at 10:39:14PM +0000 or thereabouts, Tavis Ormandy wrote:
> Hey, please find attached a glep proposal for a Gentoo.org Finger
> Daemon in docutils text.

OK, I guess this one is an infrastructure GLEP to approve/reject.  I'd also
like to get input from seemant as the devrel manager.

I have security concerns about running fingerd, but I can see how the
benefits outweigh the risks in this case.  However, there are still several
areas that I don't see being addressed by this GLEP:

1) We already suffer from what I call "information sprawl" right now,
meaning we have the same information spread out across multiple places,
with no one place being the "master repository".  The net result of this is
that users have to hunt through multiple repositories to try to find out
which one the developer chose to use for their particular query.

What ensures that the data available via fingerd will be a) complete
(meaning how will you ensure all developers participate) and b) up-to-date?
IMO, we need to identify one master source of information and *ensure* that
is used and kept up-to-date.  If we want to provide multiple avenues to
access that info, that's fine, but we need one database, not multiple ones.

2) Tangental to the issue above, we've already talked about placing things
like GPG keys on the web site in XML format and pulling the other info (dev
name, location, projects, etc.) in via XML as well.  Why is the fingerd
solution a better one?  Items on the web site are updated hourly.  I can't
think of too many cases where that type of freshness isn't timely enough.

--kurt

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]