[gentoo-dev] maintainer-needed@ packages need you!

[gentoo-dev] maintainer-needed@ packages need you!

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 599 bytes --]

Hello,

Right now, we have 1262 packages assigned to maintainer-needed@. Only
a few of them have a large number of bugs, many have just version bump
requests. 953 packages have no bug open.

Please consider adopting some of the packages, or at least fixing some
of the relevant bugs. For package - bug count list, take a look at [1].
Please note that this list is not autogenerated, so it will soon be
outdated, I hope :).

We should also consider removing some of the packages listed there.

[1]:http://dev.gentoo.org/~mgorny/maintainer-needed.txt

-- 
Best regards,
Michał Górny

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-dev] maintainer-needed@ packages need you!

[Kristian Fiskerstrand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 08/30/2014 01:46 PM, Michał Górny wrote:
> Hello,
> 
> Right now, we have 1262 packages assigned to maintainer-needed@.
> Only a few of them have a large number of bugs, many have just
> version bump requests. 953 packages have no bug open.

Thanks for the reminder and the list.

> 
> Please consider adopting some of the packages, or at least fixing
> some of the relevant bugs. For package - bug count list, take a
> look at [1]. Please note that this list is not autogenerated, so it
> will soon be outdated, I hope :).

I'm using app-crypt/ekeyd with my entropykeys so can take that one at
least.

> 
> We should also consider removing some of the packages listed
> there.
> 
> [1]:http://dev.gentoo.org/~mgorny/maintainer-needed.txt
> 


- -- 
Kristian Fiskerstrand
Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJUAcH8AAoJEPw7F94F4TagzyQP+wcTi0qzXc/PjfMD+djXjMrY
nVzOW0GG5KX94s/WPs3weV/jmF8abPFiENyAB8a0sarXN+aIPb/pG/In54GaAvPS
5JLF1hm2wS5eWVGkXfQidupk8Yunpa/Bek4YoHON+0eFZW8rXxmAre1M8LADXUbM
gOsOkvca8Ar9oe991zRpu+pIl0TsXNb70jh3m8/saW7IUTxWPPyNr0TeS1QkbYHZ
jDceufHZTgUp3qZy9U9f23kDE4w59R5t1K2qSsP8C3ugWflswOCfxnJRiDYc8F69
DWvnQnifZQncD6iXA/EACne/w9cjZFyFKagI2HwlE2h1FfxXy0sBsFwaG8pfSdtp
xikmIWbpZhrAyDTNzfQ/Et/d/JfETqBTWHIZ22HUc25I5NiDhA6OCr4deZEd+aSy
cfdQIgmJxDvsACs0OfI0oZ2d4IsZUgoAS3Yx4lmp+koVa9EhCSvizxc8+Qy4yF0l
v5tObhZ4la5fmu7xzQWrWRTOgADRfoPs6Cur3l3jXirx5dZ4eX8yTSBazJw4sbII
kYjek73o68U9phlcSxm1sY14JfCn4f0dto0C/4hX57mhmx17bLaeA2DpvO6SqNrp
/YP8OnSIf2bTOe2hyRg0CTv6cVNUpSSxYZUuWmJ8ZaAFNNOO0g6lAesMJiar2Ks1
ThEjZv5DHJvkyHLQ3OjI
=6ddH
-----END PGP SIGNATURE-----

Re: [gentoo-dev] maintainer-needed@ packages need you!

[J. Roeleveld]

On Saturday, August 30, 2014 01:46:20 PM Michał Górny wrote:
> Hello,
> 
> Right now, we have 1262 packages assigned to maintainer-needed@. Only
> a few of them have a large number of bugs, many have just version bump
> requests. 953 packages have no bug open.
> 
> Please consider adopting some of the packages, or at least fixing some
> of the relevant bugs. For package - bug count list, take a look at [1].
> Please note that this list is not autogenerated, so it will soon be
> outdated, I hope :).
> 
> We should also consider removing some of the packages listed there.
> 
> [1]:http://dev.gentoo.org/~mgorny/maintainer-needed.txt

I'm not a developer, which means I can't actively pick up any packages. If 
helpful, I would be willing to go through older open bugs and see if there is 
anything I can pick up.

For net-im/skype, I did check a few things last week as I had issues 
connecting:
bugs: 461668, 462504, 440512, 467252, 493068, 512576 are for version <4.3 
which can no longer connect (Versions are being blocked by Skype upstream)
I think these can be closed.
Other bugs:
485792 - xscreensaver not showing skype notifications (I don't actually want 
this myself, so not able to test)
519096 - issue with 32bit compilation (I use amd64 exclusively, unable to 
test)
518922 - hard dependency need to be added for pulseaudio (I see some ebuild-
code already listed, already got pulseaudio installed seperately)
514888 - Seems to be related to an issue with old chat-logs, there are links 
to skype-upstream in the report. This did not occur on my systems.

Re: [gentoo-dev] maintainer-needed@ packages need you!

[hasufell]

On 08/30/2014 02:35 PM, J. Roeleveld wrote:
> 
> For net-im/skype, 

Screw skype. We have tox [1] on the way. Try tox-overlay (not in tree,
because there is no release yet, however it already works relatively well).


[1] https://tox.im

[gentoo-dev] Re: maintainer-needed@ packages need you!

[Martin Vaeth]

hasufell <hasufell@gentoo.org> wrote:
> On 08/30/2014 02:35 PM, J. Roeleveld wrote:
>>
>> For net-im/skype,
>
> Screw skype.

Please don't. Not all communication partners are linux users.

> We have tox [1] on the way.

This is far from being ready, especially for non-specialists.
It is not even foreseeable whether the Android client will ever
be able to do at least audio. (So far, I was not even able to
exchange any messages at all. It may be my mistakes, but
if I am not able to do it, how could I expect this from casual
computer users?)

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[hasufell]

Martin Vaeth:
> hasufell <hasufell@gentoo.org> wrote:
>> On 08/30/2014 02:35 PM, J. Roeleveld wrote:
>>>
>>> For net-im/skype,
>>
>> Screw skype.
> 
> Please don't. Not all communication partners are linux users.
> 

Tox is multiplatform.

>> We have tox [1] on the way.
> 
> This is far from being ready, especially for non-specialists.
> It is not even foreseeable whether the Android client will ever
> be able to do at least audio. (So far, I was not even able to
> exchange any messages at all. It may be my mistakes, but
> if I am not able to do it, how could I expect this from casual
> computer users?)
> 
> 

This has nothing to do with specialists. Tox is configuration-free.

And sure, it's pre-alpha as indicated in my previous mail.

[gentoo-dev] Re: maintainer-needed@ packages need you!

[Martin Vaeth]

hasufell <hasufell@gentoo.org> wrote:
> Martin Vaeth:
>> hasufell <hasufell@gentoo.org> wrote:
>>> On 08/30/2014 02:35 PM, J. Roeleveld wrote:
>>>>
>>>> For net-im/skype,
>>>
>>> Screw skype.
>>
>> Please don't. Not all communication partners are linux users.
>
> Tox is multiplatform.

Perhaps some day in the future. The current state is disenchanting:
Practically nothing on Android or on iOS (no audio,
not to speak about video; it is unclear whether there ever will be).
I don't have windows, but I would be surprised if installation
is already simple for a casual user.

> This has nothing to do with specialists. Tox is configuration-free.

When it is working some day in the future. Currently,
it is just not working for non-specialists. As mentioned:

>> So far, I was not even able to exchange any messages at all.

I had just tried again a few days ago with the newest clients
on linux and android.

> And sure, it's pre-alpha as indicated in my previous mail.

That's the point. When tox is finished and working on all
platforms and easily usable and installable for non-experts,
it might some day become a possible alternative for skype.
I am looking forward for that day.

However, until that day is reached, please do not think about
removing skype from the portage tree.

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[hasufell]

Martin Vaeth:
> However, until that day is reached, please do not think about
> removing skype from the portage tree.
> 


You have confused something. I did not say that anywhere.

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[Patrick Lauer]

On Sunday 31 August 2014 11:39:22 hasufell wrote:
> Martin Vaeth:
> > hasufell <hasufell@gentoo.org> wrote:
> >> On 08/30/2014 02:35 PM, J. Roeleveld wrote:
> >>> For net-im/skype,
> >> 
> >> Screw skype.
> > 
> > Please don't. Not all communication partners are linux users.
> 
> Tox is multiplatform.
> 
> >> We have tox [1] on the way.
> > 
> > This is far from being ready, especially for non-specialists.
> > It is not even foreseeable whether the Android client will ever
> > be able to do at least audio. (So far, I was not even able to
> > exchange any messages at all. It may be my mistakes, but
> > if I am not able to do it, how could I expect this from casual
> > computer users?)
> 
> This has nothing to do with specialists. Tox is configuration-free.
> 
> And sure, it's pre-alpha as indicated in my previous mail.

So it doesn't work, but you feel the need to feel superior by telling everyone 
else that they are doing it wrong.

Sigh.

Can you please troll somewhere else?

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[hasufell]

Patrick Lauer:
> On Sunday 31 August 2014 11:39:22 hasufell wrote:
>> Martin Vaeth:
>>> hasufell <hasufell@gentoo.org> wrote:
>>>> On 08/30/2014 02:35 PM, J. Roeleveld wrote:
>>>>> For net-im/skype,
>>>>
>>>> Screw skype.
>>>
>>> Please don't. Not all communication partners are linux users.
>>
>> Tox is multiplatform.
>>
>>>> We have tox [1] on the way.
>>>
>>> This is far from being ready, especially for non-specialists.
>>> It is not even foreseeable whether the Android client will ever
>>> be able to do at least audio. (So far, I was not even able to
>>> exchange any messages at all. It may be my mistakes, but
>>> if I am not able to do it, how could I expect this from casual
>>> computer users?)
>>
>> This has nothing to do with specialists. Tox is configuration-free.
>>
>> And sure, it's pre-alpha as indicated in my previous mail.
> 
> So it doesn't work,

Wrong, it already works for a lot of people.

> but you feel the need to feel superior by telling everyone 
> else that they are doing it wrong.
> 

The fuq?


I felt the need to tell people about an upcoming alternative for skype.
If you have a problem with that... troll somewhere else.

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 518 bytes --]

Dnia 2014-09-01, o godz. 00:15:42
hasufell <hasufell@gentoo.org> napisał(a):

> I felt the need to tell people about an upcoming alternative for skype.
> If you have a problem with that... troll somewhere else.

No, you felt the need to troll people in the thread that's completely
irrelevant to that. As a punishment, you will maintain 5 maintainer-
needed@ packages!

As for alternative to Skype... we have SIP for almost 20 years. Plus
Google Talk for the resistant.

-- 
Best regards,
Michał Górny

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[Markos Chandras]

On 09/01/2014 12:15 AM, Patrick Lauer wrote:
> On Sunday 31 August 2014 11:39:22 hasufell wrote:
>> Martin Vaeth:
>>> hasufell <hasufell@gentoo.org> wrote:
>>>> On 08/30/2014 02:35 PM, J. Roeleveld wrote:
>>>>> For net-im/skype,
>>>>
>>>> Screw skype.
>>>
>>> Please don't. Not all communication partners are linux users.
>>
>> Tox is multiplatform.
>>
>>>> We have tox [1] on the way.
>>>
>>> This is far from being ready, especially for non-specialists.
>>> It is not even foreseeable whether the Android client will ever
>>> be able to do at least audio. (So far, I was not even able to
>>> exchange any messages at all. It may be my mistakes, but
>>> if I am not able to do it, how could I expect this from casual
>>> computer users?)
>>
>> This has nothing to do with specialists. Tox is configuration-free.
>>
>> And sure, it's pre-alpha as indicated in my previous mail.
> 
> So it doesn't work, but you feel the need to feel superior by telling everyone 
> else that they are doing it wrong.
> 
> Sigh.
> 
> Can you please troll somewhere else?
> 
(picking random email to reply)

can we please move this off-list?

-- 
Regards,
Markos Chandras

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1920 bytes --]

Hello,

On Mon, 01 Sep 2014 07:15:53 +0800 Patrick Lauer wrote:
> On Sunday 31 August 2014 11:39:22 hasufell wrote:
> > Martin Vaeth:
> > > hasufell <hasufell@gentoo.org> wrote:
> > >> On 08/30/2014 02:35 PM, J. Roeleveld wrote:
> > >>> For net-im/skype,
> > >> 
> > >> Screw skype.
> > > 
> > > Please don't. Not all communication partners are linux users.
> > 
> > Tox is multiplatform.
> > 
> > >> We have tox [1] on the way.
> > > 
> > > This is far from being ready, especially for non-specialists.
> > > It is not even foreseeable whether the Android client will ever
> > > be able to do at least audio. (So far, I was not even able to
> > > exchange any messages at all. It may be my mistakes, but
> > > if I am not able to do it, how could I expect this from casual
> > > computer users?)
> > 
> > This has nothing to do with specialists. Tox is configuration-free.
> > 
> > And sure, it's pre-alpha as indicated in my previous mail.
> 
> So it doesn't work, but you feel the need to feel superior by telling everyone 
> else that they are doing it wrong.

Can't agree with you here. I just tried tox (utox client) from
tox-overlay. Works like charm from the box, the only "unusual"
thing I did is keyword added to package.keywords in order to
install live ebuild.

I tested text messages, audio and video from double-nat environment
(where SIP clients can work only using stune and only some of them).

It should be noted that at least in Linux skype is much harder to
install and use since it requires pulseaudio and I don't use
that sh^W stuff. So skype reqires its own LXC container set up
which is doable, but costed me a day (with all tight isolation
stuff). And I even had not mentione that installation of skype
equals to trojan injection into the system (that's why I used all
that LXC and separate X server precautions).

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[J. Roeleveld]

[-- Attachment #1: Type: text/plain, Size: 2593 bytes --]

On Sunday, September 07, 2014 01:16:57 AM Andrew Savchenko wrote:
> Hello,
> 
> On Mon, 01 Sep 2014 07:15:53 +0800 Patrick Lauer wrote:
> > On Sunday 31 August 2014 11:39:22 hasufell wrote:
> > > Martin Vaeth:
> > > > hasufell <hasufell@gentoo.org> wrote:
> > > >> On 08/30/2014 02:35 PM, J. Roeleveld wrote:
> > > >>> For net-im/skype,
> > > >> 
> > > >> Screw skype.
> > > > 
> > > > Please don't. Not all communication partners are linux users.
> > > 
> > > Tox is multiplatform.
> > > 
> > > >> We have tox [1] on the way.
> > > > 
> > > > This is far from being ready, especially for non-specialists.
> > > > It is not even foreseeable whether the Android client will ever
> > > > be able to do at least audio. (So far, I was not even able to
> > > > exchange any messages at all. It may be my mistakes, but
> > > > if I am not able to do it, how could I expect this from casual
> > > > computer users?)
> > > 
> > > This has nothing to do with specialists. Tox is configuration-free.
> > > 
> > > And sure, it's pre-alpha as indicated in my previous mail.
> > 
> > So it doesn't work, but you feel the need to feel superior by telling
> > everyone else that they are doing it wrong.
> 
> Can't agree with you here. I just tried tox (utox client) from
> tox-overlay. Works like charm from the box, the only "unusual"
> thing I did is keyword added to package.keywords in order to
> install live ebuild.
> 
> I tested text messages, audio and video from double-nat environment
> (where SIP clients can work only using stune and only some of them).

It probably works, provided all your contacts also use it.
As long as the vast majority of my contacts use Skype and Yahoo, I will not 
be able to switch. If Kopete (and other generic IM clients) would add 
support for tox, then it would be easier.

> It should be noted that at least in Linux skype is much harder to
> install and use since it requires pulseaudio and I don't use
> that sh^W stuff. So skype reqires its own LXC container set up
> which is doable, but costed me a day (with all tight isolation
> stuff). And I even had not mentione that installation of skype
> equals to trojan injection into the system (that's why I used all
> that LXC and separate X server precautions).

If you want to isolate a package, then yes, it is more difficult then just 
running " emerge skype " (Which works flawlessly for me).

I also had no issues installing pulseaudio. (Apart from having to undo 
some alsa-settings to default to the normal audio output instead of the 
HDMI one).

Which trojan injection are you talking about?

--
Joost

[-- Attachment #2: Type: text/html, Size: 11694 bytes --]

[gentoo-dev] Re: maintainer-needed@ packages need you!

[Duncan]

J. Roeleveld posted on Sun, 07 Sep 2014 17:51:46 +0200 as excerpted:

> On Sunday, September 07, 2014 01:16:57 AM Andrew Savchenko wrote:
>> Hello,
>> 
>> On Mon, 01 Sep 2014 07:15:53 +0800 Patrick Lauer wrote:
>> > On Sunday 31 August 2014 11:39:22 hasufell wrote:
>> > > Martin Vaeth:
>> > > > hasufell <hasufell@gentoo.org> wrote:
>> > > >> On 08/30/2014 02:35 PM, J. Roeleveld wrote:
>> > > >>> For net-im/skype,
>> > > >> 
>> > > >> Screw skype.
>> > > > 
>> > > > Please don't. Not all communication partners are linux users.

The (in)?famous network effect.  A network grows in value based on the 
number of users it has...

>> > > Tox is multiplatform [but] pre-alpha [...]

FWIW, this subthread was the first I had read of it, tho I saw an article 
in the press about it since.  The early 4chan involvement is 
interesting.  This should be rather less controversial but at the same 
time potentially far more (semi-)permanently effective than the LOIC 
stuff.  Good for them! =:^)

>> > So it doesn't work [...]
>> 
>> Can't agree with you here. I just tried tox (utox client) from
>> tox-overlay. Works like charm from the box [...]
>> 
>> I tested text messages, audio and video from double-nat environment
>> (where SIP clients can work only using stune and only some of them).
> 
> It probably works, provided all your contacts also use it.
> 
> As long as the vast majority of my contacts use Skype and Yahoo, I will
> not be able to switch. If Kopete (and other generic IM clients) would
> add support for tox, then it would be easier.

That was the point above about not everyone being a Linux user (aka 
network effect), tho it seemed lost by the point of your parent post even 
if it was still quoted, so thanks for re-making it.

Of course not all users do servantware either and skype's simply not an 
option for them.  FWIW that includes me, no matter what my comm-partners 
might use.  But the network effect remains valid.  I simply can't join 
that network, network effect or not.  So I can certainly identify with 
the screw skype sentiment since that's demonstrably their attitude toward 
potential users who actually care about their rights.

>> It should be noted that at least in Linux skype is much harder to
>> install and use since it requires pulseaudio and I don't use that sh^W
>> stuff. So skype reqires its own LXC container set up which is doable,
>> but costed me a day (with all tight isolation stuff). And I even had
>> not mentione that installation of skype equals to trojan injection into
>> the system (that's why I used all that LXC and separate X server
>> precautions).
> 
> If you want to isolate a package, then yes, it is more difficult then
> just running " emerge skype " (Which works flawlessly for me).
> 
> I also had no issues installing pulseaudio. (Apart from having to undo
> some alsa-settings to default to the normal audio output instead of the
> HDMI one).
> 
> Which trojan injection are you talking about?

I'd guess the no-warrant-NSA-trojan that skype is pretty much known to 
have, given the Edward Snowden and etc. revelations, when it *HAD* been 
claimed to be "secure".

In theory there's at least shreds of the law that was supposed to protect 
US citizens left, if only shreds, but there's been no candy-coating the 
fact that if you don't happen to be a US citizen, they felt no 
compunction whatsoever.  Whatever US citizens may feel about it then, 
certainly for everyone else in the world it's a trojan, period.  That 
some g-men injected it (or forced MS to) is immaterial, when it wasn't 
/their/ g-men.

(FWIW I'm a US citizen and I'm none-too-happy about the NSA's actions 
either, but obviously I'm in the minority as Obama got elected after 
retroactively authorizing otherwise law-breaking actions, etc, and few if 
any other politicians who voted for that or any of the other shenanigans 
seem to have been kicked out due to it either, so what can I say?)

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

[gentoo-dev] tox (was: maintainer-needed@ packages need you!)

[Martin Vaeth]

This discussion has now become rather OT and does not belong
to this list. Anyway, since there appear to be some misunderstandings
concerning my previous remarks, I contribute one more post.

Duncan <1i5t5.duncan@cox.net> wrote:
>>> > > > Please don't. Not all communication partners are linux users.
>
> The (in)?famous network effect.  A network grows in value based on the
> number of users it has...

Not only: You might convince your communication partners to switch.
However, they must be able to switch on *their* systems easily
(and not have to install linux or solve other technical obstacles).

>>> > So it doesn't work [...]
>>>
>>> Can't agree with you here. I just tried tox (utox client) from
>>> tox-overlay. Works like charm from the box [...]

Maybe from utox to utox. From utox to antox (the android client) -
which is the only case that I can reasonably test - I was only once
able to send a friends request from antox to utox, but no message,
and nothing in the opposite direction. After an antox upgrade,
I cannot even use my login anymore, probably since the ID has
changed due to upgrade...

Also, you cannot be behind a restrictive NAT. For instance, one of
my NAT routers cannot easily be configured to forward the exotic port,
and then there is also the problem of UDP hole punching - not sure,
whether this is solved in tox at all.

I never tried to examine how skype does it, but opening ports in
NAT routers was never necessary for skype, probably because it
switches ports automatically as required. Moreover, since it uses
a central server, there is no UDP punching problem.

Such "magic" (like automatic port switching) is required if you
really want to suggest it to users who are not computer-affine:
It must really be "configuration free" - also in difficult situations -
and work out of the box. Currently, it apparently works only on some
only-linux clients, and only if the network is configured fine
for them.

>> As long as the vast majority of my contacts use Skype and Yahoo
>
> That was the point above about not everyone being a Linux user

No, I think these are different points: My point was about whether
people are *technically* able to switch (if all agree). The other
is whether people are *socially* able to switch.
Of course, both must be solved, but the former is the requirement
for the latter, and tox still seems to have a long way to reach
the former.

>>> It should be noted that at least in Linux skype is much harder to
>>> install and use since it requires pulseaudio

But this concerns only Linux users who probably are computer-affine
and can solve such problems (or know somebody who is).

>>> So skype reqires its own LXC container set up

Not really. There is a forum post how to use skype (*only* skype)
with pulseaudio (once bug 519530 gets fixed, you can even do this
without patching any ebuild or configuration.)

To avoid a misunderstanding: I really oppose the non-privacy
policy of skype, and hardly can await until tox is ready.
However, the current state is that skype is without alteratives
for many people.
Moreover, suggesting tox to casual computer users too early -
like now when many technical problems are not yet solved -
would be rather contraproductive and actually kill tox:
People who once had a bad experience will likely refuse to switch
when tox *is* ready.

Re: [gentoo-dev] tox

[Alexander Berntsen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Check out Linphone. Works well to Mac OS X and Microsoft Windows in my
experience. The interface is not great, but several non-technical
users have been able to use it to talk to me, so it can't be that bad
while we're waiting for Tox to mature.

Using Skype is for suckers in any event.
- -- 
Alexander
bernalex@gentoo.org
https://secure.plaimi.net/~alexander
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iF4EAREIAAYFAlQOo1gACgkQRtClrXBQc7VC6AD+I1ocqmKdYaVgCgXkXu1qVFpC
eHrEM8+3FBErcOiumhYBAJ3fl/ApY2BsrKHb+9gp38zjMnmjxU0fT95i6zdxb7XX
=sooz
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 957 bytes --]

Hello,

On Sun, 07 Sep 2014 17:51:46 +0200 J. Roeleveld wrote:
> It probably works, provided all your contacts also use it.
> As long as the vast majority of my contacts use Skype and Yahoo, I will not 
> be able to switch. If Kopete (and other generic IM clients) would add 
> support for tox, then it would be easier.

There is a tox plugin for pidgin in tox-overlay.

> Which trojan injection are you talking about?

I'm talking about the following research:
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CB4QFjAA&url=https%3A%2F%2Fwww.blackhat.com%2Fpresentations%2Fbh-europe-06%2Fbh-eu-06-biondi%2Fbh-eu-06-biondi-up.pdf&ei=9jAPVJH1AafnygOOiIHgDg&usg=AFQjCNHeILDYY4k-nUUw8vPmUCJ86Eywbg&bvm=bv.74649129,d.bGQ

Of course, skype protocol was likely changed since that time, but I
really doubt that functionality for remote execution of arbitrary
code was removed.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]

OT - My last one to this thread - Skype + Tox - Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[J. Roeleveld]

On Tuesday, September 09, 2014 08:59:41 PM Andrew Savchenko wrote:
My last response to this, as it is getting too OT

> Hello,
> 
> On Sun, 07 Sep 2014 17:51:46 +0200 J. Roeleveld wrote:
> > It probably works, provided all your contacts also use it.
> > As long as the vast majority of my contacts use Skype and Yahoo, I will
> > not
> > be able to switch. If Kopete (and other generic IM clients) would add
> > support for tox, then it would be easier.
> 
> There is a tox plugin for pidgin in tox-overlay.

That's nice for pidgin users. When others follow, uptake will be easier.

> > Which trojan injection are you talking about?
> 
> I'm talking about the following research:
> https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact
> =8&ved=0CB4QFjAA&url=https%3A%2F%2Fwww.blackhat.com%2Fpresentations%2Fbh-eur
> ope-06%2Fbh-eu-06-biondi%2Fbh-eu-06-biondi-up.pdf&ei=9jAPVJH1AafnygOOiIHgDg&
> usg=AFQjCNHeILDYY4k-nUUw8vPmUCJ86Eywbg&bvm=bv.74649129,d.bGQ
> 
> Of course, skype protocol was likely changed since that time, but I
> really doubt that functionality for remote execution of arbitrary
> code was removed.

That research was from 2006. Over 8 years ago.
Do you avoid using Bind because of all the security bugs it had in 2006?
What about OpenSSL, that one had a big one not too long ago.
And I'm sure I can find plenty of exploits for the Linux kernel based on the 
versions in use in 2006.

The Skype protocol has changed a lot over the years and older versions of the 
protocol have been deprecated and removed.

If it is still in there, I'm certain it would be known, considering the amount 
of people using Skype these days.

--
Joost

Re: OT - My last one to this thread - Skype + Tox - Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1749 bytes --]

Hi,

On Wed, 10 Sep 2014 07:50:05 +0200 J. Roeleveld wrote:
> > I'm talking about the following research:
> > https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact
> > =8&ved=0CB4QFjAA&url=https%3A%2F%2Fwww.blackhat.com%2Fpresentations%2Fbh-eur
> > ope-06%2Fbh-eu-06-biondi%2Fbh-eu-06-biondi-up.pdf&ei=9jAPVJH1AafnygOOiIHgDg&
> > usg=AFQjCNHeILDYY4k-nUUw8vPmUCJ86Eywbg&bvm=bv.74649129,d.bGQ
> > 
> > Of course, skype protocol was likely changed since that time, but I
> > really doubt that functionality for remote execution of arbitrary
> > code was removed.
> 
> That research was from 2006. Over 8 years ago.
> Do you avoid using Bind because of all the security bugs it had in 2006?
> What about OpenSSL, that one had a big one not too long ago.
> And I'm sure I can find plenty of exploits for the Linux kernel based on the 
> versions in use in 2006.
> 
> The Skype protocol has changed a lot over the years and older versions of the 
> protocol have been deprecated and removed.

There is a large difference between mistake, bug and deliberately
added functionality. As research shows, remote code execution was
deliberately added. What was a bug is a mistake that allowed
third-party to use this feature without proper keys.
 
> If it is still in there, I'm certain it would be known, considering the amount 
> of people using Skype these days.

Ablosute majority of these people are not IT specialists and even
for those that are, skype is extremely hard to decrypt, diassemble
and study, as one can see from the work above. Most probably that
nobody cares to spend several months of full-time employment to
analyze modern skype versions again.


Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[Diamond]

On Sun, 7 Sep 2014 01:16:57 +0400
Andrew Savchenko <bircoph@gmail.com> wrote:


> It should be noted that at least in Linux skype is much harder to
> install and use since it requires pulseaudio and I don't use
> that sh^W stuff. So skype reqires its own LXC container set up
> which is doable, but costed me a day (with all tight isolation
> stuff). And I even had not mentione that installation of skype
> equals to trojan injection into the system (that's why I used all
> that LXC and separate X server precautions).

Can you give any reference about how to isolate Skype properly using
LXC?

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[Matthias Maier]

Am 09. Jan 2015, 23:42 schrieb Diamond <diamond@hi-net.ru>:

>> [...] (that's why I used all
>> that LXC and separate X server precautions).
>
> Can you give any reference about how to isolate Skype properly using
> LXC?

I'm also interested in the separate X server part =)

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1309 bytes --]

Hi,

On Sat, 10 Jan 2015 00:01:46 +0100 Matthias Maier wrote:
> Am 09. Jan 2015, 23:42 schrieb Diamond <diamond@hi-net.ru>:
> >> [...] (that's why I used all
> >> that LXC and separate X server precautions).
> >
> > Can you give any reference about how to isolate Skype properly using
> > LXC?

This one is a good walkthrough:
https://www.stgraber.org/2014/02/09/lxc-1-0-gui-in-containers/
Though it uses the same X server

> I'm also interested in the separate X server part =)

I'm too lazy to write a full manual right now.
In short, there are two ways to solve this:

1) Setup X server in LXC container. This will require a lot of
maintenance (and trouble) during setup and updates.

2) Build xorg with USE="xnest", run it, and provide an access to
required display to skype (via either Unix or TCP socket).

Beware that one wouldn't be able to change window sizes and
positions that way, so one would probably want to run some simple
WM, like twm.

Another note is that skype will still be able to intercept audio
and video input (if configured so, otherwise one wouldn't be able
to use it otherwise as instant messenger), so it should be run only
on per-needed basis (or at least given an access to this devices
on per-needed basis).

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-dev] Re: maintainer-needed@ packages need you!

[Сергей]

Skype can be built with Apulse support, which is a PulseAudio emulator.

Re: [gentoo-dev] maintainer-needed@ packages need you!

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1485 bytes --]

Dnia 2014-08-30, o godz. 14:35:20
"J. Roeleveld" <joost@antarean.org> napisał(a):

> On Saturday, August 30, 2014 01:46:20 PM Michał Górny wrote:
> > Hello,
> > 
> > Right now, we have 1262 packages assigned to maintainer-needed@. Only
> > a few of them have a large number of bugs, many have just version bump
> > requests. 953 packages have no bug open.
> > 
> > Please consider adopting some of the packages, or at least fixing some
> > of the relevant bugs. For package - bug count list, take a look at [1].
> > Please note that this list is not autogenerated, so it will soon be
> > outdated, I hope :).
> > 
> > We should also consider removing some of the packages listed there.
> > 
> > [1]:http://dev.gentoo.org/~mgorny/maintainer-needed.txt
> 
> I'm not a developer, which means I can't actively pick up any packages. If 
> helpful, I would be willing to go through older open bugs and see if there is 
> anything I can pick up.
> 
> For net-im/skype, I did check a few things last week as I had issues 
> connecting:
> bugs: 461668, 462504, 440512, 467252, 493068, 512576 are for version <4.3 
> which can no longer connect (Versions are being blocked by Skype upstream)
> I think these can be closed.

Is it fine to remove all versions <4.3 from the tree then?

By the way, you can proxy-maintain some of those packages if you like.
See [1].

[1]:https://wiki.gentoo.org/wiki/Project:Proxy_Maintainers

-- 
Best regards,
Michał Górny

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-dev] maintainer-needed@ packages need you!

[J. Roeleveld]

On Saturday, August 30, 2014 04:51:35 PM Michał Górny wrote:
> Dnia 2014-08-30, o godz. 14:35:20
> 
> "J. Roeleveld" <joost@antarean.org> napisał(a):
> > On Saturday, August 30, 2014 01:46:20 PM Michał Górny wrote:
> > > Hello,
> > > 
> > > Right now, we have 1262 packages assigned to maintainer-needed@. Only
> > > a few of them have a large number of bugs, many have just version bump
> > > requests. 953 packages have no bug open.
> > > 
> > > Please consider adopting some of the packages, or at least fixing some
> > > of the relevant bugs. For package - bug count list, take a look at [1].
> > > Please note that this list is not autogenerated, so it will soon be
> > > outdated, I hope :).
> > > 
> > > We should also consider removing some of the packages listed there.
> > > 
> > > [1]:http://dev.gentoo.org/~mgorny/maintainer-needed.txt
> > 
> > I'm not a developer, which means I can't actively pick up any packages. If
> > helpful, I would be willing to go through older open bugs and see if there
> > is anything I can pick up.
> > 
> > For net-im/skype, I did check a few things last week as I had issues
> > connecting:
> > bugs: 461668, 462504, 440512, 467252, 493068, 512576 are for version <4.3
> > which can no longer connect (Versions are being blocked by Skype upstream)
> > I think these can be closed.
> 
> Is it fine to remove all versions <4.3 from the tree then?

Should be as they will never work.
I got an email from Skype about it which I can forward, but it's in Dutch. 
(Couldn't quickly find a version in English)

> By the way, you can proxy-maintain some of those packages if you like.
> See [1].
> 
> [1]:https://wiki.gentoo.org/wiki/Project:Proxy_Maintainers

I'll have a look which of the "maintainer-needed" packages I use and know 
sufficiently to assist with.

--
Joost

Re: [gentoo-dev] maintainer-needed@ packages need you!

[Dirkjan Ochtman]

On Sat, Aug 30, 2014 at 1:46 PM, Michał Górny <mgorny@gentoo.org> wrote:
> Please consider adopting some of the packages, or at least fixing some
> of the relevant bugs. For package - bug count list, take a look at [1].
> Please note that this list is not autogenerated, so it will soon be
> outdated, I hope :).

Nice list!

Looks like the dev-python category is mostly in good shape.

I might start looking at app-text/asciidoc sometime soon. In my
opinion, www-apache/mod_python can be last-rited, but IIRC we have
some users that want it to stick around. If dev-python/rtf2xml is
actually Jython-based, perhaps it should be last-rited as well.

Cheers,

Dirkjan

Re: [gentoo-dev] maintainer-needed@ packages need you!

[Markos Chandras]

On 08/30/2014 12:46 PM, Michał Górny wrote:
> Hello,
> 
> Right now, we have 1262 packages assigned to maintainer-needed@. Only
> a few of them have a large number of bugs, many have just version bump
> requests. 953 packages have no bug open.
> 
> Please consider adopting some of the packages, or at least fixing some
> of the relevant bugs. For package - bug count list, take a look at [1].
> Please note that this list is not autogenerated, so it will soon be
> outdated, I hope :).
> 
> We should also consider removing some of the packages listed there.
> 
> [1]:http://dev.gentoo.org/~mgorny/maintainer-needed.txt
> 

We already maintain such a list (along with instructions how to get
involved) here

https://www.gentoo.org/proj/en/qa/treecleaners/maintainer-needed.xml

-- 
Regards,
Markos Chandras

Re: [gentoo-dev] maintainer-needed@ packages need you!

[Joshua Kinard]

On 08/30/2014 07:46, Michał Górny wrote:
> Hello,
> 
> Right now, we have 1262 packages assigned to maintainer-needed@. Only
> a few of them have a large number of bugs, many have just version bump
> requests. 953 packages have no bug open.
> 
> Please consider adopting some of the packages, or at least fixing some
> of the relevant bugs. For package - bug count list, take a look at [1].
> Please note that this list is not autogenerated, so it will soon be
> outdated, I hope :).
> 
> We should also consider removing some of the packages listed there.
> 
> [1]:http://dev.gentoo.org/~mgorny/maintainer-needed.txt


> sys-apps/v86d

Base-system or the kernel team should probably handle this, since it's
required for the uvesafb driver in the kernel.  Though I haven't figured out
how it works yet.


> net-misc/ipx-utils

I'll see about playing with this some more.  I have several installs of
NetWare (3.2, 4.2, 6.5) in VMs, and dabble w/ IPX at random.  Bug #420053 is
from a collision w/ several manpages in net-fs/ncpfs, so I wonder if this
package is a split of some component of ncpfs or not...


> app-arch/lzma

Doesn't app-arch/xz-utils effectively deprecate this?


> net-firewall/fwbuilder

I've maintained this in the past, but I believe upstream is dead due to the
two main developers quitting the company that was behind this project.  It's
still highly useful, and the only GUI-based firewall building tool out there
(that I know of).  I believe there were some rumours of restarting
development under another fork, but I haven't looked for any kind of updates
in some time.

-- 
Joshua Kinard
Gentoo/MIPS
kumba@gentoo.org
4096R/D25D95E3 2011-03-28

"The past tempts us, the present confuses us, the future frightens us.  And
our lives slip away, moment by moment, lost in that vast, terrible in-between."

--Emperor Turhan, Centauri Republic

Re: [gentoo-dev] maintainer-needed@ packages need you!

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 408 bytes --]

Dnia 2014-09-01, o godz. 17:44:04
Joshua Kinard <kumba@gentoo.org> napisał(a):

> > app-arch/lzma  
> 
> Doesn't app-arch/xz-utils effectively deprecate this?

Not exactly. You mean app-arch/lzma-utils that is gone already.

app-arch/lzma is actually the original SDK from 7-Zip. Not sure if
anyone needs it for anything since the raw format isn't really used.

-- 
Best regards,
Michał Górny

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 949 bytes --]