[gentoo-user] necessary use flgas

[gentoo-user] necessary use flgas

[behrouz khosravi]

[-- Attachment #1: Type: text/plain, Size: 340 bytes --]

Hello everyone.

I really like to have control over my machine as much as possible. In this
way I will learn a lot, so I am trying to remove all the default use flags
and control them manually.

I just don't know which "global" use flags are absolutely necessary to the
system to make it snappier or secure.
What do you recommend ?

Thanks

[-- Attachment #2: Type: text/html, Size: 471 bytes --]

Re: [gentoo-user] necessary use flgas

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 866 bytes --]

On Tue, 23 Jun 2015 17:35:10 +0430, behrouz khosravi wrote:

> I really like to have control over my machine as much as possible. In
> this way I will learn a lot, so I am trying to remove all the default
> use flags and control them manually.
> 
> I just don't know which "global" use flags are absolutely necessary to
> the system to make it snappier or secure.
> What do you recommend ?

Use a minimal profile like default/linux/amd64/13.0 which will 
set only the USE flags most people need. From there you can disable
individual flags if you think you don't need them.

You can also start USE with -* in make.conf to turn everything off then
set your own choices. This is the ideal setup for those who prefer to
spend more time fixing their computer than using it.


-- 
Neil Bothwick

A man needs a mistress - just to break the monogamy

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-user] necessary use flgas

[David Haller]

Hello,

On Tue, 23 Jun 2015, Neil Bothwick wrote:
>On Tue, 23 Jun 2015 17:35:10 +0430, behrouz khosravi wrote:
>> I really like to have control over my machine as much as possible. In
>> this way I will learn a lot, so I am trying to remove all the default
>> use flags and control them manually.
[..]
>You can also start USE with -* in make.conf to turn everything off then
>set your own choices. This is the ideal setup for those who prefer to
>spend more time fixing their computer than using it.

Hah!

# find /usr/local/portage/*/ -mindepth 1 -maxdepth 1 -type d | wc -l
55

Hey, I got no printer, had others print about 5 pages for me in ~10
years. Why would I want cups? And BTW: qtwebkit:5 compiles just fine
without leveldb (with a little "-D" help)...

====
--- /usr/portage/dev-qt/qtwebkit/qtwebkit-5.4.2.ebuild   2015-06-17 17:24:04.000000000 +0200
+++ /usr/local/portage/dev-qt/qtwebkit/qtwebkit-5.4.2.ebuild     2015-06-23 07:05:01.823067740 +0200
@@ -14,13 +14,13 @@
 
 # TODO: qttestlib, geolocation, orientation/sensors
 
-IUSE="gstreamer gstreamer010 multimedia opengl printsupport qml udev webp"
+IUSE="gstreamer gstreamer010 multimedia opengl printsupport qml udev webp leveldb"
 REQUIRED_USE="?? ( gstreamer gstreamer010 multimedia )"
 
 RDEPEND="
        dev-db/sqlite:3
        dev-libs/icu:=
-       >=dev-libs/leveldb-1.18-r1
+       leveldb? ( >=dev-libs/leveldb-1.18-r1 )
        dev-libs/libxml2:2
        dev-libs/libxslt
        >=dev-qt/qtcore-${PV}:5[icu]
@@ -88,6 +88,9 @@
        use webp         || sed -i -e '/config_libwebp: WEBKIT_CONFIG += use_webp/d' \
                Tools/qmake/mkspecs/features/features.prf || die
 
+       use leveldb || sed -i -e 's/ENABLE_INDEXED_DATABASE=1/ENABLE_INDEXED_DATABASE=0/' \
+           Tools/qmake/mkspecs/features/features.pri || die
+
        # bug 458222
        sed -i -e '/SUBDIRS += examples/d' Source/QtWebKit.pro || die
====

As I hate cmake, I don't know if there's a better way to inject that
ENABLE_INDEXED_DATABASE=0 or something to that into the build process.
It works, I'm happy ;) Oh, and BTW, mozillen (via mozconfig) work just
fine without a spellchecker. Which I hate and never use. They distract
more and introduce errors that anything else, so I patch
eclass/mozconfig-*.eclass. BTW2: how can I "overlay" my eclass stuff
over the /usr/portage one? ATM, I just copy it over after each sync.

-dnh, minimalist, obviously ;)

-- 
my other signature is more intellectual

Re: [gentoo-user] necessary use flgas

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 583 bytes --]

On Tue, 23 Jun 2015 16:45:58 +0200, David Haller wrote:

> >You can also start USE with -* in make.conf to turn everything off then
> >set your own choices. This is the ideal setup for those who prefer to
> >spend more time fixing their computer than using it.  
> 
> Hah!

> Hey, I got no printer, had others print about 5 pages for me in ~10
> years. Why would I want cups?

You do know that only the desktop profiles include cups as a default USE
flag? The one I recommended does not.


-- 
Neil Bothwick

WindowError:01B  Illegal error. Do NOT get this error.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-user] necessary use flgas

[David Haller]

Hello,

On Tue, 23 Jun 2015, Neil Bothwick wrote:
>On Tue, 23 Jun 2015 16:45:58 +0200, David Haller wrote:
>> >You can also start USE with -* in make.conf to turn everything off then
>> >set your own choices. This is the ideal setup for those who prefer to
>> >spend more time fixing their computer than using it.  
>
>> Hey, I got no printer, had others print about 5 pages for me in ~10
>> years. Why would I want cups?
>
>You do know that only the desktop profiles include cups as a default USE
>flag? The one I recommended does not.

Try compiling icedtea, libreoffice, scribus and whatnot without
pulling in cups, no matter the use-flags. And "sabotaging" the ebuild
and buildsystem to not use cups leads to failed builds, BT,TriedThat :((

ATM, I just juggle it around. Install cups/cups-filter/ghostscript
with cups-flag, build icedtea/libreoffice/scribus, remove
cups/cups-filter, rebuild ghostscript without cups and ignore any
dependency errors on cups ;-P I do not care one bit about printing not
working, as long as the programs run.

Speaking of that, is there a gentoo-way, to link _some_ specific libs
(cups) statically to a program that won't run without it? I don't care
about a 'emerge cups/build program and link statically to cups/unmerge
cups' cycle.

Oh, yes, I did search on gentoo.org and generally, apparently, icedtea
just won't build without cups. icedtea-bin also yammers for cups:

!!! existing preserved libs:
>>> package: net-print/cups-2.0.2-r1
 *  - /usr/lib64/libcups.so.2
 *      used by /opt/icedtea-bin-7.2.5.3/jre/lib/amd64/headless/libmawt.so (dev-java/icedtea-bin-7.2.5.3)
 *      used by /opt/icedtea-bin-7.2.5.3/jre/lib/amd64/xawt/libmawt.so (dev-java/icedtea-bin-7.2.5.3)
 *      used by /usr/bin/scribus (app-office/scribus-1.5.0-r1)
 *      used by 2 other files

As long as programs run, I'll get the big stick ;) Scribus seems to
work. Still gotta test the Java stuff ... Moving stuff to a subfolder
like ".attic" works nicely though in such cases, also inside
*/portage/*[1] for ebuilds ;)

All this is not a problem with gentoo, it's a problem with upstream.

Why does a GUI (a USER INTERFACE Toolkit fer f*** sake! Not a Printer
Interface!) _ALWAYS_ be able to print (if I interpret the AWT right)? 
That's just dumb. Oh well, not your problem, but I fear the patch to
remove the cups dep would be large and tedious at best to maintain
which is why the icedtea maintainers gave up on it, as far as I've
found. *sigh* Anyway, I still got some questions about JDKs on gentoo,
but that's for another day and another thread.

BTW: I might sound like an ass demanding stuff, it's just that I'm a
    "old-time" (15+ years) of roll-your-own-package guy, just not
    really on gentoo thus far. Actually, systemd beyond an init was
    the point where I said to myself: no way. I've been reading this
    list for quite a while now (a bit in 2010, then very little, and
    now quite a lot), and I've already got e.g. you and Neil (just
    from today) on my "like" list, so to speak, always helpful,
    patient ... Been doing that kind of support elsewhere for a long
    time too, so I much appreciate you doing it here and help me with
    pointers.

Sorry, I'm having such a go at you, feel free to point me to
documentation (even vaguely, just a good search word), to another
thread etc. pp. I admit, I haven't searched for [1][2], but the other
stuff I did at least a site search on gentoo.org.

Thanks,
-dnh

PS: I hope I'll soon get into the roll and co-maintain that odd
    package here or there ;) I've been maintaining packages elsewhere,
    and ebuild stuff looks quite straightforward, I'm just still
    running into details a bit too often for my taste.

[1] speaking of that: I noticed, that when I bork[2] an ebuild in
    /usr/local/portage, it gets silently(!) ignored and the one from
    /usr/portage is used. The only indication is the flag on the
    package e.g. ::gentoo vs. ::local. Only once I move the gentoo
    ebuilds into e.g. the .attic subfolder, emerge tells me what's
    actually wrong with my ::local ebuild in /usr/local/portage. Have
    I overlooked an option of emerge or is that a bug?

[2] trivial stuff. Using 'foo? ( >=libfoo-1.2.3 )' without adding foo to
    IUSE, or missing the () around the dep after the useflag... That's
    those I run into most often so far ;) And emerge even tells you
    about it once you disable the ::gentoo main portage ;)

-- 
"Getting a penguin to pee on demand is _messy_."  -- Linus Torvalds

Re: [gentoo-user] necessary use flgas

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1396 bytes --]

On Tue, 23 Jun 2015 18:35:32 +0200, David Haller wrote:

> >You do know that only the desktop profiles include cups as a default
> >USE flag? The one I recommended does not.
> 
> Try compiling icedtea, libreoffice, scribus and whatnot without
> pulling in cups, no matter the use-flags. And "sabotaging" the ebuild
> and buildsystem to not use cups leads to failed builds, BT,TriedThat :((

The OP wanted to set up a "snappier" system. Java and LibreOffice are
not the first programs that spring to mind when I think snappier...
 
> Why does a GUI (a USER INTERFACE Toolkit fer f*** sake! Not a Printer
> Interface!) _ALWAYS_ be able to print (if I interpret the AWT right)? 
> That's just dumb.

No argument there.

> [1] speaking of that: I noticed, that when I bork[2] an ebuild in
>     /usr/local/portage, it gets silently(!) ignored and the one from
>     /usr/portage is used. The only indication is the flag on the
>     package e.g. ::gentoo vs. ::local. Only once I move the gentoo
>     ebuilds into e.g. the .attic subfolder, emerge tells me what's
>     actually wrong with my ::local ebuild in /usr/local/portage. Have
>     I overlooked an option of emerge or is that a bug?

ebuild /usr/local/portage/cat/pkg/pkg-x.y.ebuild merge

will use the specific ebuild you give it.


-- 
Neil Bothwick

Got kleptomania? Be sure to take something for it.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-user] necessary use flgas

[David Haller]

Hello,

On Tue, 23 Jun 2015, Neil Bothwick wrote:
>On Tue, 23 Jun 2015 18:35:32 +0200, David Haller wrote:
>> >You do know that only the desktop profiles include cups as a default
>> >USE flag? The one I recommended does not.
>> 
>> Try compiling icedtea, libreoffice, scribus and whatnot without
>> pulling in cups, no matter the use-flags. And "sabotaging" the ebuild
>> and buildsystem to not use cups leads to failed builds, BT,TriedThat :((
>
>The OP wanted to set up a "snappier" system. Java and LibreOffice are
>not the first programs that spring to mind when I think snappier...

Well, I use LaTeX anyway for "office", but one needs stuff that mom is
used to, so one can talk her through stuff, eh? And Java? There's e.g. 
tvbrowser and MediathekView. No need to talk about snappy but I
digressed from the OP anyway already. I just happily jumped on the
topic of leaving stuff out that one doesn't need. And generally stuff
you don't have installed cannot be attacked, esp. such ubiquitously
used stuff as cups (used by MacOS/iOS too), is an important attack
vector less installed.

Actually: mom uses libreoffice-calc to edit a .csv file, that is then
fed to a perl-script by me (via a couple of links on the XFCE/formerly
WinXP Desktop (via a .cmd batch) calling it differently), that
generates a LaTeX file using labels.sty that is fed to pdflatex and
spits out a PDF to be printed on labels, and even starting a
pdf-viewer to check it before printing ;) Worked just like a charm
for, ah, about 7+ years without any maintanece required, but
recentenly, mom must've borked up the charset on saving multiply,
probably due to changed defaults in libreoffice, looked like double
encoded utf8, but was borked even beyond that. Manually fixing it
turned out to be the least work. *Gah*. As mom wanted to weed out
outdated stuff anyway, she did it, but we talked about it and I'd had
done it.

Except from that, mom writes her letters and stuff with -writer, and
has been doing so since 199x (then with StarOffice).
 
>> Why does a GUI (a USER INTERFACE Toolkit fer f*** sake! Not a Printer
>> Interface!) _ALWAYS_ be able to print (if I interpret the AWT right)? 
>> That's just dumb.
>
>No argument there.

*MEH* :) Yeah, there's a couple of "dumb" deps by upstream, that are
not configurable and not even easily patched out (I think I have one
where I could patch, but usually, it's too hardwired in, so to speak). 
Makes you want to grab a fish (fresh from Lutetia), and slap the
culprit around the head with it ... And boy! Are we in for something
getting systemd hardwired as a dep ... *cringe*

>> [1] speaking of that: I noticed, that when I bork[2] an ebuild in
>>     /usr/local/portage, it gets silently(!) ignored and the one from
>>     /usr/portage is used. The only indication is the flag on the
>>     package e.g. ::gentoo vs. ::local. Only once I move the gentoo
>>     ebuilds into e.g. the .attic subfolder, emerge tells me what's
>>     actually wrong with my ::local ebuild in /usr/local/portage. Have
>>     I overlooked an option of emerge or is that a bug?
>
>ebuild /usr/local/portage/cat/pkg/pkg-x.y.ebuild merge
>
>will use the specific ebuild you give it.

Got to alias/script that! But it is a clumsy workaround. As your local
overlay (or any with a higher precedence) should override the base,
emerge should at least tell you about the problem with the overlay,
and then e.g. ask to emerge the base (/usr/portage), or abort. How
about it? I consider it a bug (unless I and Neil overlooked a switch
to emerge, and even then, I'd be for a different default of that, as
hey, if I do an overlay, I want to be told if I borked anything there,
not just almost quietly ignored, but anyways not told the actual
error, until I remove the /usr/portage version (again: missed option
to emerge?))

@all: What's your take on this? Have I (and Neil?) missed an option?
or has emerge a "sort of a bug"?

-dnh, who has not yet ever looked at emerge code, but guessing it
    should not be much of a problem emitting the errors in the overlay
    and some simple handling afterwards ;)

-- 
vi, pr.n.
  A computer program designed to stress-test the use of modal bleeping.

[gentoo-user] Re: necessary use flgas

[James]

David Haller <gentoo <at> dhaller.de> writes:



> >> >You can also start USE with -* in make.conf to turn everything off 
> >> then set your own choices. This is the ideal setup for those who 
> >> prefer to spend more time fixing their computer than using it.  

Huh?
There is an entire universe of embedded devices out there. Vendors refer to
this as the 'internet of things', for commercialization and mindshare
purposes. It is actually just embedded devices, with tcp/ip/udp.......
So there are trillions of reasons for gentoo folks to pursue minimization
all the way down to a stripped (optimized) linux kernel to the point of
running embedded linux. Just take a look at Linaro.

> >> Hey, I got no printer, had others print about 5 pages for me in ~10
> >> years. Why would I want cups?

> >You do know that only the desktop profiles include cups as a default USE
> >flag? The one I recommended does not.

> Try compiling icedtea, libreoffice, scribus and whatnot without
> pulling in cups, no matter the use-flags. And "sabotaging" the ebuild
> and buildsystem to not use cups leads to failed builds, BT,TriedThat :((


One of the (I guess not so obvious) purposes of my recent thread on profiles
is for the community to discuss profiles that are less than the default
profile for a given arch.  We should be able to readily move up (from an
embedded) and down (from a default profile), on each and every arch, with
just the minimal flags, configs and such. Default is not even close to
minimal. I'm just surprised (mildly disappointed :: but not really) that one
of our embedded devs has not already championed this issue.


David is just pointing out yet another reason for a different minimization
need, but still in-line with what I outlined. I just think that  the gentoo
community should not have to go it  individually alone when such
minimizations are desired.


Beside just as gentoo teaches one the basics of linux, so do does one learn
about hardware issues, when you run an embedded system on a given platform.
However, I do understand that *everyone with any sort of embedded expertise*
is now mostly focused on the possibilities with the new arm64 SoCs about to
appear on the market.


hth,
James

Re: [gentoo-user] Re: necessary use flgas

[David Haller]

Hello,

On Tue, 23 Jun 2015, James wrote:
>David Haller <gentoo <at> dhaller.de> writes:
[..]
>> Try compiling icedtea, libreoffice, scribus and whatnot without
>> pulling in cups, no matter the use-flags. And "sabotaging" the ebuild
>> and buildsystem to not use cups leads to failed builds, BT,TriedThat :((
[..]
>David is just pointing out yet another reason for a different minimization
>need, but still in-line with what I outlined. I just think that  the gentoo
>community should not have to go it  individually alone when such
>minimizations are desired.

Yeah, that's an extra aspect for the same "want": What's some random
server or a RasPi or whatnot, needing one Java app, need Cups for? Or
some other lib that's superfluous? Sad thing is, upstream is making it
extra hard. Upstream deps often are weird (to choose a harmless
expression) and to often extremely hard to patch out, if at all.[0]

-dnh

PS: I'm not sure how many "David"'s are here, if in doubt, refer to me
    as 'dnh', as I'm used to it anyways, ok? Oh, darn it, I've not
    adjusted my mail yet. My fault.

[0] I know I repeat myself today, but, a "fresh fish from Lutetia",
    slapped around the head of the responsible ... would at times be
    quite satisfactory :)

-- 
 / panic("Foooooooood fight!");               \
 \   -- /usr/src/linux/drivers/scsi/aha1542.c /

RE: [gentoo-user] necessary use flgas

[Franz Fellner]

behrouz khosravi wrote:
> Hello everyone.
> 
> I really like to have control over my machine as much as possible. In this
> way I will learn a lot, so I am trying to remove all the default use flags
> and control them manually.
> 
> I just don't know which "global" use flags are absolutely necessary to the
> system to make it snappier or secure.
> What do you recommend ?
> 
> Thanks

Oh, USE-Flags are so boing :( They are documented well (quse -D $FLAG), you can even look into specific ebuilds what they actually do.

If you want to learn Gentoo the hard way I suggest to emerge -C python. or emerge -C glibc (yeah, glibc is gnome, and I hate gnome! Whoops, it was glib, not glibc... errr)
Or install certain packages by hand (make install) into /usr/local and forget about it.

(Before someone asks: Those are issues people actually had in the forums and it's really hard to track them down or fix them, you will learn quite a bit about your system ;)...)

To be more serious:
* Set a minimal basic profile (as already suggested)
* Tune your USE-Flags in make.conf. media-related flags (mp3, flac) should be harmless, if you touch flags that get used in core packages (e.g. in the toolchain) double (or triple) check if you don't do evil things.
* fine tune USE-Flags on a per-package-base via /etc/portage/package.use

Re: [gentoo-user] necessary use flgas

[behrouz khosravi]

[-- Attachment #1: Type: text/plain, Size: 942 bytes --]

> To be more serious:
> * Set a minimal basic profile (as already suggested)
> * Tune your USE-Flags in make.conf. media-related flags (mp3, flac) should
> be harmless, if you touch flags that get used in core packages (e.g. in the
> toolchain) double (or triple) check if you don't do evil things.
> * fine tune USE-Flags on a per-package-base via /etc/portage/package.use
>
> thanks.
well what you mentioned was my set up until a week ago. I was on the
default profile. Afterwards I installed the other stuff let the portage
take care of missing use flags, and to be honest it was the first time in
my short linux life that I didnt hate KDE!(I hate the deign choices of
GNOME, and I thinks KDE have a good design with bad implementation!) In my
opinion it was way better that the KDE profile. I have moved to i3wm and
USE="-* ...." and it was not that hard. My concern was the use flags that
are better to be enabled globally like "bzip2".

[-- Attachment #2: Type: text/html, Size: 1212 bytes --]

Re: [gentoo-user] necessary use flgas

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 593 bytes --]

On Wed, 24 Jun 2015 16:29:14 +0430, behrouz khosravi wrote:

>  I have moved to i3wm and
> USE="-* ...." and it was not that hard.

No one said it would be hard, just that it has great potential for
breakage. That potential is still there. When the devs tweak default USE
settings in ebuilds to make things work properly, possibly on USE flags
you have never considered, everyone but you will get those fixes.


-- 
Neil Bothwick

In the begining, there was nothing.
And God said "Let there be light" and there was light.
There was still nothing, but you could see it better.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-user] necessary use flgas

[Alan McKinnon]

On 23/06/2015 15:05, behrouz khosravi wrote:
> Hello everyone.
> 
> I really like to have control over my machine as much as possible. In
> this way I will learn a lot, so I am trying to remove all the default
> use flags and control them manually.


Here's some good advice:

Don't do that. See below.


> I just don't know which "global" use flags are absolutely necessary to
> the system to make it snappier or secure.

That's a bit of a nonsensical line of thought, as what you think you
want doesn't really exist.

Long ago (like 2004) there were a bunch of really stupid fanboy Gentoo
users[1] without any clue at all who thought they could make their
system race along at faster-than-light speed by tweaking flags.

What they actually did was
1. usually slow it down and
2. break it completely with insane compiler flags (like -O9[2])

The single most significant thing you can do to your system to avoid it
being slow (note, I did NOT say "make it fast") is to select an
appropriate CPU type for the compiler to build with. All other
optimizations tend to be insignificant compared to just this one thing.

Put "-march=native" in CFLAGS


> What do you recommend ?

DO NOT SET "USE=-*"

This is only useful for people who want a profile that Gentoo does not
provide or assemble a system in a way that Gentoo isn't built for. Or
people who really know what they are doing and why. You are nowhere near
this category.

Pick a profile that suits what you want to use the computer for.

You have a desktop? Pick a suitable desktop profile. Don't pick a KDE
one unless oyu use KDE for instance (all that does is set some KDE flags
(like semantic-desktop or baloo or whatever they call it now) and force
some KDE packages to be merged. It doesn't change the underlying way
things work.

Then look at what you have.
You never print? Don't install cups or set it's flag.
etc, etc, etc

I very much doubt you can "increase security" by picking some USE flags.
There is no
USE="open-me-up-to-the-world"
or
USE="rock-solid-nsa-proff-tight"
USE flags :-)

So what security features do you need or want?
Figure that out and then set the system up to provide that. You will get
what you want.

It's a lot like starting a restaurant, and wondering what must go on the
menu. First state what kind of restaurant, then the menu is easy. If you
have a fancy French place, you don't sell pizza and don't need the oven.
Got a small cozy like bistro place? Then you DO need a pizza oven.

See? You can't answer the menu question till you know what kind of place.


> 
> Thanks
> 

[1] Lucky for us, they all moved on to other distros. Most folks left
behind in Gentoo now understand their systems well

[2] Which doesn't actually exist....

-- 
Alan McKinnon
alan.mckinnon@gmail.com

Re: [gentoo-user] necessary use flgas

[Alec Ten Harmsel]

On Wed, Jun 24, 2015 at 01:13:40PM +0200, Alan McKinnon wrote:
> On 23/06/2015 15:05, behrouz khosravi wrote:
> > Hello everyone.
> > 
> > I really like to have control over my machine as much as possible. In
> > this way I will learn a lot, so I am trying to remove all the default
> > use flags and control them manually.
> 
> 
> Here's some good advice:
> 
> Don't do that. See below.
> 

Nonsense - do that. If your goal is to learn how stuff works and you're
already reasonably familiar with C/C++ so you can debug any strange
errors that can happen, have fun. Just don't think you'll get any real
work done ;). i.e. it might be good to do this in a virtual machine and
still have a stable system for work.

> 
> > I just don't know which "global" use flags are absolutely necessary to
> > the system to make it snappier or secure.
> 
> That's a bit of a nonsensical line of thought, as what you think you
> want doesn't really exist.
> 
> ...
> 
> Put "-march=native" in CFLAGS
> 

Yes. Also, properly setting CPU_FLAGS_X86 is another thing that can
speed up software *if* said software supports any special instruction
sets. Most "normal desktop software" like web browsers, email clients,
terminals, editors, etc. probably will not get a whole lot of benefit
either way, since most of this software is generally not CPU-bound and
is instead network/disk bound.

In the mornings I primarily use my desktop for reading email and
browsing news with firefox (mostly on sites with minimal JavaScript),
and I have yet to see my load averages climb higher than maybe 0.5.

Any software that does anything requiring lots of math will get a boost
from this type of stuff, though; graphics editing, most things in sci-*
categories, audio/video transcoding, etc.

Alec

P.S. Just realized I don't have "-march=native" in my CFLAGS. Time to
rice - could be getting 1% better performance. ;)

P.P.S. Also, on 1% better performance: My professor for the compilers
class I took used to (maybe still does) work at Google. Apparently
Google sees a <1% increase in performance as *the best thing ever*,
because it can save them a bunch of money in infrastructure and power.
Apparently Google are the ultimate ricers.

Re: [gentoo-user] necessary use flgas

[Alec Ten Harmsel]

On Wed, Jun 24, 2015 at 01:13:40PM +0200, Alan McKinnon wrote:
> On 23/06/2015 15:05, behrouz khosravi wrote:
> > Hello everyone.
> > 
> > I really like to have control over my machine as much as possible. In
> > this way I will learn a lot, so I am trying to remove all the default
> > use flags and control them manually.
> 
> 
> Here's some good advice:
> 
> Don't do that. See below.
> 

Nonsense - do that. If your goal is to learn how stuff works and you're
already reasonably familiar with C/C++ so you can debug any strange
errors that can happen, have fun. Just don't think you'll get any real
work done ;). i.e. it might be good to do this in a virtual machine and
still have a stable system for work.

> 
> > I just don't know which "global" use flags are absolutely necessary to
> > the system to make it snappier or secure.
> 
> That's a bit of a nonsensical line of thought, as what you think you
> want doesn't really exist.
> 
> ...
> 
> Put "-march=native" in CFLAGS
> 

Yes. Also, properly setting CPU_FLAGS_X86 is another thing that can
speed up software *if* said software supports any special instruction
sets. Most "normal desktop software" like web browsers, email clients,
terminals, editors, etc. probably will not get a whole lot of benefit
either way, since most of this software is generally not CPU-bound and
is instead network/disk bound.

In the mornings I primarily use my desktop for reading email and
browsing news with firefox (mostly on sites with minimal JavaScript),
and I have yet to see my load averages climb higher than maybe 0.5.

Any software that does anything requiring lots of math will get a boost
from this type of stuff, though; graphics editing, most things in sci-*
categories, audio/video transcoding, etc.

Alec

P.S. Just realized I don't have "-march=native" in my CFLAGS. Time to
rice - could be getting 1% better performance. ;)

P.P.S. Also, on 1% better performance: My professor for the compilers
class I took used to (maybe still does) work at Google. Apparently
Google sees a <1% increase in performance as *the best thing ever*,
because it can save them a bunch of money in infrastructure and power.
Apparently Google are the ultimate ricers.

Re: [gentoo-user] necessary use flgas

[Alec Ten Harmsel]

On Wed, Jun 24, 2015 at 01:13:40PM +0200, Alan McKinnon wrote:
> On 23/06/2015 15:05, behrouz khosravi wrote:
> > Hello everyone.
> > 
> > I really like to have control over my machine as much as possible. In
> > this way I will learn a lot, so I am trying to remove all the default
> > use flags and control them manually.
> 
> 
> Here's some good advice:
> 
> Don't do that. See below.
> 

Nonsense - do that. If your goal is to learn how stuff works and you're
already reasonably familiar with C/C++ so you can debug any strange
errors that can happen, have fun. Just don't think you'll get any real
work done ;). i.e. it might be good to do this in a virtual machine and
still have a stable system for work.

> 
> > I just don't know which "global" use flags are absolutely necessary to
> > the system to make it snappier or secure.
> 
> That's a bit of a nonsensical line of thought, as what you think you
> want doesn't really exist.
> 
> ...
> 
> Put "-march=native" in CFLAGS
> 

Yes. Also, properly setting CPU_FLAGS_X86 is another thing that can
speed up software *if* said software supports any special instruction
sets. Most "normal desktop software" like web browsers, email clients,
terminals, editors, etc. probably will not get a whole lot of benefit
either way, since most of this software is generally not CPU-bound and
is instead network/disk bound.

In the mornings I primarily use my desktop for reading email and
browsing news with firefox (mostly on sites with minimal JavaScript),
and I have yet to see my load averages climb higher than maybe 0.5.

Any software that does anything requiring lots of math will get a boost
from this type of stuff, though; graphics editing, most things in sci-*
categories, audio/video transcoding, etc.

Alec

P.S. Just realized I don't have "-march=native" in my CFLAGS. Time to
rice - could be getting 1% better performance. ;)

P.P.S. Also, on 1% better performance: My professor for the compilers
class I took used to (maybe still does) work at Google. Apparently
Google sees a <1% increase in performance as *the best thing ever*,
because it can save them a bunch of money in infrastructure and power.
Apparently Google are the ultimate ricers.

[gentoo-user] Re: necessary use flgas

[»Q«]

On Wed, 24 Jun 2015 07:50:07 -0400
Alec Ten Harmsel <alec@alectenharmsel.com> wrote:

> On Wed, Jun 24, 2015 at 01:13:40PM +0200, Alan McKinnon wrote:
> > On 23/06/2015 15:05, behrouz khosravi wrote:

> >> I am trying to remove all the default use flags and control them
> >> manually. 
> > 
> > Here's some good advice:
> > 
> > Don't do that. See below.
> 
> Nonsense - do that. If your goal is to learn how stuff works and
> you're already reasonably familiar with C/C++ so you can debug any
> strange errors that can happen, have fun. Just don't think you'll get
> any real work done ;). 

I don't advocate completely overriding the profile defaults, but I do
it myself and have been for years.  In terms of getting work done, I
estimate it costs me roughly five minutes per month, but with a pretty
large standard deviation -- most months it's zero.  It helps a lot to
keep an eye on the -dev group for any discussion of possibly changing
defaults;  when a default changes, it almost always means you're going
to have to change some flag settings either globally or for a few
packages.  Be particularly vigilant about changes which might leave
you up a creek without a paddle, e.g. @system stuff or networking
stuff.

It also will help to learn which posters here override profile settings
with USE="-*".  There are a few of us (sorry, I only have a vague
mental list), and the threads we start are likely to have the same
issues you may hit.  And whenever you ask for help about *anything*,
whether you think it has to do with USE flags or not, mention at the
start you're overriding the defaults.  You'll get more little lectures
about not doing that, but it's much better than having a guru who's
trying to help find out a dozen posts downthread that he's been on a
wild goose chase.
 
> Also, properly setting CPU_FLAGS_X86 is another thing that can
> speed up software *if* said software supports any special instruction
> sets. 

And thank $DIETY for app-portage/cpuinfo2cpuflags.  Well, I guess it's
better to thank mgorny.

Re: [gentoo-user] necessary use flgas

[Alan McKinnon]

On 24/06/2015 13:50, Alec Ten Harmsel wrote:
> P.P.S. Also, on 1% better performance: My professor for the compilers
> class I took used to (maybe still does) work at Google. Apparently
> Google sees a <1% increase in performance as *the best thing ever*,
> because it can save them a bunch of money in infrastructure and power.
> Apparently Google are the ultimate ricers.


Sounds like a case where Google already did the sensible optimizations
long long ago and are now hitting the diminishing returns from the long
tail. There are probably many of these and they all add up.

One thing I've learned about Google's setup - there's nothing else like
it out there and they are truly unique. Almost nothing Google does to
optimize their setup is widely applicable to anything else :-)

Take their power density. Last figures I have is they were running at 4x
the kW per square foot as anyone else with a brain. This terrifies
people who know about cooling. But, that's the setup and that's what
Google has to work with. Now suddenly, all those lots of little
improvements start to become a huge deal.

So yes, ultimate ricers. Also the ultimates in
"riding-co-close-to-the-edge-you-fall-off-the-cliff" :-)

-- 
Alan McKinnon
alan.mckinnon@gmail.com

Re: [gentoo-user] necessary use flgas

[Dale]

Alan McKinnon wrote:
> On 24/06/2015 13:50, Alec Ten Harmsel wrote:
>> P.P.S. Also, on 1% better performance: My professor for the compilers
>> class I took used to (maybe still does) work at Google. Apparently
>> Google sees a <1% increase in performance as *the best thing ever*,
>> because it can save them a bunch of money in infrastructure and power.
>> Apparently Google are the ultimate ricers.
>
> Sounds like a case where Google already did the sensible optimizations
> long long ago and are now hitting the diminishing returns from the long
> tail. There are probably many of these and they all add up.
>
> One thing I've learned about Google's setup - there's nothing else like
> it out there and they are truly unique. Almost nothing Google does to
> optimize their setup is widely applicable to anything else :-)
>
> Take their power density. Last figures I have is they were running at 4x
> the kW per square foot as anyone else with a brain. This terrifies
> people who know about cooling. But, that's the setup and that's what
> Google has to work with. Now suddenly, all those lots of little
> improvements start to become a huge deal.
>
> So yes, ultimate ricers. Also the ultimates in
> "riding-co-close-to-the-edge-you-fall-off-the-cliff" :-)
>


Do we even have a clue how many puters Google has now?  I read several
years ago it was like 10,000 or so.  No telling what they have now.  o_O

Dale

:-)  :-) 

Re: [gentoo-user] necessary use flgas

[Alan McKinnon]

On 25/06/2015 10:27, Dale wrote:
> Alan McKinnon wrote:
>> On 24/06/2015 13:50, Alec Ten Harmsel wrote:
>>> P.P.S. Also, on 1% better performance: My professor for the compilers
>>> class I took used to (maybe still does) work at Google. Apparently
>>> Google sees a <1% increase in performance as *the best thing ever*,
>>> because it can save them a bunch of money in infrastructure and power.
>>> Apparently Google are the ultimate ricers.
>>
>> Sounds like a case where Google already did the sensible optimizations
>> long long ago and are now hitting the diminishing returns from the long
>> tail. There are probably many of these and they all add up.
>>
>> One thing I've learned about Google's setup - there's nothing else like
>> it out there and they are truly unique. Almost nothing Google does to
>> optimize their setup is widely applicable to anything else :-)
>>
>> Take their power density. Last figures I have is they were running at 4x
>> the kW per square foot as anyone else with a brain. This terrifies
>> people who know about cooling. But, that's the setup and that's what
>> Google has to work with. Now suddenly, all those lots of little
>> improvements start to become a huge deal.
>>
>> So yes, ultimate ricers. Also the ultimates in
>> "riding-co-close-to-the-edge-you-fall-off-the-cliff" :-)
>>
> 
> 
> Do we even have a clue how many puters Google has now?  I read several
> years ago it was like 10,000 or so.  No telling what they have now.  o_O

Around 2006, it was at least 100,000

You are out by an order of magnitude :-)

I would not be surprised if today Google had 5 million custom-built
stripped-down motherboards in production. Google long ago moved past the
idea of "having individual computers". By all accounts they have many
large systems, and those systems are made up of lots of small parts -
each part being a thing with CPU/RAM/disks and whatever.


-- 
Alan McKinnon
alan.mckinnon@gmail.com

Re: [gentoo-user] necessary use flgas

[Dale]

Alan McKinnon wrote:
> On 25/06/2015 10:27, Dale wrote:
>>
>>
>> Do we even have a clue how many puters Google has now?  I read several
>> years ago it was like 10,000 or so.  No telling what they have now.  o_O
> Around 2006, it was at least 100,000
>
> You are out by an order of magnitude :-)
>
> I would not be surprised if today Google had 5 million custom-built
> stripped-down motherboards in production. Google long ago moved past the
> idea of "having individual computers". By all accounts they have many
> large systems, and those systems are made up of lots of small parts -
> each part being a thing with CPU/RAM/disks and whatever.
>
>


I bet that with the volume they buy, they can have their mobos custom
made.  I need to google and see if I can even find a picture of what
they use now.  I'm curious.

Dale

:-)  :-) 

Re: [gentoo-user] necessary use flgas

[behrouz khosravi]

[-- Attachment #1: Type: text/plain, Size: 1722 bytes --]

> Here's some good advice:
>
> Don't do that. See below.
>

Oops! I have done it and I am happy so far !

That's a bit of a nonsensical line of thought, as what you think you
> want doesn't really exist.
>

I think you misunderstood me! for example adding CPU specific flags is a
good idea right?
I meant something like that. For example is it wise to enable opengl flag
globally ? is it helpful to do so?


> > What do you recommend ?
>
> DO NOT SET "USE=-*"
>

As I said before I have done it and I totally recommend it to anyone
interested to get a better understanding of user land.



> Pick a profile that suits what you want to use the computer for.

You have a desktop? Pick a suitable desktop profile. Don't pick a KDE
> one unless oyu use KDE for instance (all that does is set some KDE flags
> (like semantic-desktop or baloo or whatever they call it now) and force
> some KDE packages to be merged. It doesn't change the underlying way
> things work.
>

desktop profiles are very big for my taste. In fact I have been using KDE
for about a year on the default (basic) profile.
I have compiled the KDE with KDE profile and I have witnessed the
differences with my own eyes.


> I very much doubt you can "increase security" by picking some USE flags.
> There is no
> USE="open-me-up-to-the-world"
> or
> USE="rock-solid-nsa-proff-tight"
> USE flags :-)
>
> So what security features do you need or want?
> Figure that out and then set the system up to provide that. You will get
> what you want.
>
> Well I know there is no USE flag like that! I am not that stupid but I
remember that I have read somewhere(unfortunately I dont remember where)
that disabling some use flags will degrade the security of system.

[-- Attachment #2: Type: text/html, Size: 2940 bytes --]

Re: [gentoo-user] necessary use flgas

[Jc García]

2015-06-24 6:23 GMT-06:00 behrouz khosravi <bz.khosravi@gmail.com>:
>
>> Here's some good advice:
>>
>> Don't do that. See below.
>
>
> Oops! I have done it and I am happy so far !
>
>> That's a bit of a nonsensical line of thought, as what you think you
>> want doesn't really exist.
>
>
> I think you misunderstood me! for example adding CPU specific flags is a
> good idea right?
> I meant something like that. For example is it wise to enable opengl flag
> globally ? is it helpful to do so?
>
>>
>> > What do you recommend ?
>>
>> DO NOT SET "USE=-*"
>
>
> As I said before I have done it and I totally recommend it to anyone
> interested to get a better understanding of user land.
>
I don't see the point of using USE="-*"  for learning, if you want to
really learn, create and overlay and make your own profile, read the
developer documentation  about it, and do a proper thing, not some
clunky mess in /etc/portage.
You could very well evaluate the basic profile, and part from there or
modify it as you see fit, but making a mess that you wont be able to
port easily in case you actually make something you might want to keep
and reproduce somewhere else, is not getting a better understanding.

Re: [gentoo-user] necessary use flgas

[Alan McKinnon]

On 25/06/2015 06:25, Jc García wrote:
> 2015-06-24 6:23 GMT-06:00 behrouz khosravi <bz.khosravi@gmail.com>:
>>
>>> Here's some good advice:
>>>
>>> Don't do that. See below.
>>
>>
>> Oops! I have done it and I am happy so far !
>>
>>> That's a bit of a nonsensical line of thought, as what you think you
>>> want doesn't really exist.
>>
>>
>> I think you misunderstood me! for example adding CPU specific flags is a
>> good idea right?
>> I meant something like that. For example is it wise to enable opengl flag
>> globally ? is it helpful to do so?
>>
>>>
>>>> What do you recommend ?
>>>
>>> DO NOT SET "USE=-*"
>>
>>
>> As I said before I have done it and I totally recommend it to anyone
>> interested to get a better understanding of user land.
>>
> I don't see the point of using USE="-*"  for learning, if you want to
> really learn, create and overlay and make your own profile, read the
> developer documentation  about it, and do a proper thing, not some
> clunky mess in /etc/portage.
> You could very well evaluate the basic profile, and part from there or
> modify it as you see fit, but making a mess that you wont be able to
> port easily in case you actually make something you might want to keep
> and reproduce somewhere else, is not getting a better understanding.
> 


Best way I ever found to learn how things really work under the hood is
to build a Linux From Scratch and pay close attention to every single step.

Not that you'd ever actually *use* that system - there's no sane package
management for a start - but after building an LFS, the content of
ebuilds in @system starts to make a lot more sense; you can see why some
of the decisions in the profiles were made; and make.conf now appears in
a whole new light.

Then take the valuable lessons from LFS and apply them appropriately to
using Gentoo. These things are tools and the best workmen are always
very familiar with their tools as a co-ordinated whole (as opposed to a
bunch of mish-mash stuff cluttering up a toolbox)

-- 
Alan McKinnon
alan.mckinnon@gmail.com

Re: [gentoo-user] necessary use flgas

[behrouz khosravi]

[-- Attachment #1: Type: text/plain, Size: 779 bytes --]

Best way I ever found to learn how things really work under the hood is
> to build a Linux From Scratch and pay close attention to every single step.
>
> Not that you'd ever actually *use* that system - there's no sane package
> management for a start - but after building an LFS, the content of
> ebuilds in @system starts to make a lot more sense; you can see why some
> of the decisions in the profiles were made; and make.conf now appears in
> a whole new light.
>
> Then take the valuable lessons from LFS and apply them appropriately to
> using Gentoo. These things are tools and the best workmen are always
> very familiar with their tools as a co-ordinated whole (as opposed to a
> bunch of mish-mash stuff cluttering up a toolbox)
>
>
Thanks. I will definitely do that.

[-- Attachment #2: Type: text/html, Size: 1122 bytes --]

Re: [gentoo-user] necessary use flgas

[Rich Freeman]

On Thu, Jun 25, 2015 at 8:01 AM, behrouz khosravi <bz.khosravi@gmail.com> wrote:
>
>
>> Best way I ever found to learn how things really work under the hood is
>> to build a Linux From Scratch and pay close attention to every single
>> step.
>>
>> Not that you'd ever actually *use* that system - there's no sane package
>> management for a start - but after building an LFS, the content of
>> ebuilds in @system starts to make a lot more sense; you can see why some
>> of the decisions in the profiles were made; and make.conf now appears in
>> a whole new light.
>>
>> Then take the valuable lessons from LFS and apply them appropriately to
>> using Gentoo. These things are tools and the best workmen are always
>> very familiar with their tools as a co-ordinated whole (as opposed to a
>> bunch of mish-mash stuff cluttering up a toolbox)
>>
>
> Thanks. I will definitely do that.

The only issue I'd raise with LFS in this day and age is that many of
these guides tend to leave out stuff like devtmpfs, udev, policykit,
and so on.  Some people choose not to use them (this list probably
being one of the larger collections of such folks), but it is
increasingly important to understand how modern distros actually
operate.

Are there any LFS-like guides that actually utilize dbus/etc?

-- 
Rich

Re: [gentoo-user] necessary use flgas

[Emanuele Rusconi]

On 25 June 2015 at 14:56, Rich Freeman <rich0@gentoo.org> wrote:
>
> The only issue I'd raise with LFS in this day and age is that many of
> these guides tend to leave out stuff like devtmpfs, udev, policykit,
> and so on.  Some people choose not to use them (this list probably
> being one of the larger collections of such folks), but it is
> increasingly important to understand how modern distros actually
> operate.
>
> Are there any LFS-like guides that actually utilize dbus/etc?
>
> --
> Rich
>

You're misinformed, actually.

The base guide (LFS proper) focuses on building just a base working system (a
@system, so to speak) capable of booting, connecting to the web, and building
whatever you may want to install upon that.  It uses eudev, by the way,
although there is a version based on systemd which, from my understanding,
is considered to be a non-default one.

Dbus, policykit, Xorg, WMs, DEs etc. are all in the BLFS guide
("Beyond LFS"), which
by nature is not a linear guide but more like a collection of recipes from which
to choose and pick.

-- Emanuele Rusconi

Re: [gentoo-user] necessary use flags

[Thomas Mueller]

> Best way I ever found to learn how things really work under the hood is
> to build a Linux From Scratch and pay close attention to every single step.

> Not that you'd ever actually *use* that system - there's no sane package
> management for a start - but after building an LFS, the content of
> ebuilds in @system starts to make a lot more sense; you can see why some
> of the decisions in the profiles were made; and make.conf now appears in
> a whole new light.

> Then take the valuable lessons from LFS and apply them appropriately to
> using Gentoo. These things are tools and the best workmen are always
> very familiar with their tools as a co-ordinated whole (as opposed to a
> bunch of mish-mash stuff cluttering up a toolbox)

> Alan McKinnon

One could build a system with LFS or CLFS and then adopt one or more package managemant systems such as Gentoo portage, pacman with Arch Build System, voidlinux, etc.

Different package management systems would go to separate installations, separate partitions, of course.

Lack of package management, or actually package management that had no recognition of dependencies, was a large part of what made me not continue with Slackware beyond now-outdated 13.0.

I was spoiled by FreeBSD ports, NetBSD pkgsrc, and Linux distros with package management that recognized dependencies.

Tom

Re: [gentoo-user] necessary use flgas

[Walter Dnes]

On Wed, Jun 24, 2015 at 04:53:18PM +0430, behrouz khosravi wrote

> 
> > > What do you recommend ?
> >
> > DO NOT SET "USE=-*"
> >
> 
> As I said before I have done it and I totally recommend it to anyone
> interested to get a better understanding of user land.

  The point with "USE=-*" is to create your own base profile.  E.g. when
I upgraded my old Dell Core2 Duo from 32 to 64 bit Gentoo, I dropped
"USE=-*".  I went from...

USE_BASE="-* a52 aac bzip2 cxx fortran ncurses netifrc nptl nptlonly nsplugin offensive openssl posix readline ssl threads vim-syntax zlib X dga dri exif ffmpeg flac classic gif intel jpeg mng mp3 mpeg ogg opengl png rtmp theora tiff truetype vorbis xcomposite webm x264 xpm xv xvid xvmc"

...to...

USE="X apng bindist ffmpeg jpeg png truetype xorg -acl -berkdb -chatzilla -cracklib -crypt -gallium -gdbm -gmp-autoupdate -gstreamer -iconv -introspection -ipc -iptables -ipv6 -libav -llvm -nls -openmp -pam -roaming -sendmail -tcpd -udev -unicode"

  So I went from "-*" plus add a lot of USE flags to
default/linux/amd64/13.0/no-multilib and negating a lot of USE flags.
Six of one, half a dozen of the other.

-- 
Walter Dnes <waltdnes@waltdnes.org>
I don't run "desktop environments"; I run useful applications

Re: [gentoo-user] necessary use flgas

[Alan McKinnon]

On 24/06/2015 14:23, behrouz khosravi wrote:
> 
>     Here's some good advice:
> 
>     Don't do that. See below.
> 
> 
> Oops! I have done it and I am happy so far !

Wait a little longer :-)

I predict within 2 weeks you'll be posting back about some completely
baffling problem and we'll have a huge thread to help fix it for you.
But such id how mailing lists work.

Keep Q's advice in mind - when posting, *always* state up front in caps
that you have over-ridden USE

> 
>     That's a bit of a nonsensical line of thought, as what you think you
>     want doesn't really exist.
> 
> 
> I think you misunderstood me! for example adding CPU specific flags is a
> good idea right?

Getting your flags right for your CPU is always a very good idea, it's
one of the main things Gentoo is built for. Binary distros can't easily
do this for you (way too many variations) but a source-distro like
Gentoo can do it with ease.

It is a very good example of where a source distro truly shines and a
valid case of optimizing your binaries. It's the exact opposite of ricing.

> I meant something like that. For example is it wise to enable opengl
> flag globally ? is it helpful to do so?

If you need opengl, enable it.
If you don't need opengl, disable it.
If you have some softare that *requires* opengl to work, well then you
better enable it.

There's no correct answer to your question, you should instead be asking
"Do I need and/or want opengl?" and before that ask "What is opengl anyway?"

No doubt a bunch of folks will weigh in here telling you why opengl
is/isn't an awesome idea. But you still have to ask and answer those
questions for yourself.

>  
> 
>     > What do you recommend ?
> 
>     DO NOT SET "USE=-*"
> 
>  
> As I said before I have done it and I totally recommend it to anyone
> interested to get a better understanding of user land.

For experts, yes.

To be blunt, you are not an expert, not even close.

But hey, it's your system and your time you'll expend. If you break it,
you get to keep all the little tiny shards.

> 
>  
> 
>     Pick a profile that suits what you want to use the computer for. 
> 
>     You have a desktop? Pick a suitable desktop profile. Don't pick a KDE
>     one unless oyu use KDE for instance (all that does is set some KDE flags
>     (like semantic-desktop or baloo or whatever they call it now) and force
>     some KDE packages to be merged. It doesn't change the underlying way
>     things work.
> 
> 
> desktop profiles are very big for my taste. In fact I have been using
> KDE for about a year on the default (basic) profile.
> I have compiled the KDE with KDE profile and I have witnessed the
> differences with my own eyes.

And what difference is that? There is very little difference between a
desktop profile with KDE installed, and a KDE profile that includes KDE.

I have firefox installed. It runs. There isn't a "firefox profile" but
if there was, I expect to see very little difference between that and
what I currently have.

Unless you are complaining about a profile that emerged every known KDE
app under the sun, when what you actually wanted was just the few KDE
apps you really use minus all the semantic desktop and akonadi fluff.
There's a huge difference there. That's how my main machine is set up,
and why I don't use the KDE profile.

>  
> 
>     I very much doubt you can "increase security" by picking some USE flags.
>     There is no
>     USE="open-me-up-to-the-world"
>     or
>     USE="rock-solid-nsa-proff-tight"
>     USE flags :-)
> 
>     So what security features do you need or want?
>     Figure that out and then set the system up to provide that. You will get
>     what you want.
> 
> Well I know there is no USE flag like that! I am not that stupid but I
> remember that I have read somewhere(unfortunately I dont remember where)
> that disabling some use flags will degrade the security of system.

Of course that can happen, but it's nowhere near as simple as you imply.

As with everything else in life, the truth is always considerably more
complex than you think. USE does not enable or disable security. USE
enables or disables specific features in software, usually features that
are configured at build time.

These features can have side-effects that relate to security. Or to
accessibility. Or to look and feel. Or to semantic desktop fluff. Or to
the ability to print. Or to any other aspect of software you care to
mention.

Take for example PAM - that's a security-related optional feature. You
can disable it entirely if you like but then you lose the security
features of PAM (specifically, the ability to specify exactly how you
want authentication and authorization to be done leaving you only with
the basic username/password scheme). Maybe you want that, maybe you
don't. But nobody can tell you that the setting of the USE flag will
improve or degrade your security stance.

It's just not that simple.

You have to look at the flag, and understand what it means. Then look at
the software that uses it and understand what difference it makes *to
that software*. Then decide what the impact of those differences are
going to be *in your case*. And every case is different.


-- 
Alan McKinnon
alan.mckinnon@gmail.com