From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 17FA91396D0 for ; Sun, 20 Aug 2017 06:05:28 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id B39FCE0C63; Sun, 20 Aug 2017 06:05:21 +0000 (UTC) Received: from mail-yw0-x22b.google.com (mail-yw0-x22b.google.com [IPv6:2607:f8b0:4002:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 60B4BE0B7D for ; Sun, 20 Aug 2017 06:05:21 +0000 (UTC) Received: by mail-yw0-x22b.google.com with SMTP id h127so8798282ywf.0 for ; Sat, 19 Aug 2017 23:05:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-transfer-encoding; bh=LFq+asx8ZGgPGuI5BEG6EO0MapbMFtCn7gexRGO3Sgc=; b=k3cHft1lDmAHIaKTBzYEEQwpwRMc1hkmK0t0ftrZ3oqkOr9WSvnTw43vCvFbiU0iIV 8w23d7eijVSetInSAnhtcTAAFzmikhiQsfuQfbIKj68kCMUfq+ODn7LIkvbsj6pTspOS FAQlBorZIQYlxzWO1BfjBelk6GJpG2J/FE/UAPL9TUpnh0I9H5/83MR6yT1D2hKvpUAY LKSKfGUXut6IEaeeJDqYRjTuz2fKGffimnqn0m3gRildctCFNfvONGcz5IEpExbKpy73 vuMJrh3C5suylcFatdqm/CTx+rPLeltxkrBXVmEac/VwlJ7RC2C9Ctw8HsBsNYLHulKM nMIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:content-transfer-encoding; bh=LFq+asx8ZGgPGuI5BEG6EO0MapbMFtCn7gexRGO3Sgc=; b=exv0msHNCcaQHQWq8bsfQic4zpRrAIh5UmMXKRuxAnH4DKRuoeAYZMxbNFcS8ggrfT 9BJcnWxhJsfhN273cp/D1dA90ziqXmAjgmfkKoYyOnXQ5YcpPGl45LgsB7EoxYv0s54r GYXQSzfUaOUqWl/McKocjCSyn1/em3hmLNWEFwXH6Fw6ZRU7aSDKVPbVnC4sJGdvjl9k uA5l6n9kytLNlIUyqCl+afrkWTxtN20o4IxcXONtxbtWmJzTHmjRQkY82/iz27SSmwFv tdhPUxBINRh/D9fl2upf0wmk6f2HEZxJfUE7UN9NPtOKc/+FSRjj76l1Jqfd8ShRFsWk PJEQ== X-Gm-Message-State: AHYfb5inJYlXJSCceQxzmOvkLg3pOuqHuybZd5qBIjcQcz38ENwS6r4w +gv5yeXU+H88amyPKt//URkWDmr5pw== X-Received: by 10.37.106.65 with SMTP id f62mr11365602ybc.355.1503209120057; Sat, 19 Aug 2017 23:05:20 -0700 (PDT) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org MIME-Version: 1.0 Received: by 10.129.211.10 with HTTP; Sat, 19 Aug 2017 23:05:19 -0700 (PDT) In-Reply-To: References: <20170819103741.GB7666@martineau.grandmasfridge.local> <47bb3f3f-fcdf-aace-faba-d913fccaab8e@gentoo.org> <20170819111820.GC7666@martineau.grandmasfridge.local> <04b1f829-48fd-da30-4770-03ddc297b712@gentoo.org> From: R0b0t1 Date: Sun, 20 Aug 2017 01:05:19 -0500 Message-ID: Subject: Re: [gentoo-dev] New item for sys-kernel/hardened-sources removal To: gentoo-dev@lists.gentoo.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Archives-Salt: 07e22c15-863d-495e-879d-f5fd1827936d X-Archives-Hash: 82426d050c42f0995fd5c3140fe0a475 On Sun, Aug 20, 2017 at 12:39 AM, R0b0t1 wrote: > On Sat, Aug 19, 2017 at 6:34 AM, Francisco Blas Izquierdo Riera > (klondike) wrote: >> El 19/08/17 a las 13:18, Aaron W. Swenson escribi=C3=B3: >>> On 2017-08-19 13:01, Francisco Blas Izquierdo Riera (klondike) wrote: >>>> El 19/08/17 a las 12:37, Aaron W. Swenson escribi=C3=B3: >>>>> On 2017-08-15 17:01, Francisco Blas Izquierdo Riera (klondike) wrote: >>>>>> Hi! >>>>>> >>>>>> I'd like to get this one up by Saturday so that we can proceed with >>>>>> masking and removing of the hardened-sources after upstream stopped >>>>>> releasing new patches. >>>>> I hope I=E2=80=99m not too late. >>>>> >>>>>> We'd like to note that all the userspace hardening and MAC support >>>>>> for SELinux provided by Gentoo Hardened will still remain there and >>>>>> is unaffected by this removal. >>>>> Where is there? I think you=E2=80=99re talking about the packages, bu= t the news >>>>> item is about the kernels. It would help to be more specific here. >>>>> >>>>> That=E2=80=99s all I had that the others hadn=E2=80=99t touched on. >>>> Do you think something like that is better then? >>>> >>>> We'd like to note that all the userspace hardening and MAC support >>>> for SELinux provided by Gentoo Hardened will still remain available >>>> on the portage. Keep in mind though that the security provided by >>>> these features will be weakened a bit when using >>>> sys-kernel/gentoo-sources. Also, all PaX related packages other than >>>> the hardened-sources will remain available for the time being. >>>> >>>> >>> Much better. We should mention that we=E2=80=99re specifically discussi= ng >>> packages and not portage itself. At least, that=E2=80=99s my understand= ing from >>> your edit. >>> >>> Here=E2=80=99s my take on it: >>> >>> We'd like to note that all the userspace hardening and MAC support for >>> SELinux provided by Gentoo Hardened will still remain in the packages >>> found in portage. Keep in mind, though, that the security provided by >>> these features will be weakened a bit when using >>> sys-kernel/gentoo-sources. Also, all PaX related packages, except >>> sys-kernel/hardened-sources, will remain available for the time being. >> >> I updated the news item with your propossal. Thanks a lot :) >> > > The discussion is nice but no one has actually touched on the > technical merits of removing the packages besides "they are old." > There's plenty of old software in portage. Why not remove it first? > > I had a similar issue with the GCC developer who removed GCJ support. > I asked him for any justification at all for the removal and he had > none but some vague statements about it creating work. I would have > taken any more specific example he gave at face value, but he didn't > want to give one. I was left to conclude he didn't have one to give. > > So I ask again: On what basis are the hardened sources being removed > from the tree? > > At this point I am far less interested in making sure the sources stay > in the tree than I am in forcing you to justify your actions, because > I suspect your attempt to do so will be entertaining. > I just had a bad day so perhaps that last bit was a tad blunt. Consider replacing it with this: There is nothing that holds you accountable to me. However, I am honestly trying to understand why you are doing what you are doing and would like you to explain your decision making process to me. If you can't explain it to me, then how do you know that you have selected the best course of action? If it was a matter of opinion I can accept you will probably go "I'm a developer" and then ignore me. However I don't think it has gotten to that point yet, and you are doing the thing being discussed for what seems to be nebulous and poorly defined reasons. R0b0t1.