OT: Re: [gentoo-dev] [PATCH 1/1] profiles: drop USE=cracklib from base/make.defaults.

[Nils Freydank <holgersson@posteo.de>]

[-- Attachment #1: Type: text/plain, Size: 2832 bytes --]

Am Mittwoch, 27. Dezember 2017, 22:33:03 CET schrieb R0b0t1:
> On Wed, Dec 27, 2017 at 10:32 AM, William Hubbs <williamh@gentoo.org> wrote:
> > As he said, he contactedd the maintainers in ample time, so I would say
> > that since they didn't respond he went ahead in good faith. I'll get the
> > link later, but as I recall, the dev manual recommends a 2-4 week wait
> > for maintainers not responding then we can assume that what we are doing
> > is ok.
> 
> This assumes there is some pressing need for the change to take place,
> which I am not sure there is. I can understand wanting to make the
> change for consistency's sake, but the feature is important enough
> that I think a suitable replacement should explicitly be found before
> continuing. E.g. affirmative feedback from all affected packages.

Often a fix timeline is the only way to achieve any responses - or at least
get stuff done, even if the matter itself is not urgent at all. In this 
specific case the points Michael had were quite clear, and the timespan of
two month was long enough to react somehow (at least in the context of typical
periods in Gentoo, e.g. last rite/removal period of 30 days).

On topic: There are some users including myself that find cracklib mostly 
annoying. I use strong passwords (or ssh keys only) where I can, and cracklib 
annoys me with the request to set "secure passwords" for a container 
playground, where I want root:test as login credentials.
Beside that the point that profiles in general should contain as least USE as 
possible (see the bug report for that).

> Enforcement of rules or Gentoo development guidelines does not happen
> consistently, and the times when rules are enforced "for consistency's
> sake" seem completely arbitrary. There seems to be no extant problems
> caused by the flag as set, so why focus on this specifically?

To me these times look as they're based upon agreement between the involved 
parties, and in itself consistently, e.g. at least 30 days masking before
removal out of the tree, or in this case at least two to four weeks to let 
others respond.

> There is a lot of discussion of not burdening developers with
> pointless talk or changes. If that is a goal, then why is this posting
> receiving so many replies?

With all due respect, your posting didn't bring any new relevant aspects into 
this thread on this mailing list with the explicit focus and topic of Gentoo 
development, and might be exactly part of the "pointless talk" you mention.

My one isn't better; I just want to point that out to you, because you tend to
write messages with this kind of meta questions about the cause of things.

If you want to discuss this, I'd prefer another place than this list.

Regards,
Nils

-- 
GPG fingerprint: '00EF D31F 1B60 D5DB ADB8 31C1 C0EC E696 0E54 475B'
Nils Freydank

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]