[gentoo-project] Call for agenda items - Council meeting 2016-12-11

[gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Rich Freeman]

In two weeks from now, the council will meet again. This is the time
to raise and prepare items that the council should put on the agenda
to discuss or vote on.

Please respond to this message with agenda items. Do not hesitate to
repeat your agenda item here with a pointer if you previously
suggested one (since the last meeting).

The agenda for the meeting will be sent out on Monday, 2016-12-05.

Please reply to the gentoo-project list.

-- 
Rich

[gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Rich Freeman]

In two weeks from now, the council will meet again. This is the time
to raise and prepare items that the council should put on the agenda
to discuss or vote on.

Please respond to this message with agenda items. Do not hesitate to
repeat your agenda item here with a pointer if you previously
suggested one (since the last meeting).

The agenda for the meeting will be sent out on Monday, 2016-12-05.

Please reply to the gentoo-project list.

-- 
Rich

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 481 bytes --]

Can we discuss and possibly vote on reopening the gentoo-council
mailing list [1], to be used for any council topics like agenda items?

Rationale:
1. The gentoo-project list is intended for non-technical matters.
   Council business includes both technical and non-technical issues.
2. I recently find it increasingly difficult to filter the noise out
   of -project, in order to find the topics that I need to know about.

Ulrich

[1] https://archives.gentoo.org/gentoo-council/

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Aaron Bauman]

[-- Attachment #1.1: Type: text/plain, Size: 2722 bytes --]

On 12/01/2016 07:50 AM, Rich Freeman wrote:
> In two weeks from now, the council will meet again. This is the time
> to raise and prepare items that the council should put on the agenda
> to discuss or vote on.
>
> Please respond to this message with agenda items. Do not hesitate to
> repeat your agenda item here with a pointer if you previously
> suggested one (since the last meeting).
>
> The agenda for the meeting will be sent out on Monday, 2016-12-05.
>
> Please reply to the gentoo-project list.
>
I would like the council to consider dropping IA-64 and SPARC from the
supported list of stable architectures to increase the security posture
of the tree.

Rationale:

1. Both architectures are behind in stabilization bugs tree wide [1] and
do not currently have leads elected.  While other architectures may rank
up with IA-64 and SPARC in outstanding stable bugs their commitment to
security is seen in the rest of this rationale.

2. The lack of stabilization is leaving the tree in an undesirable and
vulnerable state for all arches.  This is directly related to
dependencies and proper cleanup of vulnerable ebuilds, which cannot
occur until all previously stable arches have been stabilized.  The
current list of outstanding security bugs pending stabilization for
IA-64 [2] (50 bugs) and SPARC [3] (57 bugs) are indicative of this
issue.  This is the focal point of why these should be considered for
inclusion as unstable architectures.

3. Both architectures are impeding the release of security advisories in
a timely manner following cleanup [4].  The inability to properly inform
our users of such vulnerabilities, in a timely manner, is contradicting
our commitment to security [5].

4. ppc & ppc64 have progressively worsened as well concerning security
stabilization, but only recently.  These may be considered in a future
council meeting or proactively considered now.

Thank you,
Aaron Bauman

[1]: https://download.sumptuouscapital.com/gentoo/wg-stable/main.pdf

[2]:
https://bugs.gentoo.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&component=Vulnerabilities&email1=ia64%40gentoo.org&emailcc1=1&emailtype1=substring&list_id=3364582&product=Gentoo%20Security&query_format=advanced&resolution=---

[3]:
https://bugs.gentoo.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&component=Vulnerabilities&email1=sparc%40gentoo.org&emailcc1=1&emailtype1=substring&list_id=3364584&product=Gentoo%20Security&query_format=advanced&resolution=---
 
[4]:
https://www.gentoo.org/support/security/vulnerability-treatment-policy.html

[5]: https://www.gentoo.org/support/security/


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Agostino Sarubbo]

On Friday 02 December 2016 23:17:13 Aaron Bauman wrote:
> I would like the council to consider dropping IA-64 and SPARC from the
> supported list of stable architectures to increase the security posture
> of the tree.

I would like to ask to keep the things as is.

The slowdown is caused from the fact that there are no rules for the 
stabilization requests.
We (kensington mainly + wg-stable group) are working to have more automations.

See also: 
https://bugs.gentoo.org/show_bug.cgi?id=601304
https://archives.gentoo.org/gentoo-dev/message/2735138449c706c2b61dde2d59009c70


-- 
Agostino Sarubbo
Gentoo Linux Developer

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 686 bytes --]

>>>>> On Thu, 1 Dec 2016, Ulrich Mueller wrote:

> Can we discuss and possibly vote on reopening the gentoo-council
> mailing list [1], to be used for any council topics like agenda items?

> Rationale:
> 1. The gentoo-project list is intended for non-technical matters.
>    Council business includes both technical and non-technical issues.
> 2. I recently find it increasingly difficult to filter the noise out
>    of -project, in order to find the topics that I need to know about.

In case that this should be rejected, I propose to moderate the
gentoo-project mailing list instead. Details to be worked out, but
probably we would want to whitelist @gentoo.org addresses.

Ulrich

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Chí-Thanh Christopher Nguyễn]

Ulrich Mueller schrieb:
> In case that this should be rejected, I propose to moderate the
> gentoo-project mailing list instead. Details to be worked out, but
> probably we would want to whitelist @gentoo.org addresses.

Can you give some examples of posts which you think a moderation 
according to your proposal should not have allowed into -project, and 
the formal grounds for this?


Best regards,
Chí-Thanh Christopher Nguyễn

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Dirkjan Ochtman]

On Fri, Dec 2, 2016 at 4:28 PM, Ulrich Mueller <ulm@gentoo.org> wrote:
> In case that this should be rejected, I propose to moderate the
> gentoo-project mailing list instead. Details to be worked out, but
> probably we would want to whitelist @gentoo.org addresses.

This seems like a better solution to me.

Cheers,

Dirkjan

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 440 bytes --]

On Friday, December 2, 2016 4:28:03 PM EST Ulrich Mueller wrote:
>
> In case that this should be rejected, I propose to moderate the
> gentoo-project mailing list instead. 

Censorship.... 

Your really just seeking to silence people, opposing points of view, etc.

CoC isn't enough people want further control... Further restrict who can 
contribute and who can comment. Horrible trend likely will get worse...

-- 
William L. Thomson Jr.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Chí-Thanh Christopher Nguyễn]

William L. Thomson Jr. schrieb:
> On Friday, December 2, 2016 4:28:03 PM EST Ulrich Mueller wrote:
>> In case that this should be rejected, I propose to moderate the
>> gentoo-project mailing list instead.
> Censorship....
>
> Your really just seeking to silence people, opposing points of view, etc.

I do not believe that this was the intention of ulm's proposal.
His reasoning is apparently that he wishes to have a mailing list with 
high signal-to-noise ratio for Council work, which -project currently isn't.

So there are two options, turn -project into such a list, or 
create/revive another list.


Best regards,
Chí-Thanh Christopher Nguyễn

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 1734 bytes --]

On Friday, December 2, 2016 4:44:11 PM EST Chí-Thanh Christopher Nguyễn wrote:
> William L. Thomson Jr. schrieb:
> > On Friday, December 2, 2016 4:28:03 PM EST Ulrich Mueller wrote:
> >> In case that this should be rejected, I propose to moderate the
> >> gentoo-project mailing list instead.
> > 
> > Censorship....
> > 
> > Your really just seeking to silence people, opposing points of view, etc.
> 
> I do not believe that this was the intention of ulm's proposal.
> His reasoning is apparently that he wishes to have a mailing list with
> high signal-to-noise ratio for Council work, which -project currently isn't.

I will give the benefit of doubt but I have been around long enough. I know how 
I am seen. I doubt mention of moderation list split etc, would be taking place 
had it not been for my recent activity on list.

I feel as if I would be one they would be seeking to moderate. I believe many 
comments from others would support that belief. Like people saying I am 
spamming the list. Off topic remarks as replies to mine calling out my 
comments as off topic, etc.

> So there are two options, turn -project into such a list, or
> create/revive another list.

That was why project was created long ago when such things were deemed off 
topic for -dev. Why council went away no clue.

Creating another list is VERY different than moderating an existing. Does the 
project list then get moderated to only allow discussion others deem relevant 
to council? If another list is not created.

Which comrel matters I would think would be relevant to a Council list. Thus I 
am not really sure what people are trying to accomplish other than censorship.

-- 
William L. Thomson Jr.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1598 bytes --]

On Fri, 2 Dec 2016 16:28:03 +0100
Ulrich Mueller <ulm@gentoo.org> wrote:

> >>>>> On Thu, 1 Dec 2016, Ulrich Mueller wrote:  
> 
> > Can we discuss and possibly vote on reopening the gentoo-council
> > mailing list [1], to be used for any council topics like agenda items?  
> 
> > Rationale:
> > 1. The gentoo-project list is intended for non-technical matters.
> >    Council business includes both technical and non-technical issues.
> > 2. I recently find it increasingly difficult to filter the noise out
> >    of -project, in order to find the topics that I need to know about.  
> 
> In case that this should be rejected, I propose to moderate the
> gentoo-project mailing list instead. Details to be worked out, but
> probably we would want to whitelist @gentoo.org addresses.

Well, there are actually three possible ways here:

1. We fork new mailing lists for more specific topics every time
the broader one gets spammed to the point of making it impossible to
use for other developers.

2. We start moderating further mailing lists every time they get
spammed to the point of making it impossible to preserve a factual
conversation for all developers.

3. We just ask nicely people who spam the lists to stop, and if they
don't we ban them altogether.


1. sounds like a never-ending struggle, though may be appropriate
anyway in some cases. 2. sounds like a major hassle that might only
cause additional work and complaints. In which case 3. sounds like
the best thing to do.

-- 
Best regards,
Michał Górny
<http://dev.gentoo.org/~mgorny/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 963 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 697 bytes --]

>>>>> On Fri, 2 Dec 2016, Chí-Thanh Christopher Nguyễn wrote:

> William L. Thomson Jr. schrieb:
>> Censorship....

Pavlov's dog?

> I do not believe that this was the intention of ulm's proposal.
> His reasoning is apparently that he wishes to have a mailing list
> with high signal-to-noise ratio for Council work, which -project
> currently isn't.

> So there are two options, turn -project into such a list, or 
> create/revive another list.

Right, and moderating -project would be my second choice only.
However, the point is that the noise in this list makes it hard to
find the messages that I need to see and therefore starts to impede
on my council work.

Ulrich

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 1545 bytes --]

On Friday, December 2, 2016 5:03:58 PM EST Ulrich Mueller wrote:
>
> > I do not believe that this was the intention of ulm's proposal.
> > His reasoning is apparently that he wishes to have a mailing list
> > with high signal-to-noise ratio for Council work, which -project
> > currently isn't.
> > 
> > So there are two options, turn -project into such a list, or
> > create/revive another list.
> 
> Right, and moderating -project would be my second choice only.
> However, the point is that the noise in this list makes it hard to
> find the messages that I need to see and therefore starts to impede
> on my council work.

These issues being discussed are 100% relevant to the council.

For council members to overlook says, "I as a council member do not care how 
entities of Gentoo conduct themselves. Nor do I care about the over all impact 
to Gentoo."

Who cares if Gentoo Java and other things go neglected. That is not of concern 
to the council. If comrel actions are causing things to be neglected. That 
again is not of concern to the council.

If it does not fall under the Foundation, who does it fall under? Does Comrel 
report to the Foundation? Are Comrel appeals made to the foundation.

Making a statement you want to moderate -project to keep things specific to the 
council. Is saying you want to censor things to topics you deem relevant to 
the council. Like recent threads deemed as not relevant which are relevant to 
the council.

There is no other way to read that other than censorship.

-- 
William L. Thomson Jr.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 917 bytes --]

On Friday, December 2, 2016 4:57:32 PM EST Michał Górny wrote:
>
> Well, there are actually three possible ways here:

Only 3? 
 
> 1. We fork new mailing lists for more specific topics every time
> the broader one gets spammed to the point of making it impossible to
> use for other developers.
> 
> 2. We start moderating further mailing lists every time they get
> spammed to the point of making it impossible to preserve a factual
> conversation for all developers.
> 
> 3. We just ask nicely people who spam the lists to stop, and if they
> don't we ban them altogether.

#3 is censorship. Who determines what is spam?

How about

4. Create a better atmosphere around Gentoo that is more open and inclusive of 
others ideas and opinions.

Rather than run around insulting people saying they are spamming a list. Which 
spam is very different in nature.

-- 
William L. Thomson Jr.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 999 bytes --]

On Fri, 2 Dec 2016 17:03:58 +0100
Ulrich Mueller <ulm@gentoo.org> wrote:

> >>>>> On Fri, 2 Dec 2016, Chí-Thanh Christopher Nguyễn wrote:  
> 
> > William L. Thomson Jr. schrieb:  
> >> Censorship....  
> 
> Pavlov's dog?
> 
> > I do not believe that this was the intention of ulm's proposal.
> > His reasoning is apparently that he wishes to have a mailing list
> > with high signal-to-noise ratio for Council work, which -project
> > currently isn't.  
> 
> > So there are two options, turn -project into such a list, or 
> > create/revive another list.  
> 
> Right, and moderating -project would be my second choice only.
> However, the point is that the noise in this list makes it hard to
> find the messages that I need to see and therefore starts to impede
> on my council work.

The problem is, soon enough someone can bring all those topics to
the Council and... we're back to square one.

-- 
Best regards,
Michał Górny
<http://dev.gentoo.org/~mgorny/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 963 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Brian Dolbec]

[-- Attachment #1: Type: text/plain, Size: 3208 bytes --]

On Fri, 02 Dec 2016 10:56:27 -0500
"William L. Thomson Jr." <wlt-ml@o-sinc.com> wrote:

> On Friday, December 2, 2016 4:44:11 PM EST Chí-Thanh Christopher
> Nguyễn wrote:
> > William L. Thomson Jr. schrieb:  
> > > On Friday, December 2, 2016 4:28:03 PM EST Ulrich Mueller wrote:  
> > >> In case that this should be rejected, I propose to moderate the
> > >> gentoo-project mailing list instead.  
> > > 
> > > Censorship....
> > > 
> > > Your really just seeking to silence people, opposing points of
> > > view, etc.  
> > 
> > I do not believe that this was the intention of ulm's proposal.
> > His reasoning is apparently that he wishes to have a mailing list
> > with high signal-to-noise ratio for Council work, which -project
> > currently isn't.  
> 
> I will give the benefit of doubt but I have been around long enough.
> I know how I am seen. I doubt mention of moderation list split etc,
> would be taking place had it not been for my recent activity on list.
> 
> I feel as if I would be one they would be seeking to moderate. I
> believe many comments from others would support that belief. Like
> people saying I am spamming the list. Off topic remarks as replies to
> mine calling out my comments as off topic, etc.
>

I would agree with you there.  The list has been quite quiet in general
until very recently.

 
> > So there are two options, turn -project into such a list, or
> > create/revive another list.  
> 
> That was why project was created long ago when such things were
> deemed off topic for -dev. Why council went away no clue.
> 
> Creating another list is VERY different than moderating an existing.
> Does the project list then get moderated to only allow discussion
> others deem relevant to council? If another list is not created.
> 
> Which comrel matters I would think would be relevant to a Council
> list. Thus I am not really sure what people are trying to accomplish
> other than censorship.
> 

William, if I may make a suggestion/observation about your recent mail
list activity.  

While you may be technically qualified to make valuable contributions
to Gentoo.  Your recent activity can be seen as that of a bully.  There
is a line (albeit hard to see, and varies between people) between being
pro-active about something and just being a bully about it until you
get your way.  Your comments above indicate that you are coming to that
realization.

So, please, step back a bit, give things a break.  If you truly want to
do good for Gentoo, you have to learn what Gentoo as a whole is willing
to accept before it pushes back.  There are many Gentoo developers that
do very little (this is after all volunteer work) and others that do a
great amount of work.  There are some that try to push the boundaries,
stir things up to get things moving.  But at some point, the pushing
could cross that line from pro-active to bullying.  So please, slow
things down a bit to prove to us that you are not in fact a bully.


P.S. Please, let's not continue this off-topic email reply on this
list.  I will likely not respond in order to preserve the original
topic.
-- 
Brian Dolbec <dolsen>


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 1750 bytes --]

On Friday, December 2, 2016 8:36:03 AM EST Brian Dolbec wrote:>
> While you may be technically qualified to make valuable contributions
> to Gentoo.  Your recent activity can be seen as that of a bully.  There
> is a line (albeit hard to see, and varies between people) between being
> pro-active about something and just being a bully about it until you
> get your way.  Your comments above indicate that you are coming to that
> realization.

What ever realization you think I am coming to is not correct. I know how 
others have perceived me for some time. Far longer than I have been on -
project and posting. It is why I have avoided Gentoo in many ways for years.

It is this logic that that has been used for years to prevent my return and 
escalate my status within Comrel since not being a developer.

I have come to the realization my years of being silent and doing nothing did 
not help Gentoo. I was not the problem then or now.

> So, please, step back a bit, give things a break.  If you truly want to
> do good for Gentoo, you have to learn what Gentoo as a whole is willing
> to accept before it pushes back.  There are many Gentoo developers that
> do very little (this is after all volunteer work) and others that do a
> great amount of work.  There are some that try to push the boundaries,
> stir things up to get things moving.  But at some point, the pushing
> could cross that line from pro-active to bullying.  So please, slow
> things down a bit to prove to us that you are not in fact a bully.

I would argue others are Bullies, comrel, Michal Gorny and others.

I am the victim not the bully. Interesting how people get that twisted.
How can I be a bully when I am forced to be on the outside?

-- 
William L. Thomson Jr.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 654 bytes --]

>>>>> On Fri, 02 Dec 2016, William L Thomson wrote:

> These issues being discussed are 100% relevant to the council.

> For council members to overlook says, "I as a council member do not
> care how entities of Gentoo conduct themselves. Nor do I care about
> the over all impact to Gentoo."

Can you please leave it to council members (who have been elected by
all developers) to decide what is relevant for them and what is not?
Your drivel in this list certainly isn't, in my opinion.

If you don't like how Gentoo operates, why don't you leave us alone
and found your own distro? You could even fork Gentoo, because it is
all Free Software.

Ulrich

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 1608 bytes --]

On Friday, December 2, 2016 5:48:03 PM EST Ulrich Mueller wrote:
> >>>>> On Fri, 02 Dec 2016, William L Thomson wrote:
> > These issues being discussed are 100% relevant to the council.
> > 
> > For council members to overlook says, "I as a council member do not
> > care how entities of Gentoo conduct themselves. Nor do I care about
> > the over all impact to Gentoo."
> 
> Can you please leave it to council members (who have been elected by
> all developers) to decide what is relevant for them and what is not?
> Your drivel in this list certainly isn't, in my opinion.

It is not up to the Council members to determine their role in Gentoo. The 
Council per Gentoo structure has a role to play. If you do not like that, then 
hand over duties and roles to the Foundation.

If you do not want to fulfill the structured duties of the council. You should 
not run for council.

Again who does Comrel fall under? Who hears appeals on Comrel matters? This is 
your duty to the community you are serving in your elected position.

> If you don't like how Gentoo operates, why don't you leave us alone
> and found your own distro? You could even fork Gentoo, because it is
> all Free Software.

Gentoo is yours? Leave you alone? What makes you think you speak for the 
majority? Being elected does not give you the right to do what ever and ignore 
whom ever.

As a council member you do not server yourself but the community who elected 
you. Which I am prevented from being a member of. Making sure it is a closed 
pool of like minded people.

-- 
William L. Thomson Jr.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Ciaran McCreesh]

On Fri, 02 Dec 2016 12:00:18 -0500
"William L. Thomson Jr." <wlt-ml@o-sinc.com> wrote:
> As a council member you do not server yourself but the community who
> elected you. Which I am prevented from being a member of. Making sure
> it is a closed pool of like minded people.

Why don't you just come back as a bunch of sock puppets like everyone
else does? Getting recruited isn't hard...

-- 
Ciaran McCreesh

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Mart Raudsepp]

Ühel kenal päeval, R, 02.12.2016 kell 15:44, kirjutas Agostino Sarubbo:
> On Friday 02 December 2016 23:17:13 Aaron Bauman wrote:
> > 
> > I would like the council to consider dropping IA-64 and SPARC from
> > the
> > supported list of stable architectures to increase the security
> > posture
> > of the tree.
> 
> I would like to ask to keep the things as is.
> 
> The slowdown is caused from the fact that there are no rules for the 
> stabilization requests.
> We (kensington mainly + wg-stable group) are working to have more
> automations.

He is talking about security stabilization bugs here.

I don't understand why stable and security stable have to be connected,
and why fringe arches are considered stopping the drafting and send-out 
of GLSA. The tooling could special case ia64 and sparc to tell that
it's not marked stable there yet or whatever when it isn't yet. The
dozen users will know what to do.

Or as a temporary measure propose the removal of these arches from the
list of security supported (I don't believe one of them is security
supported even now), and move back to security supported once the
process is more streamlined from the workflow efforts going into there
now.

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Mike Gilbert]

On Fri, Dec 2, 2016 at 12:00 PM, William L. Thomson Jr.
<wlt-ml@o-sinc.com> wrote:
> On Friday, December 2, 2016 5:48:03 PM EST Ulrich Mueller wrote:
>> >>>>> On Fri, 02 Dec 2016, William L Thomson wrote:
>> > These issues being discussed are 100% relevant to the council.
>> >
>> > For council members to overlook says, "I as a council member do not
>> > care how entities of Gentoo conduct themselves. Nor do I care about
>> > the over all impact to Gentoo."
>>
>> Can you please leave it to council members (who have been elected by
>> all developers) to decide what is relevant for them and what is not?
>> Your drivel in this list certainly isn't, in my opinion.
>
> It is not up to the Council members to determine their role in Gentoo. The
> Council per Gentoo structure has a role to play. If you do not like that, then
> hand over duties and roles to the Foundation.
>
> If you do not want to fulfill the structured duties of the council. You should
> not run for council.
>
> Again who does Comrel fall under? Who hears appeals on Comrel matters? This is
> your duty to the community you are serving in your elected position.
>
>> If you don't like how Gentoo operates, why don't you leave us alone
>> and found your own distro? You could even fork Gentoo, because it is
>> all Free Software.
>
> Gentoo is yours? Leave you alone? What makes you think you speak for the
> majority? Being elected does not give you the right to do what ever and ignore
> whom ever.

At the risk of being labeled a "bully", I would like to add my +1 to
ulm's sentiment.

I certainly do not welcome your presence in this community, and I
believe the majority of Gentoo developers share this opinion.

Please go away.

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 842 bytes --]

Such a friendly, polite, and welcoming community!

On Friday, December 2, 2016 2:45:43 PM EST Mike Gilbert wrote:
>
> I certainly do not welcome your presence in this community, and I
> believe the majority of Gentoo developers share this opinion.

Maybe you should conduct a factual poll instead of assuming you speak for some 
200+ developers from all over the world.

> Please go away.

I will not! Those that do not want me around will have to come up with some 
new ways to make that be such. I went away for years. I am back, deal with it. 

Long as I do not breach CoC, there is little justification. Even if I did very 
little recourse I am outside Gentoo, a user...

I gave in and went away long ago. That will not happen again.
Cruft from 2008 still remains in tree... its 2016...

-- 
William L. Thomson Jr.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 656 bytes --]

On 12/02/2016 09:08 PM, William L. Thomson Jr. wrote:
> I will not! Those that do not want me around will have to come up with some 
> new ways to make that be such. I went away for years. I am back, deal with it. 
> 
> Long as I do not breach CoC, there is little justification.

Please be aware of the following in CoC: "Below is a list of things that
could result in disciplinary action. [...] Posting/participating only to
incite drama or negativity rather than to tactfully share information."

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 1246 bytes --]

On Friday, December 2, 2016 9:17:20 PM EST Kristian Fiskerstrand wrote:
> On 12/02/2016 09:08 PM, William L. Thomson Jr. wrote:
> > I will not! Those that do not want me around will have to come up with
> > some
> > new ways to make that be such. I went away for years. I am back, deal with
> > it.
> > 
> > Long as I do not breach CoC, there is little justification.
> 
> Please be aware of the following in CoC: "Below is a list of things that
> could result in disciplinary action. [...] Posting/participating only to
> incite drama or negativity rather than to tactfully share information."

Funny you say that, take a look at a post I just made and I would like your 
comments on such. Showing several clear violations much worse than what your 
implying I am doing.

I am not posting to incite anything. More to resolve long time issues that 
have effected several people over many years. I am just one of them. That is 
the only aspect of the CoC you could potentially apply. There has been other 
more clear violations by Developers.

There has been numerous personal negative comments directed at me. But of 
course that stuff is not part of the CoC. Do as I say not as I do right?

-- 
William L. Thomson Jr.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 886 bytes --]

>>>>> On Fri, 02 Dec 2016, William L Thomson wrote:

> Gentoo is yours? Leave you alone? What makes you think you speak for
> the majority? Being elected does not give you the right to do what
> ever and ignore whom ever.

> As a council member you do not server yourself but the community who
> elected you.

Very true. And the overall goal is to produce a distribution, which is
primarily technical work. The community of developers and contributing
users isn't an end in itself, but only exists to serve this goal.

> Which I am prevented from being a member of. Making sure it is a
> closed pool of like minded people.

Not sure what you mean by this, but I believe that recruiters will
to the best of their knowledge admit anybody who has the necessary
technical skills. Of course, some minimum social skills will also
be required, in order to be able to work with others.

Ulrich

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Mike Gilbert]

On Fri, Dec 2, 2016 at 3:08 PM, William L. Thomson Jr.
<wlt-ml@o-sinc.com> wrote:
> Such a friendly, polite, and welcoming community!
>
> On Friday, December 2, 2016 2:45:43 PM EST Mike Gilbert wrote:
>>
>> I certainly do not welcome your presence in this community, and I
>> believe the majority of Gentoo developers share this opinion.
>
> Maybe you should conduct a factual poll instead of assuming you speak for some
> 200+ developers from all over the world.

You could conduct a poll of your own to see who wants you back, and
somehow convince a statistically significant portion of the community
to participate in it. This would certainly help your case. However, I
think you will find this to be quite a difficult thing to achieve.

Regardless of the outcome, I will still not welcome you unless you
have a major change in attitude.

>> Please go away.
>
> I will not! Those that do not want me around will have to come up with some
> new ways to make that be such. I went away for years. I am back, deal with it.
>
> Long as I do not breach CoC, there is little justification. Even if I did very
> little recourse I am outside Gentoo, a user...
>
> I gave in and went away long ago. That will not happen again.
> Cruft from 2008 still remains in tree... its 2016...

So it seems you are being obnoxious out of spite.

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[John R. Graham]

>On 12/02/2016 03:17 PM, Kristian Fiskerstrand wrote:
>Sent: Dec 2, 2016 3:17 PM
>To: gentoo-project@lists.gentoo.org
>Subject: Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11
>
>On 12/02/2016 09:08 PM, William L. Thomson Jr. wrote:
>> I will not! Those that do not want me around will have to come up with some 
>> new ways to make that be such. I went away for years. I am back, deal with it. 
>> 
>> Long as I do not breach CoC, there is little justification.
>
>Please be aware of the following in CoC: "Below is a list of things that
>could result in disciplinary action. [...] Posting/participating only to
>incite drama or negativity rather than to tactfully share information."

Ah, but don't you see, his posts are _constructive_ criticism. If only he posts a few more times, repeats the same things in slightly different ways, maybe he can get Gentoo to realize how much it sucks. And once all of the volunteers  collectively realize how much they suck, they'll try so much harder.

- John

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 2181 bytes --]

On Friday, December 2, 2016 9:28:22 PM EST Ulrich Mueller wrote:
> 
> Very true. And the overall goal is to produce a distribution, which is
> primarily technical work. The community of developers and contributing
> users isn't an end in itself, but only exists to serve this goal.

My biggest concern is the amount of technical things being neglected for many 
years now. The entire lack of a Java team for around 8 years now. Not to 
mention some other things outside of Java.

I tried proxying, and all the rest over the last 8 years....

> > Which I am prevented from being a member of. Making sure it is a
> > closed pool of like minded people.
> 
> Not sure what you mean by this, but I believe that recruiters will
> to the best of their knowledge admit anybody who has the necessary
> technical skills. Of course, some minimum social skills will also
> be required, in order to be able to work with others.

I am prevented from being a Gentoo Developer. Therefore I cannot vote for 
Council members. I am subject to what others decide all around.

How can you judge someones social skills you do not know and have never worked 
with?

One of the few I have worked with replied to my initial post. No one respected 
their opinion of me. Everyone else who does not work with me, is not seeking 
to work on Java stuff, has lots of opinions on me. Few know me, and less have 
worked with me.

Every time I have tried to return it has been a different issue. The latest is 
not social reasons. Which started long before I posted on list. Thus the 
problem was never solved and future ones prevented.

Almost 2 years ago, over 1.5

"First of all, I'm not concerned about your technical knowledge or 
capabilities. Second, whatever happened around 2007/2008 is primarily not my 
problem; this was before I joined Gentoo. The influence of it was that 
discussing the ability to cooperate with others should also be part of the 
recruiting process."
https://bugs.gentoo.org/show_bug.cgi?id=135927#c43

Notice I did not go straight to mailing lists then nor did I in 2008. I held 
back for many years...


-- 
William L. Thomson Jr.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 1110 bytes --]

On Friday, December 2, 2016 3:33:56 PM EST Mike Gilbert wrote:
>
> You could conduct a poll of your own to see who wants you back, and
> somehow convince a statistically significant portion of the community
> to participate in it. This would certainly help your case. However, I
> think you will find this to be quite a difficult thing to achieve.

You do realize I was elected as a Trustee before. I even told people in my 
manifesto do not vote for me. It is likely still around some where.

> Regardless of the outcome, I will still not welcome you unless you
> have a major change in attitude.

Maybe approach me differently. Treat me differently and you will get a 
different response.

> > I gave in and went away long ago. That will not happen again.
> > Cruft from 2008 still remains in tree... its 2016...
> 
> So it seems you are being obnoxious out of spite.

If that was the case, I would have done it in 2008, the years since, or in 
2015 when other issues came up. I have held back for far to long. It has 
effected others in the mean time.

-- 
William L. Thomson Jr.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 163 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 927 bytes --]

On Fri, 02 Dec 2016 15:35:19 -0500
"William L. Thomson Jr." <wlt-ml@o-sinc.com> wrote:

> On Friday, December 2, 2016 9:28:22 PM EST Ulrich Mueller wrote:
> > > Which I am prevented from being a member of. Making sure it is a
> > > closed pool of like minded people.  
> > 
> > Not sure what you mean by this, but I believe that recruiters will
> > to the best of their knowledge admit anybody who has the necessary
> > technical skills. Of course, some minimum social skills will also
> > be required, in order to be able to work with others.  
> 
> I am prevented from being a Gentoo Developer. Therefore I cannot vote for 
> Council members. I am subject to what others decide all around.
> 
> How can you judge someones social skills you do not know and have never worked 
> with?

How about the sample of 166 mails in our inboxes?

-- 
Best regards,
Michał Górny
<http://dev.gentoo.org/~mgorny/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 963 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Daniel Campbell]

[-- Attachment #1.1: Type: text/plain, Size: 2621 bytes --]

On 12/02/2016 12:17 PM, Kristian Fiskerstrand wrote:
> On 12/02/2016 09:08 PM, William L. Thomson Jr. wrote:
>> I will not! Those that do not want me around will have to come up with some 
>> new ways to make that be such. I went away for years. I am back, deal with it. 
>>
>> Long as I do not breach CoC, there is little justification.
> 
> Please be aware of the following in CoC: "Below is a list of things that
> could result in disciplinary action. [...] Posting/participating only to
> incite drama or negativity rather than to tactfully share information."
> 
Shouldn't we be a little careful about how we interpret that? Regardless
of how I or others feel about William's posts, it seems clear to me that
he wants to help and improve Gentoo. Most of his comments have revolved
around IRS paperwork and the state of Java in the tree, which he's right
about.

Granted, that doesn't mean that someone gets to cause a bunch of drama,
but inevitably when people disagree there will be some "drama" in the
form of discussion and debate. Try to put an end to that, and it creates
what's known as a "chilling" effect, preventing *any* criticism -- be it
constructive or otherwise -- from getting attention that it may well
deserve.

I understand the desire for a higher SNR, but from the looks of things,
the "noise" portion is growing due to something that's amiss. I don't
know what that is; I can't know due to privacy concerns. I do know that
situations like these don't happen just because someone has an axe to
grind. If that were the case, I think we'd be seeing more flaming,
slurs, and other sorts of antisocial behavior.

I'm not sure I'm on board with the tone of some of the e-mails (from any
of the parties concerned), but if I rejected everything I didn't like
the tone of, I'd be in a dark and lonely world.

-- on topic --

I don't feel moderation is necessary on any of our mailing lists at this
time. Least of all, I do not think Council is in a position to worry
itself with moderation of a public list. Restricting the mailing list to
@gentoo.org addresses only would then require anyone seeking the
council's attention to go through a developer first. If an idea is good,
it should not matter what the source is. Moderating a list meant to talk
about Gentoo as a project robs us of potential good ideas. I'd rather
slog through 100 e-mails a week to find that single good idea than to
not find it at all.
-- 
Daniel Campbell - Gentoo Developer
OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net
fpr: AE03 9064 AE00 053C 270C  1DE4 6F7A 9091 1EA0 55D6


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Dirkjan Ochtman]

On Sat, Dec 3, 2016 at 9:01 AM, Daniel Campbell <zlg@gentoo.org> wrote:
>> Please be aware of the following in CoC: "Below is a list of things that
>> could result in disciplinary action. [...] Posting/participating only to
>> incite drama or negativity rather than to tactfully share information."
>>
> Shouldn't we be a little careful about how we interpret that? Regardless
> of how I or others feel about William's posts, it seems clear to me that
> he wants to help and improve Gentoo. Most of his comments have revolved
> around IRS paperwork and the state of Java in the tree, which he's right
> about.

I think it's written quite carefully such that the interpretation does
not have to be so careful. "only to incite drama or negativity" seems
like something that's never a positive contribution, and seems like an
apt description of many of the recent posts on this list.

This discussion is not about whether someone wants to help and improve
Gentoo, it's about the way they go about doing so. I think you
dramatically underestimate the effect of what I see as effectively a
denial of service attack on mailing lists where all our productive
contributors hang out.

In other words, this is not about the contents, but about the manner
of bringing up issues. If someone starts a constructive discussion
about some issue they perceive with the way Gentoo operates, I'd be
very welcoming. If someone starts 8 discussions with long emails full
of negativity and hijacks other threads to do the same, I think it's
better for the community to just shut them out. Another aspect is
whether someone responds to criticism by improving their participation
-- which also hasn't happened here.

Producing Open Source Software has a really good chapter on this:
http://producingoss.com/en/difficult-people.html.

Cheers,

Dirkjan

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Ian Delaney]

On Sat, 3 Dec 2016 10:28:17 +0100
Dirkjan Ochtman <djc@gentoo.org> wrote:

> On Sat, Dec 3, 2016 at 9:01 AM, Daniel Campbell <zlg@gentoo.org>
> wrote: [...]  
> > Shouldn't we be a little careful about how we interpret that?
> > Regardless of how I or others feel about William's posts, it seems
> > clear to me that he wants to help and improve Gentoo. Most of his
> > comments have revolved around IRS paperwork and the state of Java
> > in the tree, which he's right about.  
> 
> I think it's written quite carefully such that the interpretation does
> not have to be so careful. "only to incite drama or negativity" seems
> like something that's never a positive contribution, 

and it is also a subjective value judgement

> and seems like an apt description of many of the recent posts on this
> list.
> 

and it is also a subjective value judgement, still. That said, I have
witnessed first hand the strong subjective and emotional reaction to
his posts. While I don't agree with the substance of their negative
critique or description of the nature of his contributions, there is no
doubting they or openly annoyed.

> This discussion is not about whether someone wants to help and improve
> Gentoo, it's about the way they go about doing so. I think you
> dramatically underestimate the effect of what I see as effectively a
> denial of service attack on mailing lists where all our productive
> contributors hang out.
> 

See what I mean?

> In other words, this is not about the contents, but about the manner
> of bringing up issues. If someone starts a constructive discussion
> about some issue they perceive with the way Gentoo operates, I'd be
> very welcoming. If someone starts 8 discussions with long emails full
> of negativity and hijacks other threads to do the same, 

so what do you think we the community should do about it?

> I think it's
> better for the community to just shut them out. 

Well here once again we have it; sanctions. And a time frame, djc?
You never were very good at times frames for these things as I recall.

A day, a week, or the ever popular 6 months. Or perhaps infinity which
appears to apply to the one he claims never cancelled from back in the
day.

> Another aspect is whether someone responds to criticism by improving
> their participation -- which also hasn't happened here.
> 

Well, this appears to have merit. A series of members of the community
asking him to stop spamming, mostly, in replies to his replies which
itself balloons the stats of the list concerned. That said, it is
apparent by my own observation or opinion, that he is like a dog with a
bone, and determined to the point of single mindedness, impervious to
dissuasion.

> Producing Open Source Software has a really good chapter on this:
> http://producingoss.com/en/difficult-people.html.
> 
> Cheers,
> 
> Dirkjan
> 

Firstly, the member of comrel appears to announcing a warning to him
that he is not as free from 'violation' as he appears to think. By all
appearances, this member gives all the signs of preparing to pounce,
having already validated the outcome. The target will be charged and
dealt by valid means, having let slack enough rope to 'hang' himself.
This is a classic 'gotcha'. 

Is this really a desirable final outcome?

I wonder, has anyone from anywhere in the whole community attempted to
talk to him one on one and talk him down? Or is the question so
fanciful that it's rhetorical?

-- 
kind regards

Ian Delaney

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Aaron Bauman]

[-- Attachment #1.1: Type: text/plain, Size: 2038 bytes --]



On 12/03/2016 03:22 AM, Mart Raudsepp wrote:
> Ühel kenal päeval, R, 02.12.2016 kell 15:44, kirjutas Agostino Sarubbo:
>> On Friday 02 December 2016 23:17:13 Aaron Bauman wrote:
>>> I would like the council to consider dropping IA-64 and SPARC from
>>> the
>>> supported list of stable architectures to increase the security
>>> posture
>>> of the tree.
>> I would like to ask to keep the things as is.
>>
>> The slowdown is caused from the fact that there are no rules for the 
>> stabilization requests.
>> We (kensington mainly + wg-stable group) are working to have more
>> automations.
> He is talking about security stabilization bugs here.
>
> I don't understand why stable and security stable have to be connected,
> and why fringe arches are considered stopping the drafting and send-out 
> of GLSA. The tooling could special case ia64 and sparc to tell that
> it's not marked stable there yet or whatever when it isn't yet. The
> dozen users will know what to do.

They must be connected, because we cannot properly clean the tree if
they are not.  Otherwise, we would break the dependency tree.  As long
as the packages are marked stable, we can somewhat ensure that users
will not be exposed to vulnerable code, but not entirely.   We cannot
publish a GLSA if there is no stable upgrade path for the user either. 
Why would that be acceptable?  Given a "dozen users will know what to
do," then why build tooling for such a small audience?  If they know
what to do, then we should expect that they will know what to do without
being a stable arch.

> Or as a temporary measure propose the removal of these arches from the
> list of security supported (I don't believe one of them is security
> supported even now), and move back to security supported once the
> process is more streamlined from the workflow efforts going into there
> now.
>
>

Aside from the above items, I think this proposal becomes confusing for
the user.  My arch is stable... but not security supported?


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Mart Raudsepp]

[-- Attachment #1: Type: text/plain, Size: 1469 bytes --]

Ühel kenal päeval, R, 09.12.2016 kell 21:54, kirjutas Aaron Bauman:
> 
> They must be connected, because we cannot properly clean the tree if
> they are not.  Otherwise, we would break the dependency tree.  As
> long
> as the packages are marked stable, we can somewhat ensure that users
> will not be exposed to vulnerable code, but not entirely.   We cannot
> publish a GLSA if there is no stable upgrade path for the user
> either. 
> Why would that be acceptable?  Given a "dozen users will know what to
> do," then why build tooling for such a small audience?  If they know
> what to do, then we should expect that they will know what to do
> without
> being a stable arch.
> 
> > Or as a temporary measure propose the removal of these arches from
> the
> > list of security supported (I don't believe one of them is security
> > supported even now), and move back to security supported once the
> > process is more streamlined from the workflow efforts going into
> there
> > now.
> >
> >
> 
> Aside from the above items, I think this proposal becomes confusing
> for
> the user.  My arch is stable... but not security supported?

Yes. See your own documentation at
https://www.gentoo.org/support/security/vulnerability-treatment-policy.html 
for a list of security supported architectures and documentation on
stabling of not security supported architectures must not be waited for
a stable fix to proceed.


Mart

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Aaron Bauman]

[-- Attachment #1.1: Type: text/plain, Size: 1697 bytes --]



On 12/10/2016 02:09 PM, Mart Raudsepp wrote:
> Ühel kenal päeval, R, 09.12.2016 kell 21:54, kirjutas Aaron Bauman:
>> They must be connected, because we cannot properly clean the tree if
>> they are not.  Otherwise, we would break the dependency tree.  As
>> long
>> as the packages are marked stable, we can somewhat ensure that users
>> will not be exposed to vulnerable code, but not entirely.   We cannot
>> publish a GLSA if there is no stable upgrade path for the user
>> either. 
>> Why would that be acceptable?  Given a "dozen users will know what to
>> do," then why build tooling for such a small audience?  If they know
>> what to do, then we should expect that they will know what to do
>> without
>> being a stable arch.
>>
>>> Or as a temporary measure propose the removal of these arches from
>> the
>>> list of security supported (I don't believe one of them is security
>>> supported even now), and move back to security supported once the
>>> process is more streamlined from the workflow efforts going into
>> there
>>> now.
>>>
>>>
>> Aside from the above items, I think this proposal becomes confusing
>> for
>> the user.  My arch is stable... but not security supported?
> Yes. See your own documentation at
> https://www.gentoo.org/support/security/vulnerability-treatment-policy.html 
> for a list of security supported architectures and documentation on
> stabling of not security supported architectures must not be waited for
> a stable fix to proceed.
>
>
> Mart

Yes, that is not up to date.  In practice, as you can see through our
bug reports, we still cover IA64 and arm due to the very reasons I have
brought forth.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Patrick Lauer]

On 12/09/16 13:54, Aaron Bauman wrote:
> 
> 
> On 12/03/2016 03:22 AM, Mart Raudsepp wrote:
>> Ühel kenal päeval, R, 02.12.2016 kell 15:44, kirjutas Agostino Sarubbo:
>>> On Friday 02 December 2016 23:17:13 Aaron Bauman wrote:
>>>> I would like the council to consider dropping IA-64 and SPARC from
>>>> the
>>>> supported list of stable architectures to increase the security
>>>> posture
>>>> of the tree.
>>> I would like to ask to keep the things as is.
>>>
>>> The slowdown is caused from the fact that there are no rules for the 
>>> stabilization requests.
>>> We (kensington mainly + wg-stable group) are working to have more
>>> automations.
>> He is talking about security stabilization bugs here.
>>
>> I don't understand why stable and security stable have to be connected,
>> and why fringe arches are considered stopping the drafting and send-out 
>> of GLSA. The tooling could special case ia64 and sparc to tell that
>> it's not marked stable there yet or whatever when it isn't yet. The
>> dozen users will know what to do.
> 
> They must be connected, because we cannot properly clean the tree if
> they are not.  Otherwise, we would break the dependency tree.  As long
> as the packages are marked stable, we can somewhat ensure that users
> will not be exposed to vulnerable code, but not entirely.   We cannot
> publish a GLSA if there is no stable upgrade path for the user either. 
> Why would that be acceptable?  Given a "dozen users will know what to
> do," then why build tooling for such a small audience?  If they know
> what to do, then we should expect that they will know what to do without
> being a stable arch.
> 
... why?

I mean: there *is* a security issue, so better tell me about it now so I
can apply workarounds (e.g. disabling services) instead of waiting an
unbounded time until it is stable on all architectures (why do I care
about architecture X lagging?) and then telling me that I was exposed
for the last dozen timeunits.

From my point of view it is rather confusing ...