[gentoo-user] portage: fixed or not???

[gentoo-user] portage: fixed or not???

[Jarry]

Hi,

there was a thread concerning portage/emerge being recently fixed
and faster now (sorry, forgot original subject). Well, I was really
impressed by that improvement, until today:

"emerge --sync" takes again very long time, nearly freezing at 51%
of "updating portage cache", cpu load is on 99% load, 25 minutes and
I'm still waiting. And 2 days ago the whole "emerge --sync" took
about 3-4 minutes! Anyone else having the same experience?

Jarry
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Dale]

Jarry wrote:

>Hi,
>
>there was a thread concerning portage/emerge being recently fixed
>and faster now (sorry, forgot original subject). Well, I was really
>impressed by that improvement, until today:
>
>"emerge --sync" takes again very long time, nearly freezing at 51%
>of "updating portage cache", cpu load is on 99% load, 25 minutes and
>I'm still waiting. And 2 days ago the whole "emerge --sync" took
>about 3-4 minutes! Anyone else having the same experience?
>
>Jarry
>  
>
Same here just a bit ago.  I did not use the du -s thing though.  It
stayed around 50% for a while. 

What happened?  Anybody know?

Dale


-- 
To err is human, I'm most certainly human.

 

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Norberto Bensa]

Jarry wrote:
> Anyone else having the same experience?
>

I've never seen a portage speed improvement in over two years.


-- 
Norberto Bensa
4544-9692
Ciudad de Buenos Aires, Argentina
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[John Green]

Dale wrote:

>Jarry wrote:
>
>  
>
>>Hi,
>>
>>there was a thread concerning portage/emerge being recently fixed
>>and faster now (sorry, forgot original subject). Well, I was really
>>impressed by that improvement, until today:
>>
>>"emerge --sync" takes again very long time, nearly freezing at 51%
>>of "updating portage cache", cpu load is on 99% load, 25 minutes and
>>I'm still waiting. And 2 days ago the whole "emerge --sync" took
>>about 3-4 minutes! Anyone else having the same experience?
>>
>>Jarry
>> 
>>
>>    
>>
>Same here just a bit ago.  I did not use the du -s thing though.  It
>stayed around 50% for a while. 
>
>What happened?  Anybody know?
>
>Dale
>
>
>  
>
Same here too.  No idea why.

John Green
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Nick Rout]

To everyone in this thread: it would probably help if you specified
which version of portage you are running!


On Sun, 06 Nov 2005 16:34:00 +0100
Jarry wrote:

> Hi,
> 
> there was a thread concerning portage/emerge being recently fixed
> and faster now (sorry, forgot original subject). Well, I was really
> impressed by that improvement, until today:
> 
> "emerge --sync" takes again very long time, nearly freezing at 51%
> of "updating portage cache", cpu load is on 99% load, 25 minutes and
> I'm still waiting. And 2 days ago the whole "emerge --sync" took
> about 3-4 minutes! Anyone else having the same experience?
> 
> Jarry
> -- 
> gentoo-user@gentoo.org mailing list

-- 
Nick Rout <nick@rout.co.nz>

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jarry]

Nick Rout wrote:
> To everyone in this thread: it would probably help if you specified
> which version of portage you are running!

Do you really think it is important? Because since I'm using Gentoo,
I do not take care about versions, portage does it instead of me.
All I do is running this set of commands every night from crontab:

emerge --sync
emerge --update --deep --newuse world
emerge --depclean
revdep-rebuild

So my portage is also always updated, to the last stable version.
Now it is 2.0.51.22-r3...

Jarry
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Bogdan Ionita]

[-- Attachment #1: Type: text/plain, Size: 656 bytes --]

On 11/6/05, Jarry <jarry@gmx.net> wrote:
>
> Hi,
>
> there was a thread concerning portage/emerge being recently fixed
> and faster now (sorry, forgot original subject). Well, I was really
> impressed by that improvement, until today:
>
> "emerge --sync" takes again very long time, nearly freezing at 51%
> of "updating portage cache", cpu load is on 99% load, 25 minutes and
> I'm still waiting. And 2 days ago the whole "emerge --sync" took
> about 3-4 minutes! Anyone else having the same experience?



Hi,

I had the same problem, don't know why, solved it like this:

http://gentoo-wiki.com/TIP_speed_up_portage_with_cdb

Neko

[-- Attachment #2: Type: text/html, Size: 1059 bytes --]

Re: [gentoo-user] portage: fixed or not???

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 759 bytes --]

On Sun, 06 Nov 2005 22:03:38 +0100 Jarry <jarry@gmx.net> wrote:
| Nick Rout wrote:
| > To everyone in this thread: it would probably help if you specified
| > which version of portage you are running!
| 
| Do you really think it is important? Because since I'm using Gentoo,
| I do not take care about versions, portage does it instead of me.
| All I do is running this set of commands every night from crontab:
| 
| emerge --sync
| emerge --update --deep --newuse world
| emerge --depclean
| revdep-rebuild

I really hope you don't want your system to carry on working...

-- 
Ciaran McCreesh : Gentoo Developer (Anti-XML, anti-newbie conspiracy)
Mail            : ciaranm at gentoo.org
Web             : http://dev.gentoo.org/~ciaranm


[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] portage: fixed or not???

[Nick Rout]

On Sun, 06 Nov 2005 22:03:38 +0100
Jarry wrote:

> Nick Rout wrote:
> > To everyone in this thread: it would probably help if you specified
> > which version of portage you are running!
> 
> Do you really think it is important? Because since I'm using Gentoo,
> I do not take care about versions, portage does it instead of me.
> All I do is running this set of commands every night from crontab:

Of course it bloody matters. If the portage package was changed it
results in a new version, so maybe you are not running a version with
the "fix". Or maybe you are. But how the hell would we know unless you
tell us?

> So my portage is also always updated, to the last stable version.
> Now it is 2.0.51.22-r3...
> 

great, so you see the sync delay at 50% with this version or not?

> Jarry
> -- 
> gentoo-user@gentoo.org mailing list

-- 
Nick Rout <nick@rout.co.nz>

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[b.n.]

> Do you really think it is important? Because since I'm using Gentoo,
> I do not take care about versions, portage does it instead of me.
> All I do is running this set of commands every night from crontab:
> 
> emerge --sync
> emerge --update --deep --newuse world
> emerge --depclean
> revdep-rebuild
> 
> So my portage is also always updated, to the last stable version.
> Now it is 2.0.51.22-r3...

We didn't know your portage is always updated, glad to know it.
But you're not the only one having this problem, it seems from the 
thread, and you can't assume other people have your habits. So it was a 
perfectly meaningful question.

m.
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Dale]

Nick Rout wrote:

>To everyone in this thread: it would probably help if you specified
>which version of portage you are running!
>
>
>On Sun, 06 Nov 2005 16:34:00 +0100
>Jarry wrote:
>
>  
>
>>Hi,
>>
>>there was a thread concerning portage/emerge being recently fixed
>>and faster now (sorry, forgot original subject). Well, I was really
>>impressed by that improvement, until today:
>>
>>"emerge --sync" takes again very long time, nearly freezing at 51%
>>of "updating portage cache", cpu load is on 99% load, 25 minutes and
>>I'm still waiting. And 2 days ago the whole "emerge --sync" took
>>about 3-4 minutes! Anyone else having the same experience?
>>
>>Jarry
>>-- 
>>gentoo-user@gentoo.org mailing list
>>    
>>
>
>  
>
> root@smoker / # emerge --version
> Portage 2.0.51.22-r3 (default-linux/x86/2005.0, gcc-3.3.6,
> glibc-2.3.5-r2, 2.6.12-gentoo-r10 i686)
> root@smoker / #   


That help any?

Dale
:-)


-- 
To err is human, I'm most certainly human.

 

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[John Green]

Nick Rout wrote:

>To everyone in this thread: it would probably help if you specified
>which version of portage you are running!
>
>
>On Sun, 06 Nov 2005 16:34:00 +0100
>Jarry wrote:
>
>  
>
Still running portage 2.0.51.22-r3 here, which is why the speed
variation was puzzling.

I now think the variation (with this version of portage) simply reflects
whether the "emerge sync" changed anything or not.   If nothing changed,
the cache rebuild is quick.  If something changed, the rebuild is slow and
hangs around for a long time at 51% or 52%.

John Green
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Richard Fish]

John Green wrote:

>Nick Rout wrote:
>
>  
>
>>To everyone in this thread: it would probably help if you specified
>>which version of portage you are running!
>>
>>
>>On Sun, 06 Nov 2005 16:34:00 +0100
>>Jarry wrote:
>>
>> 
>>
>>    
>>
>Still running portage 2.0.51.22-r3 here, which is why the speed
>variation was puzzling.
>  
>

I'm on 2.0.53_rc7 (~x86), and it is still fast for me, although I am 
using the cdb cache module as well.

-Richard

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Qian Qiao]

On 11/6/05, Jarry <jarry@gmx.net> wrote:
> Nick Rout wrote:
> > To everyone in this thread: it would probably help if you specified
> > which version of portage you are running!
>
> Do you really think it is important? Because since I'm using Gentoo,
> I do not take care about versions, portage does it instead of me.
> All I do is running this set of commands every night from crontab:
>
> emerge --sync
> emerge --update --deep --newuse world
> emerge --depclean
> revdep-rebuild
>
> So my portage is also always updated, to the last stable version.
> Now it is 2.0.51.22-r3...

Omg, you have emerge --deep --newuse --update world as a *cron* job?

-- Joe

--
There are 3 kinds of people in the world:
Those who can count, and those who can't.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Holly Bostick]

Qian Qiao schreef:
> On 11/6/05, Jarry <jarry@gmx.net> wrote:
>> 
>> All I do is running this set of commands every night from
>> crontab:
>> 
>> emerge --sync emerge --update --deep --newuse world emerge
>> --depclean revdep-rebuild
>> 
>> So my portage is also always updated, to the last stable version. 
>> Now it is 2.0.51.22-r3...
> 
> 
> Omg, you have emerge --deep --newuse --update world as a *cron* job?
> 

.... and just when you thought it couldn't get any worse, comes a
depclean....

.... every night.

Ciaran said it best:

> I really hope you don't want your system to carry on working...

Holly
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Qian Qiao]

On 11/7/05, Holly Bostick <motub@planet.nl> wrote:
> Qian Qiao schreef:
> > Omg, you have emerge --deep --newuse --update world as a *cron* job?
> >
>
> .... and just when you thought it couldn't get any worse, comes a
> depclean....
>
> .... every night.
>
> Ciaran said it best:
>
> > I really hope you don't want your system to carry on working...

Wonder how he survivied that apache layout upgrade, :P

Anyways, the mysql ebuild was nice, you have to set STRAIGHT_UPGRADE=1
in order to do emerge --update mysql.

But for Jarry, he probably need 2 variables:
BRAVE_YET_DUMB=1
I_WILL_NOT_BLAME_THE_DEVS_IF_MY_SYSTEM_GETS_BORKED=1

-- Joe

--
There are 3 kinds of people in the world:
Those who can count, and those who can't.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jarry]

Holly Bostick wrote:
> Qian Qiao schreef:
>>On 11/6/05, Jarry <jarry@gmx.net> wrote:
>>
>>>All I do is running this set of commands every night from
>>>crontab:
>>>emerge --sync emerge --update --deep --newuse world emerge
>>>--depclean revdep-rebuild
>>
>>Omg, you have emerge --deep --newuse --update world as a *cron* job?
> 
> .... and just when you thought it couldn't get any worse, comes a
> depclean .... every night.
> 
> Ciaran said it best:
>>I really hope you don't want your system to carry on working...

http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=2&chap=1#doc_chap3
======================== <copy&paste>=====================
Updating your System
To keep your system in perfect shape (and not to mention install the
latest security updates) you need to update your system regularly. Since
Portage only checks the ebuilds in your Portage tree you first have to
update your Portage tree.

Code Listing 2: Updating the Portage tree
# emerge --sync

 When your Portage tree is updated, you can update your system with
emerge --update world
...
Code Listing 16: Removing orphaned dependencies
# emerge --update --deep --newuse world
# emerge --depclean
# revdep-rebuild
============================================================

Could some of you, gentoo-wizards, be kind enough and explain, what
is wrong in doing the things the way gentoo handbook recommends it?
Without offensive language, if I may ask...

Jarry
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jarry]

Qian Qiao wrote:

> But for Jarry, he probably need 2 variables:
> BRAVE_YET_DUMB=1
> I_WILL_NOT_BLAME_THE_DEVS_IF_MY_SYSTEM_GETS_BORKED=1

Satisfied? Carry on, if it makes you feel better...
Anyway, I'll not fight back to this primitive insultation. It is
under my level, and imho under level of this mailing list too...

Jarry

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jarry]

b.n. wrote:

> Jarry is quite arrogant...

Could you please be more specific? Who did I insulted, or what
makes you think I am arrogant? Copy&paste please, if you find
something...

Jarry

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Qian Qiao]

On 11/7/05, Jarry <jarry@gmx.net> wrote:
> http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=2&chap=1#doc_chap3
> ======================== <copy&paste>=====================
> Updating your System
> To keep your system in perfect shape (and not to mention install the
> latest security updates) you need to update your system regularly. Since
> Portage only checks the ebuilds in your Portage tree you first have to
> update your Portage tree.
>
> Code Listing 2: Updating the Portage tree
> # emerge --sync
>
>  When your Portage tree is updated, you can update your system with
> emerge --update world
> ...
> Code Listing 16: Removing orphaned dependencies
> # emerge --update --deep --newuse world
> # emerge --depclean
> # revdep-rebuild
> ============================================================
>
> Could some of you, gentoo-wizards, be kind enough and explain, what
> is wrong in doing the things the way gentoo handbook recommends it?
> Without offensive language, if I may ask...

The idea is very simple: some upgrades are not compatible with what
you have previously installed.

A very good example will be the recent change to Apache. The
configuration files moved. A lot of people who blindly upgraded due to
either seeing but not reading, or cron jobs had their system borked.
To make things worse, they started whining, in the forums, on the ML,
and probably other places.

When maintaining a system, it is good to know what each upgrade does,
and take necessary precautions. The devs can have the ebuild to print
out warning messages, but will your cron be able to catch it?

To elabrate even more:
Redhat, suse and possibly other distro users can do cron upgrades, as
those distros never give out in-compatible upgrades to a release.
Those upgrades will wait until the next release, where everything is
upgraded, and the users will need to re-install the whole system and
possible pay more for the next release.

Things are done differently here in Gentoo, everything is dynamic, a
carefully carried out upgrade can bring a 1.4 to current, which is
amazing I have to say. Because of this, it is inevitable that some
upgrades will not be compatible. Whilst the devs made every effort to
keep you warned/informed, it is *your* responsibility to carry out the
upgrades properly. And a cron job simply isn't the proper way.

Hope I made the reason clear enough.

Finally, please don't get offended. We were not meant to do that. Try
dig out your sense of humour, :P

-- Joe

--
There are 3 kinds of people in the world:
Those who can count, and those who can't.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Holly Bostick]

Jarry schreef:
> Holly Bostick wrote:
> 
>> Qian Qiao schreef:
>> 
>>> On 11/6/05, Jarry <jarry@gmx.net> wrote:
>>> 
>>> 
>>>> All I do is running this set of commands every night from 
>>>> crontab: emerge --sync emerge --update --deep --newuse world
>>>> emerge --depclean revdep-rebuild
>>> 
>>> Omg, you have emerge --deep --newuse --update world as a *cron*
>>> job?
>> 
>> .... and just when you thought it couldn't get any worse, comes a 
>> depclean .... every night.
>> 
>> Ciaran said it best:
>> 
>>> I really hope you don't want your system to carry on working...
> 
> 
> http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=2&chap=1#doc_chap3
>  ======================== <copy&paste>===================== Updating
> your System To keep your system in perfect shape (and not to mention
> install the latest security updates) you need to update your system
> regularly. Since Portage only checks the ebuilds in your Portage tree
> you first have to update your Portage tree.
> 
> Code Listing 2: Updating the Portage tree # emerge --sync
> 
> When your Portage tree is updated, you can update your system with 
> emerge --update world ... Code Listing 16: Removing orphaned
> dependencies # emerge --update --deep --newuse world # emerge
> --depclean # revdep-rebuild 
> ============================================================
> 
> Could some of you, gentoo-wizards, be kind enough and explain, what 
> is wrong in doing the things the way gentoo handbook recommends it?

The Gentoo Handbook does *not* recommend you do these procedures
*unattended*, the way you are doing them.

And a depclean-- which should 1) always be run with --pretend first, and
2) should be checked for sanity before running without --pretend,
certainly should not be run both unattended and unchecked, every night.

I suppose you've never seen this message:


emerge -p depclean

*** WARNING *** : DEPCLEAN CAN  SERIOUSLY  IMPAIR YOUR SYSTEM. USE CAUTION.
*** WARNING *** : (Cancel: CONTROL-C) -- ALWAYS VERIFY ALL PACKAGES IN THE
*** WARNING *** : CANDIDATE LIST FOR  SANITY  BEFORE  ALLOWING DEPCLEAN TO
*** WARNING *** : UNMERGE ANY PACKAGES.
*** WARNING *** :
*** WARNING *** : USE FLAGS MAY HAVE AN EXTREME EFFECT ON THE OUTPUT.
*** WARNING *** : SOME LIBRARIES MAY BE USED BY PACKAGES BUT ARE NOT
*** WARNING *** : CONSIDERED TO BE A DEPEND DUE TO USE FLAG SETTINGS.
*** WARNING *** : emerge --update --deep --newuse world TO VERIFY
*** WARNING *** : SANITY IN THIS REGARD.
*** WARNING *** :
*** WARNING *** : Packages  in the list  that are  desired  may be added
*** WARNING *** : directly to the world file to cause them to be ignored
*** WARNING *** : by depclean and maintained in the future. BREAKAGES DUE
*** WARNING *** : TO UNMERGING AN  ==IN-USE LIBRARY==  MAY BE REPAIRED BY
*** WARNING *** : MERGING  *** THE PACKAGE THAT COMPLAINS ***  ABOUT THE
*** WARNING *** : MISSING LIBRARY.


emerge -uDN world... well, it's not so much that anything is "wrong"
with doing that every night, but ... unattended? So you have no idea
what USE flags you're using, what versions of anything you're using, and
when something else breaks (because you updated a dependency but the
program that depends on it isn't able to use the update as yet, which
happens a lot)-- you have no idea what broke the program, or why.

If you have an nVidia card, but the new drivers don't support your
particular card, and you just upgrade blindly, how are you going to know
why X doesn't work all of a sudden?

If you suddenly wake up to find that you have no disk space, because you
have installed Evolution and Evolution Data Server (which you don't use,
but there is a new USE flag for many GNOME programs-- eds-- that will
install those applications unless you turn the flag off)-- who do you
have to blame but yourself? And how are you going to determine what is
suddenly eating your disk space and prevent it from happening again?

With great power comes great responsibility, and Gentoo gives you a lot
of power to configure and manage your system. However, you are
responsible for paying attention to what is happening and keeping
everything under control.

Which you are not doing, and frankly, you're pretty lucky that something
hasn't blown up up to now.

Holly
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jarry]

b.n. wrote:
> Jarry wrote:
>> b.n. wrote:
>>> Jarry is quite arrogant...
>>
>> Could you please be more specific? Who did I insulted, or what
>> makes you think I am arrogant? Copy&paste please, if you find
>> something...
> 
> Just read the three lines quoted above and you'll find what I mean.

Yes, I have read it. Two question and one request. Polite and
respectful. Does that make me arrogant? Well, I knew my english is
far from being perfect, bud did not know it is actually THAT bad...

BTW, I think it could not be reason for you calling me arrogant,
because I posted it AFTER your statement...

> m.

Strange, when someone who signs his emails with just one character
wants to give me lessons about being arrogant...

Jarry

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[kashani]

Qian Qiao wrote:
> To elabrate even more:
> Redhat, suse and possibly other distro users can do cron upgrades, as
> those distros never give out in-compatible upgrades to a release.

heh, if only this were truly the case. However the sentiment is still 
correct, my beef being with the word *never*.

kashani
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[b.n.]

> http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=2&chap=1#doc_chap3
> ======================== <copy&paste>=====================
> Updating your System
> To keep your system in perfect shape (and not to mention install the
> latest security updates) you need to update your system regularly. Since
> Portage only checks the ebuilds in your Portage tree you first have to
> update your Portage tree.
> 
> Code Listing 2: Updating the Portage tree
> # emerge --sync
> 
>  When your Portage tree is updated, you can update your system with
> emerge --update world
> ...
> Code Listing 16: Removing orphaned dependencies
> # emerge --update --deep --newuse world
> # emerge --depclean
> # revdep-rebuild
> ============================================================
> 
> Could some of you, gentoo-wizards, be kind enough and explain, what
> is wrong in doing the things the way gentoo handbook recommends it?
> Without offensive language, if I may ask...

Jarry is quite arrogant (why in the hell should we people use offensive 
language with you, unless you give us occasion to do it? and, hey, a bit 
of self-irony should help), but I was wondering too why all this fuss 
about updating regularly the system.
I update by hand and I always see what's going on with the help of 
--pretend, to see if there's some nasty issue. But I --deep --update my 
desktop about twice a week and nothing bad is happening here.

m.
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jarry]

Holly Bostick wrote:

> The Gentoo Handbook does *not* recommend you do these procedures
> *unattended*, the way you are doing them.

Well, gentoo says "...update your system regularly...". I thought
it means really regularly, not "when root finds some spare time
to do it". And things, which must be done on my server regularly,
I usually put into crontab...

> when something else breaks (because you updated a dependency but the

Personally, I prefer rather breaking some dependencies in my system,
over leaving some security hole in it. I am fully aware of the
possibility that some services might be unavailable, but logsentry
and monit will inform me about it...

> If you suddenly wake up to find that you have no disk space

Again, logsentry&quota would inform me, I think. And 2x160GB is plenty
of space. BTW, no X/KDE/Gnome on my server...

> Which you are not doing, and frankly, you're pretty lucky that something
> hasn't blown up up to now.

That might happen, sooner o later. But still I think it is still better
than leaving some hole for uninvited visitors.
Thanks for your constructive explanation.

Jarry

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[b.n.]

Jarry wrote:
> b.n. wrote:
> 
> 
>>Jarry is quite arrogant...
> 
> 
> Could you please be more specific? Who did I insulted, or what
> makes you think I am arrogant? Copy&paste please, if you find
> something...

Just read the three lines quoted above and you'll find what I mean.

m.
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Qian Qiao]

On 11/7/05, Jarry <jarry@gmx.net> wrote:
> That might happen, sooner o later. But still I think it is still better
> than leaving some hole for uninvited visitors.

You'd rather having a b0rked system, than some uninvited visitors... Hmmm.

One piece of advice: turn that system off.

-- Joe

--
There are 3 kinds of people in the world:
Those who can count, and those who can't.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[kashani]

Jarry wrote:
> Could some of you, gentoo-wizards, be kind enough and explain, what
> is wrong in doing the things the way gentoo handbook recommends it?
> Without offensive language, if I may ask...

	Being a server guy I'll throw this one out as it hasn't happened yet, 
though I expect a fair amount of chaos when it hits.

When Postfix 2.2 goes live anyone doing virtual mail serving with a 
database backend will break because the sql syntax is different (and 
more powerful) in 2.2 than 2.0/2.1. Unless of course you change your 
configs to match.

	If you're looking for an older example some combination of updates from 
Postfix 2.0.x to 2.1.x would cause queue corruption. The recommended way 
to update was to shut Postfix down while emerging.

kashani
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Nick Rout]

On Mon, 07 Nov 2005 20:49:40 +0100
Jarry wrote:

> b.n. wrote:
> > Jarry wrote:
> >> b.n. wrote:
> >>> Jarry is quite arrogant...
> >>
> >> Could you please be more specific? Who did I insulted, or what
> >> makes you think I am arrogant? Copy&paste please, if you find
> >> something...
> > 
> > Just read the three lines quoted above and you'll find what I mean.
> 
> Yes, I have read it. Two question and one request. Polite and
> respectful. Does that make me arrogant? Well, I knew my english is
> far from being perfect, bud did not know it is actually THAT bad...
> 
> BTW, I think it could not be reason for you calling me arrogant,
> because I posted it AFTER your statement...
> 
> > m.
> 
> Strange, when someone who signs his emails with just one character
> wants to give me lessons about being arrogant...
> 
> Jarry

Frankly back off or bugger off.

-- 
Nick Rout <nick@rout.co.nz>

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Qian Qiao]

On 11/7/05, Jarry <jarry@gmx.net> wrote:
> Personally, I prefer rather breaking some dependencies in my system,
> over leaving some security hole in it. I am fully aware of the
> possibility that some services might be unavailable, but logsentry
> and monit will inform me about it...

If your server a production server?

Tell me how log entries are gonna inform you if the init scripts can't
even start the service?

Maintain servers includes maintaining *usability* as well as security.
Some of the updates aren't security updates, they are merely feature
additions, might in fact introduce more security issues.

Furthermore, if you can't even maintain usability of the system, I
don't see how or why you need to keep it secure, that system won't
work anyways.

Let me just give you one more example:
A upgrade to the PAM library might require you to restart sshd,
otherwise new connections may not auth. That information will be
printed on the screen after the new PAM library is merged. However
that will not appear in the emerge.log. Tell me, how you are gonna
know that you should restart your sshd if that upgrade was carried out
by a cron job. To make things worse, just imagine, that system is a
remote system, and is maintained through ssh. Pfff.

Anyway, good luck with being an admin.

-- Joe

--
There are 3 kinds of people in the world:
Those who can count, and those who can't.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jarry]

b.n. wrote:

>> Polite and respectful. 
> They don't look that much.

Well, I always thought that using the words like "please" is a sign
of respect to others. On the other side, some of replies included
phrases like "...it bloody matters!..." or "how the hell would we
know...!" or "Jarry needs variable BRAVE_YET_DUMB=1". Although
such words do not sound good to me, I would never dare to say their
authors are arrogant...

> have told/added something like "anyway please sorry if I looked
> arrogant, I didn't meant to". Then we could have agreed.

Not problem for me, just did not find any reason to do it...
But what about those who do not look arrogant, but are arrogant?

> For example (you wanted examples, so I give you):
> ">which version of portage you are running!
> Do you really think it is important? Because since I'm using Gentoo,
> I do not take care about versions, portage does it instead of me."

I asked the question seriously. When I switched to gentoo, everybody
told me "...c'mon, come'n'try gentoo, there are no versions like in
redhat, suse or debian, it is always updated!...". Suddenly there are
versions...

(BTW, I wrote I was impressed by portage speed last week, during
 upgrade. It means I could not have old portage version)

> Taking a simple joke this seriously doesn't make you look superior. In
> fact you look much more childish than the original poster. If you were
> really a superior intelligence, you would have at least asked yourself
> *why* so much people were laughing at your post.

Aha, now I understand! I should have probably answer:
AND_YOU_ARE_EVEN_BIGGER_FOOL_LOL=1
That would have been probably even better simple joke, huh? :-)
<now THIS is sarcasm from me, I would never write something like that>

> You copy-and-paste the manual (implicitly stating we're all
> morons that have never read it)

I copy&pasted it to let you know where I got that idea...

>> Strange, when someone who signs his emails with just one character
>> wants to give me lessons about being arrogant...
> ?
> And that's two characters, BTW (a letter and a dot :P )
> m.

OK, that's "cool", I will use it from now! :-)
J.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jarry]

Qian Qiao wrote:

> Tell me how log entries are gonna inform you if the init scripts can't
> even start the service?

I'm not sure, probably in ~30min I would get email, if completely
broken server would not make it impossible. I thought either monit
or logsentry would notice it and inform me...

> Let me just give you one more example:
> A upgrade to the PAM library might require you to restart sshd,

Well, this will be probably criticised, but after every upgrade
(independently of what was really updated) I restart sshd, named,
sendmail and apache, even with old config-files. I thought that way
not only my system is updated, but also new versions of those
daemons are running. Rest (I thought) is not important...

> Anyway, good luck with being an admin.

I know, I'm far from being it. But thanks for answer...

Jarry

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Holly Bostick]

Jarry schreef:
> Holly Bostick wrote:
> 
> 
>> The Gentoo Handbook does *not* recommend you do these procedures 
>> *unattended*, the way you are doing them.
> 
> 
> Well, gentoo says "...update your system regularly...". I thought it 
> means really regularly, not "when root finds some spare time to do 
> it". And things, which must be done on my server regularly, I usually
>  put into crontab...

Hmmm, interesting concept. What else does root have to do but administer
the server?

Why exactly does root, whose job is to run the server, have no time to
schedule the actual running of the server, which includes:

checking whether updates are available;

checking whether updates are *appropriate*;

making sure that available, appropriate updates don't interrupt the
running of the server for which root is responsible?

If it was a desktop system, I could understand. I hate to take time out
from a good run of AisleRiot to do a glsa-check, myself (and why isn't
*that* one of your cron jobs?).

But a server is something else entirely.

> 
> 
>> when something else breaks (because you updated a dependency but 
>> the
> 
> 
> Personally, I prefer rather breaking some dependencies in my system,
>  over leaving some security hole in it. I am fully aware of the 
> possibility that some services might be unavailable, but logsentry 
> and monit will inform me about it...

You would rather have your server not work than have a security hole in it.

What difference does it make if there's a security hole if the server
itself doesn't work?

Not that I'm advocating security holes, but this just doesn't make sense
(the security hole in X package can't be exploited if the program
segfaults when you try to start it because its dependencies are broken).

> 
> 
>> If you suddenly wake up to find that you have no disk space
> 
> 
> Again, logsentry&quota would inform me, I think. And 2x160GB is 
> plenty of space. BTW, no X/KDE/Gnome on my server...

So you have time to fix the errors, but not time to prevent them before
they occur?

And of course, somehow you are going to be able to fix the errors
without taking the server down, without any interruption to your users?

I don't get it, but more power to you.

> 
> 
>> Which you are not doing, and frankly, you're pretty lucky that 
>> something hasn't blown up up to now.
> 
> 
> That might happen, sooner o later. But still I think it is still 
> better than leaving some hole for uninvited visitors.

The invited vistors (ordinary users of the server) are on their own,
apparently.

Holly
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Qian Qiao]

On 11/7/05, Jarry <jarry@gmx.net> wrote:
> b.n. wrote:
>
> >> Polite and respectful.
> > They don't look that much.
>
> Well, I always thought that using the words like "please" is a sign
> of respect to others. On the other side, some of replies included
> phrases like "...it bloody matters!..." or "how the hell would we
> know...!" or "Jarry needs variable BRAVE_YET_DUMB=1". Although
> such words do not sound good to me, I would never dare to say their
> authors are arrogant...

You are just brave and dumb. Take a look at how many people explained
or attempted to explain why running upgrades as cron jobs is a dumb
thing do to, and you simply neglected them. To make things worse, you
stated: "I prefer rather breaking some dependencies in my system, over
leaving some security hole in it". Which is plain bs.

> I asked the question seriously. When I switched to gentoo, everybody
> told me "...c'mon, come'n'try gentoo, there are no versions like in
> redhat, suse or debian, it is always updated!...". Suddenly there are
> versions...
>
> (BTW, I wrote I was impressed by portage speed last week, during
>  upgrade. It means I could not have old portage version)

As well as brave and dumb, you are also ignorant. There are versions,
and it is clearly mentioned in the documentations. It's always
up-to-date doesn't mean there are no versions. There are no
*releases*, but there are versions.

Back to the arrogance bit, people give you advices or suggestions, in
the hope that you could maintain your system better, you are perfectly
entitled to stick to your no-so-bright way, but you can't stop us
thinking that defending those *wrong* ways are somewhat arrogant.

Again, good luck with your server maintenance.

-- Joe

--
There are 3 kinds of people in the world:
Those who can count, and those who can't.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[b.n.]

>>Just read the three lines quoted above and you'll find what I mean.
> 
> 
> Yes, I have read it. Two question and one request. 

True.

> Polite and
> respectful. 

They don't look that much.
Arrogance is not about insulting. It is something much more subtle, but 
not less evident.

> Does that make me arrogant? Well, I knew my english is
> far from being perfect, bud did not know it is actually THAT bad...

Your english is OK, AFAIK (I'm not a native english speaker too, so I 
can't be 100% sure). It's the *tone* you use that's not good.

> BTW, I think it could not be reason for you calling me arrogant,
> because I posted it AFTER your statement...

Oh, this was just such a shiny bright and unwillingly ironic example 
that I couldn't resist.

See, the simple fact you're biting this little flamebait so much means 
you're an arrogant at my eyes. If you were not so permalous, you would 
have told/added something like "anyway please sorry if I looked 
arrogant, I didn't meant to". Then we could have agreed.

Fact is, you're asking questions here and people is going to help you, 
and you act like you're always right and other people are idiots.

For example (you wanted examples, so I give you):
">which version of portage you are running!

Do you really think it is important? Because since I'm using Gentoo,
I do not take care about versions, portage does it instead of me."

Here you seem to imply that the original poster, by caring about Portage 
versions, is a hopeless dumb, while you're a loooot smarter. Note: you 
*SEEM* to imply. You can scream here and there you weren't meaning it. 
But that's what I read through your words.

"Satisfied? Carry on, if it makes you feel better...
Anyway, I'll not fight back to this primitive insultation. It is
under my level, and imho under level of this mailing list too..."

Taking a simple joke this seriously doesn't make you look superior. In 
fact you look much more childish than the original poster. If you were 
really a superior intelligence, you would have at least asked yourself 
*why* so much people were laughing at your post.

"Could some of you, gentoo-wizards, be kind enough and explain, what
is wrong in doing the things the way gentoo handbook recommends it?
Without offensive language, if I may ask..."

Same as above. You don't ask yourself what can be wrong in your 
assumptions. You copy-and-paste the manual (implicitly stating we're all 
morons that have never read it) and you seem to dare us to explain how 
can we dare laugh at this autority. Moreover, you imply you're 
*absolutely certain* to do what the Gentoo handbook is recommending, 
when you have been answered you overlooked a VERY basic detail, and 
that's all the fuss was about.

Summing up, you don't give us the fuzzy warm feeling of a user that 
sincerely and gently wants help. You seem to feel always the need to 
defend yourself and you seem to lack any sense of humour about yourself. 
That's all.

>>m.
> 
> 
> Strange, when someone who signs his emails with just one character
> wants to give me lessons about being arrogant...

?
And that's two characters, BTW (a letter and a dot :P )

m.
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jeff Smelser]

[-- Attachment #1: Type: text/plain, Size: 486 bytes --]

On Monday 07 November 2005 02:04 pm, Jarry wrote:
> > Which you are not doing, and frankly, you're pretty lucky that something
> > hasn't blown up up to now.
>
> That might happen, sooner o later. But still I think it is still better
> than leaving some hole for uninvited visitors.
> Thanks for your constructive explanation.

Yeah, but your not restarting anything anyway, so your point is moot.. The 
service is still running with a big fat hole in it regardless..

Jeff

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] portage: fixed or not???

[Jarry]

Holly Bostick wrote:

> Hmmm, interesting concept. What else does root have to do but administer
> the server?

Well, in this case it is not some serious server, just for fun&play.
And sometimes I really do not have time to take care of it for a couple
of days, week or two. I have a different job...

> What difference does it make if there's a security hole if the server
> itself doesn't work?

Let us say, if server is down, it can not be misused for further
attacks, spam-sending, ddos, etc. That could easily happen, if someone
gained root-access (I think)...

> So you have time to fix the errors, but not time to prevent them before
> they occur?

As I said previously: fixing errors later is my problem. But if I do
not close some security leak, it would be then problem for me and maybe
someone else too. There are too many unpatched and vulnerable computers
on the net, I did not want to cotribute to it...

But there is definitely something in what you are saying. Maybe I will
think over it again...

Jarry

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Mark]

OK, can y'all just drop it? Filling my inbox with bickering is not why
I subscribe to such a fine technical list


On 11/7/05, Qian Qiao <qian.qiao@gmail.com> wrote:
> On 11/7/05, Jarry <jarry@gmx.net> wrote:
> > b.n. wrote:
> >
> > >> Polite and respectful.
> > > They don't look that much.
> >
> > Well, I always thought that using the words like "please" is a sign
> > of respect to others. On the other side, some of replies included
> > phrases like "...it bloody matters!..." or "how the hell would we
> > know...!" or "Jarry needs variable BRAVE_YET_DUMB=1". Although
> > such words do not sound good to me, I would never dare to say their
> > authors are arrogant...
>
> You are just brave and dumb. Take a look at how many people explained
> or attempted to explain why running upgrades as cron jobs is a dumb
> thing do to, and you simply neglected them. To make things worse, you
> stated: "I prefer rather breaking some dependencies in my system, over
> leaving some security hole in it". Which is plain bs.
>
> > I asked the question seriously. When I switched to gentoo, everybody
> > told me "...c'mon, come'n'try gentoo, there are no versions like in
> > redhat, suse or debian, it is always updated!...". Suddenly there are
> > versions...
> >
> > (BTW, I wrote I was impressed by portage speed last week, during
> >  upgrade. It means I could not have old portage version)
>
> As well as brave and dumb, you are also ignorant. There are versions,
> and it is clearly mentioned in the documentations. It's always
> up-to-date doesn't mean there are no versions. There are no
> *releases*, but there are versions.
>
> Back to the arrogance bit, people give you advices or suggestions, in
> the hope that you could maintain your system better, you are perfectly
> entitled to stick to your no-so-bright way, but you can't stop us
> thinking that defending those *wrong* ways are somewhat arrogant.
>
> Again, good luck with your server maintenance.
>
> -- Joe
>
> --
> There are 3 kinds of people in the world:
> Those who can count, and those who can't.
>
> --
> gentoo-user@gentoo.org mailing list
>
>


--
Mark
[unwieldy legal disclaimer would go here - feel free to type your own]

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[A. Khattri]

On Mon, 7 Nov 2005, John Jolet wrote:

> At the risk of of adding to the flames here, perhaps an example is in
> order.... I once worked as a sysadmin for a guy who firmly believed in
> security.  To prevent any security holes from lingering, he did an apt-get
> update out of cron every friday night....on production servers (we were
> running debian).  The instance of us having to spend monday fixing what broke
> friday was about 10%.  Unacceptable on a server.  I don't even do that on my
> test systems.

I can understand the paranoia of having your servers hacked but there is
usually a middle ground that works reasonably well. I run a script nightly
via cron but all it does is do a portage sync and then *prebuild* binary
packages for any important updates before sending an email in them
morning. I have to apply the updates manually but this gives you a chance
to test and/or rollback if need be. The only downside is that manual
intervention is required - can't have everything I suppose.


-- 

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Qian Qiao]

On 11/7/05, Jarry <jarry@gmx.net> wrote:
<trim>
doh, everything is trimmed. :D
</trim>

Let's leave the brave, dumb, ignorance, arrogance out, and concentrate
on maintaining a server, especially production servers with clients.

First of all, I should point out that maintaining a server is far more
than just keeping everything up to date, it is more about providing
all of the clients consistent and stable services.

To provide such services of such quality, down times should be kept
minimal. Thus, b0rked system with no security holes mean no value to
clients as they need a working system.

Also, major changes should be kept minimal, some software make major
configuration file changes once in a while, and that should be
avoided. Having your clients to change their file/code to match your
setting will leave you with unhappy clients who may just leave.

System restarts, hmmm, a few times in a year is probably a lot. Some
software restarts should also be avoided. For example, a webserver
restart will cause all http clients to lose their session, and all the
data stored in the session. There may well be important data in the
session, thus doing so is just irresponsible.

So now the ultimate question: when should updates by applied to the
system, and what shall be applied.
1. Security fixes. Gentoo provides emerge --security, which prints out
security advices based on the packages installed on your system. You
should keep an eye on that, rather than upgrading everything.
2. Popular feature request. If most of you clients request MySQL 4.1
while you are running 4.0, you should probably upgrade.
3. Bug fixes. For example, a few clients run into a well known bug in
PHP3, you should probably take the opportunity to upgrade it to PHP4.

As to how there upgrades shall be applied:
1. Upgrades that are transparent can be applied immediately.
Transparent means no configuration change, no service interruption
expected.
2. Inform everyone about the upgrades that will cause down time, and
give them an estimated time of when these upgrades are applied, and
roughly how long the down time is expected.
3. Schedule maintenance slots.

You clients should always know what to expect from you.

With all the above considerations in mind, I'm pretty sure that a cron
job for the updates is a brave yet not-so-bright move, and should be
avoided.

BTW, the above short guild is in no way official or complete, it is
just my personal experience. There maybe other people who wants to
amend, or there may well be special considerations from your side.

-- Joe

--
There are 3 kinds of people in the world:
Those who can count, and those who can't.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Qian Qiao]

On 11/7/05, Qian Qiao <qian.qiao@gmail.com> wrote:

Oh, I left out an important note: major upgrades, feature upgrades
should always be tested on a test server before applying to
production.

-- Joe

--
There are 3 kinds of people in the world:
Those who can count, and those who can't.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Holly Bostick]

Jeff Smelser schreef:
> On Monday 07 November 2005 02:04 pm, Jarry wrote:
> 
>>> Which you are not doing, and frankly, you're pretty lucky that 
>>> something hasn't blown up up to now.
>> 
>> That might happen, sooner o later. But still I think it is still 
>> better than leaving some hole for uninvited visitors. Thanks for 
>> your constructive explanation.
> 
> 
> Yeah, but your not restarting anything anyway, so your point is 
> moot.. The service is still running with a big fat hole in it 
> regardless..

No, no, Jeff, that is apparently where you are wrong:

Jarry schreef:

> Well, this will be probably criticised, but after every upgrade 
> (independently of what was really updated) I restart sshd, named, 
> sendmail and apache, even with old config-files. I thought that way 
> not only my system is updated, but also new versions of those daemons
>  are running. Rest (I thought) is not important...

So you see, the mail server, ssh server and web server *are* restarted.

Whether or not they were the services actually updated (or needing
update), and without regard to
whether the change required an updated *configuration* file, which--
since etc-update was not run-- did not take place. But we all know that
fixing a security hole never has any relationship to the application's
config files, ever. Don't we? And of course restarting those four
servers, even with old config files, constitutes a full and complete
update, patching all relevant security holes covered by the emerge -uDN
world. *Ob*viously. Because *ob*viously, emerge -uDNworld updates to the
version of whatever containing the patch for the hole. No matter what
your ACCEPT_KEYWORDS is set to, no matter what USE flags are enabled.

I mean, *really*, Jeff. What *are* you thinking? Why on earth should we
need to pay attention to any of that stuff? Don't you know Gentoo
manages your server(s) for you? (Wonder why it takes two days to a week
to install, if it does all this automatic management so well?!)

I hope you see how mistaken you are and are duly chastened.

Holly
;-)
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jarry]

b.n. wrote:

>> phrases like "...it bloody matters!..." or "how the hell would we
>> know...!" or "Jarry needs variable BRAVE_YET_DUMB=1". Although
>> such words do not sound good to me, I would never dare to say their
>> authors are arrogant...
> 
> These people are treating you with confidence. They're kidding with you
> because they assume you're understanding we're just kidding and we're
> all respectful of each other, at a deeper level. They assume you have a
> life and you don't have to feel hurt by every little single humour is
> done at you.

Believe me, or not, but I really did not know this was kidding (and it
is the most surprising info I got today). Respect to you all, but in my
country and culture we do not call something like that "kidding"...

Thanks for all replies, subject closed!

Jarry

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[kashani]

Jarry wrote:
> As I said previously: fixing errors later is my problem. But if I do
> not close some security leak, it would be then problem for me and maybe
> someone else too. There are too many unpatched and vulnerable computers
> on the net, I did not want to cotribute to it...
> 
> But there is definitely something in what you are saying. Maybe I will
> think over it again...

	Your assumption works if your only line of defense is the software 
itself. This is why your smart security book recommends a layered 
defense such as a firewall, system acls or capabilities, dropping 
privileges, chrooting services, configurations done with security in 
mind, selinux, stack protection, etc. Ideally you'd be able to schedule 
an update in the window of your choosing because your other defenses are 
in place protecting you until you can update your software in a 
controlled sensible way without downtime. It's not always the case, but 
the odds are much more in your favor in this scenerio.

kashani
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Jeff Smelser]

[-- Attachment #1: Type: text/plain, Size: 1886 bytes --]

On Monday 07 November 2005 03:52 pm, Holly Bostick wrote:
> No, no, Jeff, that is apparently where you are wrong:

Heh, I missed this tidbit..

> Jarry schreef:
> > Well, this will be probably criticised, but after every upgrade
> > (independently of what was really updated) I restart sshd, named,
> > sendmail and apache, even with old config-files. I thought that way
> > not only my system is updated, but also new versions of those daemons
> >  are running. Rest (I thought) is not important...
>
> So you see, the mail server, ssh server and web server *are* restarted.
>
> Whether or not they were the services actually updated (or needing
> update), and without regard to
> whether the change required an updated *configuration* file, which--
> since etc-update was not run-- did not take place. But we all know that
> fixing a security hole never has any relationship to the application's
> config files, ever. Don't we? And of course restarting those four
> servers, even with old config files, constitutes a full and complet
> update, patching all relevant security holes covered by the emerge -uDN
> world. *Ob*viously. Because *ob*viously, emerge -uDNworld updates to the
> version of whatever containing the patch for the hole. No matter what
> your ACCEPT_KEYWORDS is set to, no matter what USE flags are enabled.
>
> I mean, *really*, Jeff. What *are* you thinking? Why on earth should we
> need to pay attention to any of that stuff? Don't you know Gentoo
> manages your server(s) for you? (Wonder why it takes two days to a week
> to install, if it does all this automatic management so well?!)

Heh, well, I stand corrected. I am sure we should all be doing this, because 
its obviously the right thing to do..

Well, i have been bitten on upgrades I was watching, he will be bit 
eventually, then he will come crying here.

Jff

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] portage: fixed or not???

[Jeff Smelser]

[-- Attachment #1: Type: text/plain, Size: 747 bytes --]

On Monday 07 November 2005 03:38 pm, Jarry wrote:

> As I said previously: fixing errors later is my problem. But if I do
> not close some security leak, it would be then problem for me and maybe
> someone else too. There are too many unpatched and vulnerable computers
> on the net, I did not want to cotribute to it...
>
> But there is definitely something in what you are saying. Maybe I will
> think over it again...

I am curious, what program recently has been biting you that your so worried 
about remote attackers? 

Besides that, if you have your firewall and so forth set right, this should 
keep the problem pretty limited.. Considering its a play machine, what would 
you really need open to the entire world?

Jeff

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] portage: fixed or not???

[Qian Qiao]

On 11/7/05, A. Khattri <ajai@bway.net> wrote:
> I can understand the paranoia of having your servers hacked but there is
> usually a middle ground that works reasonably well. I run a script nightly
> via cron but all it does is do a portage sync and then *prebuild* binary
> packages for any important updates before sending an email in them
> morning. I have to apply the updates manually but this gives you a chance
> to test and/or rollback if need be. The only downside is that manual
> intervention is required - can't have everything I suppose.

Unless we have a tool with enough intelligence to read the message
spit out by the ebuild during the upgrade, and handle them correctly,
I'd guess system administration is still a manual job.

I do have cron jobs, but what they do are: emerge --sync, emerge
--security. and do monthly/nightly backup.

For software upgrades, I do them by hand, and most of the time,
one-by-one. Just to ensure everything is working as intended.

Hmmm, working as intended, no one here play WoW on EU realms right, :P

-- Joe

--
There are 3 kinds of people in the world:
Those who can count, and those who can't.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[John Jolet]

On Monday 07 November 2005 15:22, Qian Qiao wrote:
> On 11/7/05, Jarry <jarry@gmx.net> wrote:
> > b.n. wrote:
> > >> Polite and respectful.
> > >
> > > They don't look that much.
> >
> > Well, I always thought that using the words like "please" is a sign
> > of respect to others. On the other side, some of replies included
> > phrases like "...it bloody matters!..." or "how the hell would we
> > know...!" or "Jarry needs variable BRAVE_YET_DUMB=1". Although
> > such words do not sound good to me, I would never dare to say their
> > authors are arrogant...
>
> You are just brave and dumb. Take a look at how many people explained
> or attempted to explain why running upgrades as cron jobs is a dumb
> thing do to, and you simply neglected them. To make things worse, you
> stated: "I prefer rather breaking some dependencies in my system, over
> leaving some security hole in it". Which is plain bs.
At the risk of of adding to the flames here, perhaps an example is in 
order.... I once worked as a sysadmin for a guy who firmly believed in 
security.  To prevent any security holes from lingering, he did an apt-get 
update out of cron every friday night....on production servers (we were 
running debian).  The instance of us having to spend monday fixing what broke 
friday was about 10%.  Unacceptable on a server.  I don't even do that on my 
test systems.
>
> > I asked the question seriously. When I switched to gentoo, everybody
> > told me "...c'mon, come'n'try gentoo, there are no versions like in
> > redhat, suse or debian, it is always updated!...". Suddenly there are
> > versions...
> >
> > (BTW, I wrote I was impressed by portage speed last week, during
> >  upgrade. It means I could not have old portage version)
>
> As well as brave and dumb, you are also ignorant. There are versions,
> and it is clearly mentioned in the documentations. It's always
> up-to-date doesn't mean there are no versions. There are no
> *releases*, but there are versions.
>
> Back to the arrogance bit, people give you advices or suggestions, in
> the hope that you could maintain your system better, you are perfectly
> entitled to stick to your no-so-bright way, but you can't stop us
> thinking that defending those *wrong* ways are somewhat arrogant.
>
> Again, good luck with your server maintenance.
>
> -- Joe
>
> --
> There are 3 kinds of people in the world:
> Those who can count, and those who can't.

-- 
John Jolet
Your On-Demand IT Department
512-762-0729
www.jolet.net
john@jolet.net
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[b.n.]

>>>Polite and respectful. 
>>
>>They don't look that much.
> 
> 
> Well, I always thought that using the words like "please" is a sign
> of respect to others. 

Sometimes it looks more like sarcasm.
Yours is a bit "autistic" way to deal with human language. It is not 
like using "please" in a sentence means an automatic grep turns on a 
RESPECTFUL_LANGUAGE=1 flag in response.

> On the other side, some of replies included
> phrases like "...it bloody matters!..." or "how the hell would we
> know...!" or "Jarry needs variable BRAVE_YET_DUMB=1". Although
> such words do not sound good to me, I would never dare to say their
> authors are arrogant...

These people are treating you with confidence. They're kidding with you 
because they assume you're understanding we're just kidding and we're 
all respectful of each other, at a deeper level. They assume you have a 
life and you don't have to feel hurt by every little single humour is 
done at you.

>>">which version of portage you are running!
>>Do you really think it is important? Because since I'm using Gentoo,
>>I do not take care about versions, portage does it instead of me."
> 
> 
> I asked the question seriously. When I switched to gentoo, everybody
> told me "...c'mon, come'n'try gentoo, there are no versions like in
> redhat, suse or debian, it is always updated!...". Suddenly there are
> versions...

Ehm... They were asking about a Portage version, not a Gentoo version. 
It's TRUE you don't have to deal with your distro versions more (that's 
the thing I love more about Gentoo), but your packages still have 
version numbers...

>>Taking a simple joke this seriously doesn't make you look superior. In
>>fact you look much more childish than the original poster. If you were
>>really a superior intelligence, you would have at least asked yourself
>>*why* so much people were laughing at your post.
> 
> 
> Aha, now I understand! I should have probably answer:
> AND_YOU_ARE_EVEN_BIGGER_FOOL_LOL=1
> That would have been probably even better simple joke, huh? :-)
> <now THIS is sarcasm from me, I would never write something like that>

Ok, I assume your sense of humour is hopeless :-D

>>You copy-and-paste the manual (implicitly stating we're all
>>morons that have never read it)
> 
> I copy&pasted it to let you know where I got that idea...

Yes, I figured it out. But it's the impression you give that's quite bad.

>>And that's two characters, BTW (a letter and a dot :P )
>>m.
> 
> 
> OK, that's "cool", I will use it from now! :-)

?

I just don't see what's odd or wrong or cool with signing with just my 
name initial... who cares about my name,anyway?

m.
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Billy Holmes]

Holly Bostick wrote:
> world. *Ob*viously. Because *ob*viously, emerge -uDNworld updates to the
> version of whatever containing the patch for the hole. No matter what
> your ACCEPT_KEYWORDS is set to, no matter what USE flags are enabled.

I also wanted to add something: sometimes patches are submitted and they 
don't fix the entire problem. Sometimes, they are just bad patches that 
somehow made it into the release. Humans after all control the versions, 
push the changes, and update keywords. We make mistakes. Computer just 
propogate that mistake at lightening speeds.

So in a production environment, to update immediately is not always the 
best advice. There should always be some $delay between when the patch 
is released, and it's applied to production. $delay being defined by 
your local policies, commitments, and need to CYA.
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[A. Khattri]

On Mon, 7 Nov 2005, Qian Qiao wrote:

> 3. Schedule maintenance slots.

That's the best way to manage updates.


-- 

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] portage: fixed or not???

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 528 bytes --]

On Mon, 07 Nov 2005 14:38:45 -0600, kashani wrote:

> 	If you're looking for an older example some combination of
> updates from Postfix 2.0.x to 2.1.x would cause queue corruption. The
> recommended way to update was to shut Postfix down while emerging.

A recent update to dovecot stopped it completely until you updated the
config file. I suppose you could fix that with a cron job that did

echo "-5" | etc-update

:-)


-- 
Neil Bothwick

No program done by a hacker will work unless he is on the system.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] portage: fixed or not???

[Holly Bostick]

Neil Bothwick schreef:
 >
> A recent update to dovecot stopped it completely until you updated the
> config file. I suppose you could fix that with a cron job that did
> 
> echo "-5" | etc-update
> 
> :-)

My goodness, Neil-- are you aiming to be the next Stephen King?

You certainly have an eye for true horror.....

Holly
-- 
gentoo-user@gentoo.org mailing list