Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore)

[Kent Fredric <kentfredric@gmail.com>]

On 11 August 2015 at 20:38, Michał Górny <mgorny@gentoo.org> wrote:
> Dnia 2015-08-11, o godz. 10:29:55
> Alexander Berntsen <bernalex@gentoo.org> napisał(a):
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> On 10/08/15 22:59, Aaron W. Swenson wrote:
>> > Users can fetch/pull from Github.
>> Users should not have to interface with or rely on proprietary
>> software to use Gentoo.
>
> Then please provide them with true open-source infrastructure. And also
> remember to block all the mirrors by default.


Its fine to say "can" in the context of "They may if they want to, but
they are not forced to".

Having a quality infrastructure should happen in parallel to github mirrors.

Uses may use the proprietary one or the opensource one.

As long as nothing *demands* they use the proprietary instead of the
opensource one, and there is a working path that is usable and
covenient to avoid the proprietary ( which there is in this case ),
then there's no real foul.

The only downside is realistically, if all users cloned from gentoo
infra using git, then we would drown.

"Ban mirrors" wouldn't fix this problem, "Ban github" wouldn't fix this problem.

So you basically *must* implement a reasonable infrastructure, and
they can use github instead if it is more convenient for them.

To an extent this does imply we're relying that *some* users will use
github/other to decrease our server load.

Meh.

-- 
Kent

KENTNL - https://metacpan.org/author/KENTNL