Re: [gentoo-dev] Current unavoidable use of xz utils in Gentoo

["Eddie Chapman" <eddie@ehuk.net>]

Matt Jolly wrote:
> Hi Eddie,
>
> On 31/3/24 21:13, Eddie Chapman wrote:
>
>> At the moment there is far too much of
>> a cavalier attitude about the whole thing being shown by too many,
>> including here I'm sad to see.
>
> It's obvious that this is something that you are very worried about, but
> I think that you need to take a deep breath and relax a little. I have
> not seen a cavalier attitude towards this issue.

No, I don't need to do that. I don't appreciate suggestions to "just calm
down", especially when I'm not being hysterical.  Your comment to me just
reinforces what I mean when I say there is far too much of a cavalier
attitude.

> What I see instead are developers who have made an initial assessment
> and disclosure, have taken some actions to mitigate the severity of the
> issue, and are carefully continuing their investigations (over a major
> holiday in large parts of the world) so that they can issue sane responses
> to actual threats, and not a knee-jerk response like 'Gentoo should
> re-encode all xzs in other formats' which, as was discussed above, adds
> significant complexity for no real benefit.

I stand by and reiterate my view that there is far too much of a cavalier
attitude towards the matter in general out there including here in Gentoo.
But not in particular here, it is everywhere where this is being discussed
at the moment.

But please think a little about what I mean when I say a "cavalier
attitude", and what it does NOT mean. It does not mean that a lot of
people are not working very hard to analyse and learn about this issue and
taking steps to try to mitigate it. It does not mean people are not well
intentioned, everyone wants to fix this. I have great appreciation and
admiration for a lot of fantastic work I see going on including by people
involved in Gentoo. But I believe it will only really be beneficial in the
far future, not right now.

How are people in general being cavalier? By trying desperately to salvage
the situation with xz-utils above all else, by focussing too much on how
the original author of xz-utils and rallying round them (absolutely a
great thing to do but has absolutely nothing to do with what is good or
not good for users as a whole right now), there is too much clouded
judgment. There is more I could argue about why I use that word, but I
know by now that I am going against the grain of what the majority want
and it's not what people want to hear so I'm done, this discussion is now
a waste of everyone's time here including mine.

> I've seen from your previous emails to the list that you know what
> paragraphs are and how to use them to break up your content into digestible
> chunks. Please continue using them - it makes it significantly easier to
> respond to your ideas and gives off an aura of professionalism that you
> will need if you want your concerns to be taken seriously and addressed
> directly.

Yes you are right, I do apologise for not using paragraphs in my last
message, I slipped there, thanks for pointing it out. I've tried to do so
in this message.

> Cheers,
>
> Matt

And I should make more of an effort to sign off, it's a little more
friendly :-)

Regards,
Eddie