On Sat, Aug 16, 2008 at 11:30:03AM -0400, Paul W. Frields wrote:
The Fedora Infrastructure team continues to work on the issues we discovered earlier this week. Right now, we're getting the account system restored to service, along with some of the application servers. We're also taking advantage of the outages to upgrade a few systems at the same time.
So, is it safe to apply updates?
On Sat, 2008-08-16 at 15:13 -0400, Matthew Miller wrote:
So, is it safe to apply updates?
I wondered that, too. The original posting was too vague. You can't tell if they're just fixing a fault, or sorting out an attack.
Tim wrote:
On Sat, 2008-08-16 at 15:13 -0400, Matthew Miller wrote:
So, is it safe to apply updates?
I wondered that, too. The original posting was too vague. You can't tell if they're just fixing a fault, or sorting out an attack.
Assume the latter and act accordingly.
max wrote:
Tim wrote:
On Sat, 2008-08-16 at 15:13 -0400, Matthew Miller wrote:
So, is it safe to apply updates?
I wondered that, too. The original posting was too vague. You can't tell if they're just fixing a fault, or sorting out an attack.
Assume the latter and act accordingly.
This means that if I updated my systems they could be compromised and I need to re-install? All because the announcement was made in other list!
In any moment was clear to me, and probably others, that you have to another list to get such important announcements.
Marcelo
On Sat, Aug 16, 2008 at 11:09:09PM -0400, max wrote:
I wondered that, too. The original posting was too vague. You can't tell if they're just fixing a fault, or sorting out an attack.
Assume the latter and act accordingly.
Like, how? Quick, switch everything to another distro? We don't know enough to act reasonably.
Marcelo M. Garcia wrote:
This means that if I updated my systems they could be compromised and I need to re-install? All because the announcement was made in other list!
In any moment was clear to me, and probably others, that you have to another list to get such important announcements.
Marcelo
Did you turn off signature checking in yum? If not, then unless Fedora's PGP key was compromised, the RPMs will fail the check, and not be installed. You also have to override yum to install an unsigned package.
Mikkel
On Sun, Aug 17, 2008 at 8:36 AM, Matthew Miller mattdm@mattdm.org wrote:
On Sat, Aug 16, 2008 at 11:09:09PM -0400, max wrote:
I wondered that, too. The original posting was too vague. You can't tell if they're just fixing a fault, or sorting out an attack.
Assume the latter and act accordingly.
Like, how? Quick, switch everything to another distro? We don't know enough to act reasonably.
Like keep your eyes open for anything unusual at the least. Do a little packet sniffing just to see if there is any unusual traffic...I mean take sensible precautions, run chrootkit and rkhunter, run clam, obviously you aren't going to blow away boxes on a whim but it pays to be aware of what transpires on your network. I thought that is what sysadmins were suppossed to do, be aware of what's going on with the network.
-Max
On Mon, Aug 18, 2008 at 1:29 AM, max bianco maximilianbianco@gmail.comwrote:
On Sun, Aug 17, 2008 at 8:36 AM, Matthew Miller mattdm@mattdm.org wrote:
On Sat, Aug 16, 2008 at 11:09:09PM -0400, max wrote:
I wondered that, too. The original posting was too vague. You can't tell if they're just fixing a fault, or sorting out an attack.
Assume the latter and act accordingly.
Like, how? Quick, switch everything to another distro? We don't know
enough
to act reasonably.
Like keep your eyes open for anything unusual at the least. Do a little packet sniffing just to see if there is any unusual traffic...I mean take sensible precautions, run chrootkit and rkhunter, run clam, obviously you aren't going to blow away boxes on a whim but it pays to be aware of what transpires on your network. I thought that is what sysadmins were suppossed to do, be aware of what's going on with the network.
If only all the sysadmins in the world had the time to check on each system and every packet on the network! Try looking for a needle in a haysack?
The least fedora could have done is give some suggestions to users on how to take precautions if this is really a security issue which seems quite obvious now since it's been days and everyone is in the dark
Steve
On Sun, Aug 17, 2008 at 5:42 AM, Marcelo M. Garcia marcelo.maia.garcia@googlemail.com wrote:
max wrote:
Tim wrote:
On Sat, 2008-08-16 at 15:13 -0400, Matthew Miller wrote:
So, is it safe to apply updates?
I wondered that, too. The original posting was too vague. You can't tell if they're just fixing a fault, or sorting out an attack.
Assume the latter and act accordingly.
This means that if I updated my systems they could be compromised and I need to re-install? All because the announcement was made in other list!
In any moment was clear to me, and probably others, that you have to another list to get such important announcements.
Marcelo
In all fairness, I don't think it is too much of an assumption that people would subscribe to the fedora-announce-list for announcements. The fedora-list has always been for troubleshooting.
http://fedoraproject.org/wiki/Communicate#Mailing_Lists
Aside from personally sending you an email, how would you suggest that it be made more clear. Perhaps your suggestion can be implemented.
The least fedora could have done is give some suggestions to users on how to take precautions if this is really a security issue which seems quite obvious now since it's been days and everyone is in the dark
I completly agree. The way of communicating this issue is pretty bad. In fact, nobody really seems to know if it was just a spontanous maintaince work with a strange announce or an possible security breach itself. After some days there is no clue about what actually might be the problem. Of course, nobody might expect that the issue is resolved, however, there should be CLEAR announcements that informs the user about the best way to handle the issue. Else, I need to calculate with the worst case and that is a security breach with compromissed signed keys. No information about the time the problem occurs, so you have to see all fedora system as possible compromised. That's not funny to be left in that situation with an "please don't install updates" and "the wiki will be back soon".
Make clear announcements and tell what you think what might be happened. This will greatly help to avoid spreading rumors and many users might sleep much better at night.
Best regards, Florian
The least fedora could have done is give some suggestions to users on how to take precautions if this is really a security issue which seems quite obvious now since it's been days and everyone is in the dark
I completly agree. The way of communicating this issue is pretty bad. In fact, nobody really seems to know if it was just a spontanous maintaince work with a strange announce or an possible security breach itself. After some days there is no clue about what actually might be the problem. Of course, nobody might expect that the issue is resolved, however, there should be CLEAR announcements that informs the user about the best way to handle the issue. Else, I need to calculate with the worst case and that is a security breach with compromissed signed keys. No information about the time the problem occurs, so you have to see all fedora system as possible compromised. That's not funny to be left in that situation with an "please don't install updates" and "the wiki will be back soon".
Make clear announcements and tell what you think what might be happened. This will greatly help to avoid spreading rumors and many users might sleep much better at night.
Best regards, Florian
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
I agree!
Regards, Roger
On Mon, Aug 18, 2008 at 11:27:22AM +0200, Florian Sievert wrote:
the best way to handle the issue. Else, I need to calculate with the worst case and that is a security breach with compromissed signed keys. No information about the time the problem occurs, so you have to see all fedora system as possible compromised. That's not funny to be left in that situation with an "please don't install updates" and "the wiki will be back soon".
Hi,
The main Fedora developers and Red Hat have a strong background of respectability, so I deposit my trust that if it was such a thing we'd be notified about it.
Calm down, and wait, I'm sure we'll know soon enough.
Rui
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Rui Miguel Silva Seabra wrote:
The main Fedora developers and Red Hat have a strong background of respectability, so I deposit my trust that if it was such a thing we'd be notified about it.
Calm down, and wait, I'm sure we'll know soon enough.
well said.
all of this chatter back and forth is really of no point. people really do need to calm down.
give consideration to a very important fact, there was notification given thru 'fedora-announce-list'.
anyone who is not subscribed to 'fedora-announce-list' have no one other than them selves to blame for not being aware.
fact that something such as this has happened, it would be best that all who are not subscribed to 'fedora-announce-list', should do so.
paul w frields sent notice to 'fedora-announce-list' 8/14/2008 2315hrs utc. dave stevens replied, which went to 'fedora-list' 8/15/2008 2058hrs utc.
from what i see in 'fedora-list', nothing started until 8/16/2008.
this only goes to show that there are a lot on 'fedora-list' that do not pay attention to what is posted on 'fedora-list'.
so, chill out.
i well believe that once all has been inspected, and there is a lot for fedora/redhat groups to inspect, every one will be informed of just what happened and what needs to be done.
no need to reply. just kick back and wait.
- -- tc,hago.
g .
in a free world without fences, who needs gates.
learn linux: 'Rute User's Tutorial and Exposition' http://rute.2038bug.com/index.html.gz 'The Linux Documentation Project' http://www.tldp.org/ 'HowtoForge' http://howtoforge.com/
Steve Repo wrote:
If only all the sysadmins in the world had the time to check on each system and every packet on the network! Try looking for a needle in a haysack?
Sure but I would assume, wrongly it seems, that a good admin has taken the time to establish some sort of baseline for the network. If you monitor traffic once in a while and know what is going on the task is certainly manageable. You don't need to necessarily monitor every box or even everything getting onto the network just the outbound traffic if that's all you have time for. Certainly not a small task but you should be able to reasonably sift through it if you've monitored the network over a period of time and understand what is normal for your network and what is not. If you haven't then I would suggest starting now. The filters on wireshark are damn good and once you learn what is more or less normal for your network then spotting oddities is easier. Of course you'll ultimately have to rely a lot on your own judgement but there are many tools to help monitor network activity. Nagios is one, hobbit is another if memory serves, there is whois for checking who ip may belong to.
The least fedora could have done is give some suggestions to users on how to take precautions if this is really a security issue which seems quite obvious now since it's been days and everyone is in the dark
I am not sure how to respond to the above except to say that I don't think fedora expects to have to manage your machines for you. Rather than have you get insulted, which is probably unavoidable at this point, and start a flame war about what fedora should and shouldn't do maybe we can discuss some of the things to do to secure a network and how to proceed if you *suspect* you have a compromised box or two online. Where are all those oldtime admins? how about schooling us youngsters on proper procedure instead of watching another thread descend into pointless bickering.
-Max
On Mon, Aug 18, 2008 at 8:27 AM, g geleem@bellsouth.net wrote:
anyone who is not subscribed to 'fedora-announce-list' have no one other than them selves to blame for not being aware.
fact that something such as this has happened, it would be best that all who are not subscribed to 'fedora-announce-list', should do so.
The specific current situation aside for a moment. As a Board member, I am interested in thinking about a better mechanism of communication of anything hoped to be seen by the entire community. Is the annouce list the best thing we can do? Or is it just the best thing we can do right now given our current tools? Nothing's ever perfect but their maybe room to try something new with regard to communication mechanisms... if there are people willing to put the effort in to build it.
I do not want to go into this too deeply until the current situation has been resolved. I do not want to be a distraction. But I think this is an area where someone could step up and provide some new code to make communicating important announcements easier. Once the current situation is over, I will be making an effort to facilitate a discussion concerning some of the ideas I've heard thrown around for better communication mechanisms and looking for contributors to take up the challenge and write the code to implement the concepts which survive.
-jef
list the best thing we can do? Or is it just the best thing we can do right now given our current tools? Nothing's ever perfect but their maybe room to try something new with regard to communication mechanisms... if there are people willing to put the effort in to build it.
Some suggestions:
- An RSS feed for *important* announcements that is picked up by default by the package updater or similar but can be unsubscribed from if users want. - Ability for yum to get an error message from a repository and report it. - Sticking important stuff on the *front* of the fedora project web site.
There is a different issue about what is said and leaving people in the dark assuming the worst - a very bad way to create long term trust.
Alan
On Mon, Aug 18, 2008 at 10:15:24 -0800, Jeff Spaleta jspaleta@gmail.com wrote:
The specific current situation aside for a moment. As a Board member, I am interested in thinking about a better mechanism of communication of anything hoped to be seen by the entire community. Is the annouce list the best thing we can do? Or is it just the best thing we can do right now given our current tools? Nothing's ever perfect but their maybe room to try something new with regard to communication mechanisms... if there are people willing to put the effort in to build it.
I think it would have been better to have messages displayed when connecting to the bodhi or koji servers rather than having them down. There might have been issues with certificates and the like, but if it would be easily doable it would have been nice. An announcement on fedoraproject.org would have been nice. Based on descriptions I saw, people trying new network installs or updates immediately after installs from media might have had some problems. The messages posted by Paul got reposted on LWN. This might have been accidental this time, but in the future you might ask Jon to post stuff.
On Mon, 18 Aug 2008 10:15:24 -0800 "Jeff Spaleta" jspaleta@gmail.com wrote:
The specific current situation aside for a moment. As a Board member, I am interested in thinking about a better mechanism of communication of anything hoped to be seen by the entire community. Is the annouce list the best thing we can do?
Personally I don't see any reason not to put important messages in all the groups (heck, if they are sent as one mail to all the groups, intelligent mailers can even detect they have already seen that message-id and only show it to you once).
The key would be the definition of "important" :-). I can't count the number of delays I have commuting to work because someone who has the power to do so thinks some message is important enough to put up on the big message boards on I-95, so everyone slows down to read stuff like "there will be construction on the turnpike this weekend", but I'm not on the turnpike, I'm on I-95, and it isn't the weekend yet anyway :-).
Just glancing at the fedora-announce archives, I'd classify 90% of the messages I see as "unimportant", so I really don't want to subscribe to it.
Personally I'd call only two things important: outages of servers everyone uses (bugzilla, wiki, repos), or compromised security on those same servers (which propably leads to an outage anyway).
On Mon, 2008-08-18 at 19:10 +0100, Alan Cox wrote:
list the best thing we can do? Or is it just the best thing we can do right now given our current tools? Nothing's ever perfect but their maybe room to try something new with regard to communication mechanisms... if there are people willing to put the effort in to build it.
Some suggestions:
- An RSS feed for *important* announcements that is picked up by default
by the package updater or similar but can be unsubscribed from if users want.
- Ability for yum to get an error message from a repository and report it.
All of these ideas are good but I like this one in particular. The problem with using mailing lists or websites is that not everyone is subscribed or visits the right places. Putting something into 'yum' would catch pretty much everyone who keeps their system up to date.
- Sticking important stuff on the *front* of the fedora project web site.
There is a different issue about what is said and leaving people in the dark assuming the worst - a very bad way to create long term trust.
Indeed. No news is bad news ...
poc
On Mon, 2008-08-18 at 19:10 +0100, Alan Cox wrote:
list the best thing we can do? Or is it just the best thing we can do right now given our current tools? Nothing's ever perfect but their maybe room to try something new with regard to communication mechanisms... if there are people willing to put the effort in to build it.
Some suggestions:
- An RSS feed for *important* announcements that is picked up by default
by the package updater or similar but can be unsubscribed from if users want.
- Ability for yum to get an error message from a repository and report it.
- Sticking important stuff on the *front* of the fedora project web site.
There is a different issue about what is said and leaving people in the dark assuming the worst - a very bad way to create long term trust.
Exactly what has happened right now.
An obscure announcement, the infrastructure going down, no updates, just silence ... very poor management.
Ralf
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Jeff Spaleta wrote: <snip>
The specific current situation aside for a moment. As a Board member, I am interested in thinking about a better mechanism of communication
i see nothing wrong with way it is now.
leave tech support on 'fedora-list'.
leave announcements on 'fedora-announce-list'.
'fedora-list' is busy enough as it is and when 'soap boxes' get pulled out, traffic gets even heavier.
as i stated in my reply to rui, a reply was made to a 'fedora-announce-list' and it returned thru 'fedora-list'. yet for some reason, all of post that were made about not being able to make downloads, do updates, or log sites, seemed to have missed a reply to what they were posting about.
to me, this is a lacking on part of posters. not a lacking on part of fedora or redhat teams.
when i subscribed to 'fedora-list', i also subscribed 'fedora-announce-list', and several others. i did so because they were there and from their description i knew each had their purpose. time has proven this.
i and several others replied to post about problems, yet others still posted they were having problems. not a fedora or redhat fault.
to me, this only indicates that some people do not read all their emails, or only read what they feel is of interest. not a fedora or redhat fault.
my only other suggestion besides leaving as is, would be a change to 'subject:', such as;
[ANNOUNCEMENT], [SPECIAL-ANNOUNCEMENT], [SECURITY-ANNOUNCEMENT]
being at start of subject line to bring, *maybe*, a better awareness of what is being sent by 'fedora-announce-list'.
I do not want to go into this too deeply until the current situation has been resolved.
maybe you should have waited? ;o)
I do not want to be a distraction. But I think this is an area where someone could step up and provide some new code to make communicating important announcements easier.
*new code* is not needed. a *conscious awareness by readers* is needed.
Once the current situation is over, I will be making an effort to facilitate a discussion concerning some of the ideas
i look forward to it.
thank you for your time and post.
- -- tc,hago.
g .
in a free world without fences, who needs gates.
learn linux: 'Rute User's Tutorial and Exposition' http://rute.2038bug.com/index.html.gz 'The Linux Documentation Project' http://www.tldp.org/ 'HowtoForge' http://howtoforge.com/
On Mon, 2008-08-18 at 21:13 +0000, g wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Jeff Spaleta wrote:
<snip> > The specific current situation aside for a moment. As a Board member, > I am interested in thinking about a better mechanism of communication
i see nothing wrong with way it is now.
Do you consider shouting "fire" in a fully crowded theater and to leave people alone in the resulting panic to be an appropriate means?
It's at least how I perceived Paul's mail and the subsequent "non-/dis-information policy" FPB, FESCO and RH have exhibited.
IMO, the question on which additional/alternative means to inform the public would have been appropriate can not be answered before somebody finally informs the public about what has happened.
One thing is for sure: This incident made a structural weakness of "the Fedora system" apparent: Centralism. Whatever might have happened it effectively paralyzed Fedora.
I do not want to go into this too deeply until the current situation has been resolved.
maybe you should have waited? ;o)
Yes, he likely better should have.
Ralf
On Mon, Aug 18, 2008 at 1:42 PM, Ralf Corsepius rc040203@freenet.de wrote:
maybe you should have waited? ;o)
Yes, he likely better should have.
I said I was going to wait to facilitate a discussion, but I see no reason to wait on telling people I plan to have one. If people are talking about whether or not fedora-announce-list is adequate as a mechanism for communication, then I want people to be aware that I am interested in hearing well reasoned opinions concerning what a better mechanism would be. More than that, I'm interested in talking to someone who is willing to help put that better mechanism in place if we reach a concencous opinion as to what the mechanism is.
Or I could just bury my head in the sand and ignore the discussions on this list and elsewhere. You either want me paying attention as a board member..or you don't. If you don't just put me in your kill file. And if you do, then expect me to wade into on-going discussions and challenge people to put work into fixes project deficiencies.
-jef
On Mon, Aug 18, 2008 at 10:15:24AM -0800, Jeff Spaleta wrote:
The specific current situation aside for a moment. As a Board member, I am interested in thinking about a better mechanism of communication of anything hoped to be seen by the entire community. Is the annouce list the best thing we can do? Or is it just the best thing we can do right now given our current tools? Nothing's ever perfect but their maybe room to try something new with regard to communication mechanisms... if there are people willing to put the effort in to build it.
The _mechanism_ seems fine.
Jeff Spaleta wrote:
On Mon, Aug 18, 2008 at 1:42 PM, Ralf Corsepius rc040203@freenet.de wrote:
maybe you should have waited? ;o)
Yes, he likely better should have.
I said I was going to wait to facilitate a discussion, but I see no reason to wait on telling people I plan to have one. If people are talking about whether or not fedora-announce-list is adequate as a mechanism for communication, then I want people to be aware that I am interested in hearing well reasoned opinions concerning what a better mechanism would be. More than that, I'm interested in talking to someone who is willing to help put that better mechanism in place if we reach a concencous opinion as to what the mechanism is.
Or I could just bury my head in the sand and ignore the discussions on this list and elsewhere. You either want me paying attention as a board member..or you don't. If you don't just put me in your kill file. And if you do, then expect me to wade into on-going discussions and challenge people to put work into fixes project deficiencies.
-jef
+1
On Mon, 2008-08-18 at 14:19 -0800, Jeff Spaleta wrote:
On Mon, Aug 18, 2008 at 1:42 PM, Ralf Corsepius rc040203@freenet.de wrote:
maybe you should have waited? ;o)
Yes, he likely better should have.
I said I was going to wait to facilitate a discussion, but I see no reason to wait on telling people I plan to have one.
+1
If people are talking about whether or not fedora-announce-list is adequate as a mechanism for communication,
It may have to be a multi-faceted approach, get the info out to wide a base as possible. 1: Cross-Post to all lists
If sites are up 2: http://fedoraproject.org/index.html should be a link to info 3: http://fedoraproject.org/wiki/Communicate (everything here, a BOLD PROMINENT link if it's not a list)
4: More pertinent info (a) Are users machines already suspect? (b) as end-user possible tasks\fixes to be done f8\9? (c) yum update gives: STOP There's a problem please check list\site (if actually possible)
then I want people to be aware that I am interested in hearing well reasoned opinions concerning what a better mechanism would be. More than that, I'm interested in talking to someone who is willing to help put that better mechanism in place if we reach a concencous opinion as to what the mechanism is.
I'm not a programmer\coder so can just throw in my 2c as an end-user.
-jef
Frank
On Mon, 2008-08-18 at 10:15 -0800, Jeff Spaleta wrote:
Is the annouce list the best thing we can do?
Well, those who *want* to know these things, can join an announce list (like I did, ages ago). Those who don't want to know can avoid the information overload, and not join. Lumping all communication together makes it harder for those who want less info.
There will be plenty that won't join mailing lists, because they're not interested in them, at all. But might expect to see a notice somewhere, if they've been trying to update a system for several days, and nothing is happening. Service status notices on the main website usually take care of those people. But if there is one for Fedora, I didn't notice it.
I think the main website does fairly well in letting people know how they can find out information (IRC, join a mailing list, etc.), so I don't think it's too hard to find general information out.
On Tue, 2008-08-19 at 18:04 +0930, Tim wrote:
On Mon, 2008-08-18 at 10:15 -0800, Jeff Spaleta wrote:
Is the annouce list the best thing we can do?
Well, those who *want* to know these things,
"Wanting to know" isn't the problem.
Communicating the appropriate pieces of information to the appropriate audiences in appropriate time is the problem.
E.g. "ordinary" users do not need to know if e.g. the buildsystem is down, however they would have to know about which precautions to take to protect their systems in case malicious/compromised packages should have hit the repos and need to be informed when the "danger is over". For such cases, sending emails to an announce list hardly is an appropriate means, because one can't expect ordinary users to be subscribed.
Ralf
On Tue, Aug 19, 2008 at 2:29 PM, Ralf Corsepius rc040203@freenet.de wrote:
On Tue, 2008-08-19 at 18:04 +0930, Tim wrote:
On Mon, 2008-08-18 at 10:15 -0800, Jeff Spaleta wrote:
Is the annouce list the best thing we can do?
Well, those who *want* to know these things,
"Wanting to know" isn't the problem.
Communicating the appropriate pieces of information to the appropriate audiences in appropriate time is the problem.
E.g. "ordinary" users do not need to know if e.g. the buildsystem is down, however they would have to know about which precautions to take to protect their systems in case malicious/compromised packages should have hit the repos and need to be informed when the "danger is over". For such cases, sending emails to an announce list hardly is an appropriate means, because one can't expect ordinary users to be subscribed.
You cannot expect a non-tech enduser to be even aware such lists exist. I'd expect tech-savvy and administrators to subscribe to such lists.
A message such as "There has been a problem with update service. Click here for detailed information (link to the website with the notice)" when yum update is performed is appropriate,
Steve
On Tue, 2008-08-19 at 18:04 +0930, Tim wrote:
[tim@localhost ~]$ uname -r 2.6.25.14-108.fc9.i686
this is exactly what i didn't install because of the announce
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
i have the same kernel installed, and now i am in deepest darkness about my system, if it is corrupt or not...
also, the repos have been closed after the update...
Roger
Tim:
[tim@localhost ~]$ uname -r 2.6.25.14-108.fc9.i686
Vassilios Kotoulas:
this is exactly what i didn't install because of the announce
As I recall, that was installed before the announcement.
I would hope that if maliciousness was the reason for it, that we would have had a more specific warning that updates should not be downloaded, and why. As opposed to some other warning that you mightn't be able to download all the files you need thanks to a system fault - which is the alternative people are guessing at, but still don't really know about.
The original notice was woeful, and nothing has been done to properly clarify the situation, since.
On Tue, 19 Aug 2008 21:42:54 +0930 Tim ignored_mailbox@yahoo.com.au wrote:
The original notice was woeful, and nothing has been done to properly clarify the situation, since.
Other than the possible hint that the repos started working again (I hope everything is OK, because I been updating :-).
On Tue, 19 Aug 2008 21:42:54 +0930 Tim ignored_mailbox@yahoo.com.au wrote:
The original notice was woeful, and nothing has been done to properly clarify the situation, since.
Other than the possible hint that the repos started working again (I hope everything is OK, because I been updating :-).
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
...would be great, if we hear something from the infrastructure people...
see here: http://blogs.zdnet.com/security/?p=1725
Roger
On Tue, Aug 19, 2008 at 3:59 AM, Ralf Corsepius rc040203@freenet.de wrote:
On Tue, 2008-08-19 at 18:04 +0930, Tim wrote:
On Mon, 2008-08-18 at 10:15 -0800, Jeff Spaleta wrote:
Is the annouce list the best thing we can do?
Well, those who *want* to know these things,
"Wanting to know" isn't the problem.
I believe he is addressing a previous poster who claimed he didn't know he needed to be on the announce list for announcements. I believe that was in this thread.
On Tue, Aug 19, 2008 at 02:49:41PM +0530, Steve Repo wrote:
You cannot expect a non-tech enduser to be even aware such lists exist. I'd expect tech-savvy and administrators to subscribe to such lists.
Personally, I'd ask said user for an e-mail address, then subscribe him myself. But then again, I don't think users get to make decisions.
A message such as "There has been a problem with update service. Click here for detailed information (link to the website with the notice)" when yum update is performed is appropriate,
I have no doubt that if you offer such a patch, and the infrastructure to host such a service, it will receive all the consideration it deserves.
Let's see... the service isn't working, nothing can be retrieved, but we're somehow going to retrieve this pointer to the message describing the failure to retrieve...
Arthur Pemberton wrote:
In all fairness, I don't think it is too much of an assumption that people would subscribe to the fedora-announce-list for announcements. The fedora-list has always been for troubleshooting.
http://fedoraproject.org/wiki/Communicate#Mailing_Lists
Aside from personally sending you an email, how would you suggest that it be made more clear. Perhaps your suggestion can be implemented.
Hi.
A suggestion to the people of the Fedora web site lists.
If it's so "natural" for a user to sign fedora-announce, this should be stated in the web page, something like "It is highly recommend if you are signing for fedora-list". One step further is to put a option (like a check box) to sign for announce when signing for fedora-list.
And to make users happy, a guide on how to create filters to different lists.
Regards
Marcelo
On Tue, 2008-08-19 at 18:47 -0700, Marc Wilson wrote:
On Tue, Aug 19, 2008 at 02:49:41PM +0530, Steve Repo wrote:
You cannot expect a non-tech enduser to be even aware such lists exist. I'd expect tech-savvy and administrators to subscribe to such lists.
Personally, I'd ask said user for an e-mail address, then subscribe him myself. But then again, I don't think users get to make decisions.
A message such as "There has been a problem with update service. Click here for detailed information (link to the website with the notice)" when yum update is performed is appropriate,
I have no doubt that if you offer such a patch, and the infrastructure to host such a service, it will receive all the consideration it deserves.
Let's see... the service isn't working, nothing can be retrieved, but we're somehow going to retrieve this pointer to the message describing the failure to retrieve...
You mean like the "This site is undergoing maintainance, please check back later" messages one sees from time to time. Gee, I wonder how they do that ...
poc
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Marcelo M. Garcia wrote: <snip>
If it's so "natural" for a user to sign fedora-announce, this should be stated in the web page, something like "It is highly recommend if you are signing for fedora-list". One step further is to put a option (like a check box) to sign for announce when signing for fedora-list.
you do not need a bunch of detailed pages if you just read what is at;
https://redhat.com/mailman/listinfo
And to make users happy, a guide on how to create filters to different lists.
filters are filters. email clients are not all same when it comes to setting up filters. among easiest to set up is thunderbird.
you need to have a look at;
http://www.mozilla.org/support/thunderbird/
- -- tc,hago.
g .
in a free world without fences, who needs gates.
learn linux: 'Rute User's Tutorial and Exposition' http://rute.2038bug.com/index.html.gz 'The Linux Documentation Project' http://www.tldp.org/ 'HowtoForge' http://howtoforge.com/
Jeff Spaleta wrote, On 08/18/2008 02:15 PM:
On Mon, Aug 18, 2008 at 8:27 AM, g geleem@bellsouth.net wrote:
anyone who is not subscribed to 'fedora-announce-list' have no one other than them selves to blame for not being aware.
fact that something such as this has happened, it would be best that all who are not subscribed to 'fedora-announce-list', should do so.
The specific current situation aside for a moment. As a Board member, I am interested in thinking about a better mechanism of communication of anything hoped to be seen by the entire community.
<SNIP>
I do not want to go into this too deeply until the current situation has been resolved. I do not want to be a distraction. But I think this is an area where someone could step up and provide some new code to make communicating important announcements easier.
I don't think new code is needed, the announcement occurred and has been duly noted. As geleem noted we need to watch the very low volume fedora-announce-list or at least view it's archive on a periodic basis, no big deal on the tools to communicate being there, because they are.
The problem is not that communication did not happen. The problem is that Paul dropped a line which can imply things that MAY be well beyond the true situation. I think Matthew Miller's message[1] summarizes, very well, an extreme position that can be implied from "We're still assessing the end-user impact of the situation, but as a precaution, we recommend you not download or update any additional packages on your Fedora systems"[2]. Also very little in the related messages[3][4] has reduced the perceived likely hood that the extreme position is wrong.
I think this could be calmed down (communication on _this_ sub-issue COMPLETED) if Fedora/Red Hat could issue a statement indicating at least one of: 1) 'we have no reason to believe that THE private keys used to sign rpms have been compromised.' 2) 'Look folks it was just a big hardware heading for the big sleep problem, and the mirrors probably got a combination of rpms that would not be able to resolve all the dependencies because of incomplete pushes from kjoii to updates.' {we (users) already understand from [3] that there has been a decision that as long as we are down, replace some old hardware. response: cool faster stuff.} 3) 'updates released before ## MMM YYYY are not going to cause a problem.' or 'none of the updates will cause a security compromise problem, though some of the dependencies may not be available, and thus have the possibility to cause an security availability problem.'
[1] 'Re: important question about updates [was Re: Infrastructure status, 2008-08-19 UTC 0200]' https://www.redhat.com/archives/fedora-list/2008-August/msg02048.html BTW +1 on all Matthew said in[1].
[2] https://www.redhat.com/archives/fedora-announce-list/2008-August/msg00008.ht...
[3] https://www.redhat.com/archives/fedora-announce-list/2008-August/msg00009.ht... [4] https://www.redhat.com/archives/fedora-announce-list/2008-August/msg00011.ht...
g wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Marcelo M. Garcia wrote:
<snip> > If it's so "natural" for a user to sign fedora-announce, this should be > stated in the web page, something like "It is highly recommend if you > are signing for fedora-list". One step further is to put a option (like > a check box) to sign for announce when signing for fedora-list.
you do not need a bunch of detailed pages if you just read what is at;
https://redhat.com/mailman/listinfo
And to make users happy, a guide on how to create filters to different lists.
filters are filters. email clients are not all same when it comes to setting up filters. among easiest to set up is thunderbird.
Hi
In the page that you suggest, I read "Announcements related to the Fedora Project", which seems a pretty much vague. And the other says "For users of Fedora", which is my case. To me don't seem logical that I should sign to both.
The whole point is, if it is so obvious that one that signs for Fedora-list should also sign for Fedora-Announce, why two separated lists? If the announces are important and concern to the users.
Even in a high volume list like "Fedora-list", if I see a header "[INFRASTRUCTURE TEAM - Urgent] ..." I will read the message.
Maybe because English is not my native tongue, but the word "announcement" doesn't to suggest something that important.
About the filters, as I said, to make users happy, it isn't important, just would be nice to have a page in Fedora Wiki.
Regards
Marcelo
On Thu, 21 Aug 2008 11:35:49 +0100, Marcelo M. Garcia wrote:
g wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Marcelo M. Garcia wrote:
<snip> > If it's so "natural" for a user to sign fedora-announce, this should be > stated in the web page, something like "It is highly recommend if you > are signing for fedora-list". One step further is to put a option (like > a check box) to sign for announce when signing for fedora-list.
you do not need a bunch of detailed pages if you just read what is at;
https://redhat.com/mailman/listinfo
And to make users happy, a guide on how to create filters to different lists.
filters are filters. email clients are not all same when it comes to setting up filters. among easiest to set up is thunderbird.
Hi
In the page that you suggest, I read "Announcements related to the Fedora Project", which seems a pretty much vague.
Okay, but Fedora is the distribution released by the Fedora Project, so related announcements should be of interest to anyone having to do something with Fedora. The online list archive shows that only a very few announcements have been made before.
And the other says "For users of Fedora", which is my case. To me don't seem logical that I should sign to both.
Splitting-hairs. Many more lists could be made obsolete with such a reasoning.
The whole point is, if it is so obvious that one that signs for Fedora-list should also sign for Fedora-Announce, why two separated lists?
And who maintains the _list of lists_ to which announcements shall be sent? Do you ask for major cross-posts to [more than] a dozen lists?
If the announces are important and concern to the users.
... not just to "the users", but also to several other target groups, who may not be subscribed to fedora-list.
Same applies to fedora-package-announce list.
Even in a high volume list like "Fedora-list", if I see a header "[INFRASTRUCTURE TEAM - Urgent] ..." I will read the message.
Only if you read the list on a daily basis or if you know what special subject marker to search for in your filters.
Maybe because English is not my native tongue, but the word "announcement" doesn't to suggest something that important.
Announcements at the airport or at the train-station, do you ignore them?
On Thu, 21 Aug 2008 11:35:49 +0100, Marcelo M. Garcia wrote:
g wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Marcelo M. Garcia wrote:
<snip> > If it's so "natural" for a user to sign fedora-announce, this should be > stated in the web page, something like "It is highly recommend if you > are signing for fedora-list". One step further is to put a option (like > a check box) to sign for announce when signing for fedora-list.
you do not need a bunch of detailed pages if you just read what is at;
https://redhat.com/mailman/listinfo
And to make users happy, a guide on how to create filters to different lists.
filters are filters. email clients are not all same when it comes to setting up filters. among easiest to set up is thunderbird.
Hi
In the page that you suggest, I read "Announcements related to the Fedora Project", which seems a pretty much vague.
Okay, but Fedora is the distribution released by the Fedora Project, so related announcements should be of interest to anyone having to do something with Fedora. The online list archive shows that only a very few announcements have been made before.
And the other says "For users of Fedora", which is my case. To me don't seem logical that I should sign to both.
Splitting-hairs. Many more lists could be made obsolete with such a reasoning.
The whole point is, if it is so obvious that one that signs for Fedora-list should also sign for Fedora-Announce, why two separated lists?
And who maintains the _list of lists_ to which announcements shall be sent? Do you ask for major cross-posts to [more than] a dozen lists?
If the announces are important and concern to the users.
... not just to "the users", but also to several other target groups, who may not be subscribed to fedora-list.
Same applies to fedora-package-announce list.
Even in a high volume list like "Fedora-list", if I see a header "[INFRASTRUCTURE TEAM - Urgent] ..." I will read the message.
Only if you read the list on a daily basis or if you know what special subject marker to search for in your filters.
Maybe because English is not my native tongue, but the word "announcement" doesn't to suggest something that important.
Announcements at the airport or at the train-station, do you ignore them?
those are broadcasted via speaker and panels and whatever they find at a train station, they do not concentrate on one single channel, knowing exactly having people with high, middle, low and no experience at all.
what is happening, is that now will of each experience loose their interest on this distro while discussing the correct way of information.i think that even fedora can learn of non-experienced people which just want to have a working system without being signed in there and there and there, and not only for high-tech-interested subscribed in any list.
so, the idea having the information, that updates will fail while running the update itself, as mentionned before would be the quickest and most visible way for all. Perphaps, there would be the possibilty to leave a hyperlink to a website for the reason of the incident whithin the message?
Roger
Michael Schwendt wrote:
On Thu, 21 Aug 2008 11:35:49 +0100, Marcelo M. Garcia wrote:
g wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Marcelo M. Garcia wrote:
<snip> > If it's so "natural" for a user to sign fedora-announce, this should be > stated in the web page, something like "It is highly recommend if you > are signing for fedora-list". One step further is to put a option (like > a check box) to sign for announce when signing for fedora-list. you do not need a bunch of detailed pages if you just read what is at;
https://redhat.com/mailman/listinfo
And to make users happy, a guide on how to create filters to different lists.
filters are filters. email clients are not all same when it comes to setting up filters. among easiest to set up is thunderbird.
Hi
In the page that you suggest, I read "Announcements related to the Fedora Project", which seems a pretty much vague.
Okay, but Fedora is the distribution released by the Fedora Project, so related announcements should be of interest to anyone having to do something with Fedora. The online list archive shows that only a very few announcements have been made before.
Humm. I think you are confirming what I said. If every user should be in both, since they have something to do with Fedora, why to separated lists?
And the other says "For users of Fedora", which is my case. To me don't seem logical that I should sign to both.
Splitting-hairs. Many more lists could be made obsolete with such a reasoning.
OK. Maybe they should. Some house keeping once in a while is good.
The whole point is, if it is so obvious that one that signs for Fedora-list should also sign for Fedora-Announce, why two separated lists?
And who maintains the _list of lists_ to which announcements shall be sent? Do you ask for major cross-posts to [more than] a dozen lists?
Yes, I'm talking about Fedora-Announce and Fedora-List only.
If the announces are important and concern to the users.
... not just to "the users", but also to several other target groups, who may not be subscribed to fedora-list.
Same applies to fedora-package-announce list.
I'm not so sure if packages-announce is in the same level as Fedora-announce.
Even in a high volume list like "Fedora-list", if I see a header "[INFRASTRUCTURE TEAM - Urgent] ..." I will read the message.
Only if you read the list on a daily basis or if you know what special subject marker to search for in your filters.
Yes. I read the list every day.
Maybe because English is not my native tongue, but the word "announcement" doesn't to suggest something that important.
Announcements at the airport or at the train-station, do you ignore them?
If I remember right, the announcements in airports or train stations are made to all users and it's user's responsibility to decide what to do.
Now image the opposite situation, that you have to go to a specific place, a room, to have announcements. I think that the life of travellers would be much more difficult.
Regards
M.
On Thu, 21 Aug 2008 11:35:49 +0100, Marcelo M. Garcia wrote:
g wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Marcelo M. Garcia wrote:
<snip> > If it's so "natural" for a user to sign fedora-announce, this should be > stated in the web page, something like "It is highly recommend if you > are signing for fedora-list". One step further is to put a option (like > a check box) to sign for announce when signing for fedora-list.
you do not need a bunch of detailed pages if you just read what is at;
https://redhat.com/mailman/listinfo
And to make users happy, a guide on how to create filters to different lists.
filters are filters. email clients are not all same when it comes to setting up filters. among easiest to set up is thunderbird.
Hi
In the page that you suggest, I read "Announcements related to the Fedora Project", which seems a pretty much vague.
Okay, but Fedora is the distribution released by the Fedora Project, so related announcements should be of interest to anyone having to do something with Fedora. The online list archive shows that only a very few announcements have been made before.
And the other says "For users of Fedora", which is my case. To me don't seem logical that I should sign to both.
Splitting-hairs. Many more lists could be made obsolete with such a reasoning.
The whole point is, if it is so obvious that one that signs for Fedora-list should also sign for Fedora-Announce, why two separated lists?
And who maintains the _list of lists_ to which announcements shall be sent? Do you ask for major cross-posts to [more than] a dozen lists?
If the announces are important and concern to the users.
... not just to "the users", but also to several other target groups, who may not be subscribed to fedora-list.
Same applies to fedora-package-announce list.
Even in a high volume list like "Fedora-list", if I see a header "[INFRASTRUCTURE TEAM - Urgent] ..." I will read the message.
Only if you read the list on a daily basis or if you know what special subject marker to search for in your filters.
Maybe because English is not my native tongue, but the word "announcement" doesn't to suggest something that important.
Announcements at the airport or at the train-station, do you ignore them?
ah yeah, you won't even hear them, if you sit in traffic on your way to the station ;)
Roger
On Thu, 21 Aug 2008 14:36:45 +0200 (CEST), Roger Grosswiler wrote:
Maybe because English is not my native tongue, but the word "announcement" doesn't to suggest something that important.
Announcements at the airport or at the train-station, do you ignore them?
those are broadcasted via speaker and panels and whatever they find at a train station, they do not concentrate on one single channel, knowing exactly having people with high, middle, low and no experience at all.
This is about the word "announcement" and whether it implies anything of importance. How do you know whether an announcement is important to you or not? You need to pay attention to announcements to find out.
On Thu, 21 Aug 2008 13:39:04 +0100, Marcelo M. Garcia wrote:
Humm. I think you are confirming what I said.
No.
If every user should be in both,
No, users should be free to choose.
since they have something to do with Fedora, why to separated lists?
fedora-list => high traffic, tedious discussion threads fedora-announce-list => very low traffic, only announcements
And who maintains the _list of lists_ to which announcements shall be sent? Do you ask for major cross-posts to [more than] a dozen lists?
Yes, I'm talking about Fedora-Announce and Fedora-List only.
And subscribers of other lists don't receive the announcements? Then let's cross-post the announcements to all fedora lists, or what?
I'm not so sure if packages-announce is in the same level as Fedora-announce.
Why not? It's relevant to users, so let's cross-post all package announcements to fedora-list and remove the separate list. (just kidding in case you don't get it)
Even in a high volume list like "Fedora-list", if I see a header "[INFRASTRUCTURE TEAM - Urgent] ..." I will read the message.
Only if you read the list on a daily basis or if you know what special subject marker to search for in your filters.
Yes. I read the list every day.
What is easier? To read fedora-announce-list every day (roughly a single message per month or so) or to skim over hundreds of messages on fedora-list every day?
Maybe because English is not my native tongue, but the word "announcement" doesn't to suggest something that important.
Announcements at the airport or at the train-station, do you ignore them?
If I remember right, the announcements in [...]
So, if you listen to those announcements, why do you consider a mailing-list for Fedora related announcements not important? Re-read your part of the quote above, please.
Now image the opposite situation, that you have to go to a specific place, a room, to have announcements. I think that the life of travellers would be much more difficult.
See my other reply. I refer to your sentence where you comment on the word "announcement" and its meaning. Let's stop splitting-hairs - some Fedora users might prefer to receive announcements via SMS or IM instead of being forced to read e-mail lists daily. Other spend much more time on IRC or reading news feeds. The thing here is that because you read fedora-list every day, you want to get announcements in that single place, too, while I argue that so far it isn't asked too much to subscribe to fedora-announce-list. Very low traffic that could go directly to your inbox.
On Thu, 21 Aug 2008 14:36:45 +0200 (CEST), Roger Grosswiler wrote:
Maybe because English is not my native tongue, but the word "announcement" doesn't to suggest something that important.
Announcements at the airport or at the train-station, do you ignore them?
those are broadcasted via speaker and panels and whatever they find at a train station, they do not concentrate on one single channel, knowing exactly having people with high, middle, low and no experience at all.
This is about the word "announcement" and whether it implies anything of importance. How do you know whether an announcement is important to you or not? You need to pay attention to announcements to find out.
-- Let's rename fedora-announce-list to fedora-important-announce-list ;) and then have users complain that some of the announcements are not considered important enough.
ok, you are somehow about right, but finding the right medium seems to be the problem here...do we bring the mountain to the prophet or the other way around? Even not at the train station you have to subscribe to the broadcast...just be there. as you are, if you make your update. why not letting tell the update-app, that it does not want to??
if you go to the doctor, will somebody else speak about your symptoms, or is it you? If update is ill, why shouldn't update speak to me?
Roger
On Thu, 21 Aug 2008 15:32:57 +0200 (CEST), Roger Grosswiler wrote:
as you are, if you make your update. why not letting tell the update-app, that it does not want to??
That would be a separate discussion, mostly about technical details, IMO. I'm not convinced it's _the_ way to go. So far it would be just another medium.
On Thu, Aug 21, 2008 at 8:32 AM, Roger Grosswiler roger@gwch.net wrote:
On Thu, 21 Aug 2008 14:36:45 +0200 (CEST), Roger Grosswiler wrote:
Maybe because English is not my native tongue, but the word "announcement" doesn't to suggest something that important.
Announcements at the airport or at the train-station, do you ignore them?
those are broadcasted via speaker and panels and whatever they find at a train station, they do not concentrate on one single channel, knowing exactly having people with high, middle, low and no experience at all.
This is about the word "announcement" and whether it implies anything of importance. How do you know whether an announcement is important to you or not? You need to pay attention to announcements to find out.
-- Let's rename fedora-announce-list to fedora-important-announce-list ;) and then have users complain that some of the announcements are not considered important enough.
ok, you are somehow about right, but finding the right medium seems to be the problem here...do we bring the mountain to the prophet or the other way around? Even not at the train station you have to subscribe to the broadcast...just be there. as you are, if you make your update. why not letting tell the update-app, that it does not want to??
How about we just have announcements of the announcement list?
On Wed, Aug 20, 2008 at 4:27 AM, Marcelo M. Garcia marcelo.maia.garcia@googlemail.com wrote:
Arthur Pemberton wrote:
In all fairness, I don't think it is too much of an assumption that people would subscribe to the fedora-announce-list for announcements. The fedora-list has always been for troubleshooting.
http://fedoraproject.org/wiki/Communicate#Mailing_Lists
Aside from personally sending you an email, how would you suggest that it be made more clear. Perhaps your suggestion can be implemented.
Hi.
A suggestion to the people of the Fedora web site lists.
If it's so "natural" for a user to sign fedora-announce, this should be stated in the web page, something like "It is highly recommend if you are signing for fedora-list". One step further is to put a option (like a check box) to sign for announce when signing for fedora-list.
And to make users happy, a guide on how to create filters to different lists.
Regards
Marcelo
Why can't people just read http://fedoraproject.org/wiki/Communicate and come to a decision on what lists they want to be on? What's with all the hand holding?
On Wed, Aug 20, 2008 at 4:27 AM, Marcelo M. Garcia marcelo.maia.garcia@googlemail.com wrote:
Arthur Pemberton wrote:
In all fairness, I don't think it is too much of an assumption that people would subscribe to the fedora-announce-list for announcements. The fedora-list has always been for troubleshooting.
http://fedoraproject.org/wiki/Communicate#Mailing_Lists
Aside from personally sending you an email, how would you suggest that it be made more clear. Perhaps your suggestion can be implemented.
Hi.
A suggestion to the people of the Fedora web site lists.
If it's so "natural" for a user to sign fedora-announce, this should be stated in the web page, something like "It is highly recommend if you are signing for fedora-list". One step further is to put a option (like a check box) to sign for announce when signing for fedora-list.
And to make users happy, a guide on how to create filters to different lists.
Regards
Marcelo
Why can't people just read http://fedoraproject.org/wiki/Communicate and come to a decision on what lists they want to be on? What's with all the hand holding?
-- Fedora 7 : sipping some of that moonshine ( www.pembo13.com )
--
why does everybody expect, that enduser search their information? If it is important, it has to be brought...i think...
they are interested in having a working distro, not being subscribed in list here and list there and list everywhere. and perhaps, it would be nice, if they get an info, if something is not working. even your browser brings the information, if internet is not available on a workstation, you don't have to subscribe to a list... "an error has occured while updating your system please have a look at http://find.error.here"
i would find this kind of very nice ;)
Roger
Michael Schwendt wrote:
What is easier? To read fedora-announce-list every day (roughly a single message per month or so) or to skim over hundreds of messages on fedora-list every day?
Which is harder: subscribe to fedora-list and read it, or subscribe to fedora-list _and_ fedora-announce-list, and read fedora-list _and_ fedora-announce-list every day?
But, since no useful information about this situation is being posted to either place, it doesn't matter much anyway...
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Marcelo M. Garcia wrote: <snip>
marcelo, michael, rodger,
after reading in a previous post that 'infrastructure' hit news announcements on, of all places, zdnet, i felt it was time to back out of this thread and 'chill out', and why i made a post asking all to.
you all are presenting some interesting points and views. but this back and forth as you are doing is doing nothing but giving zdnet and every anti linux site more fuel.
plus, if redhat/fedora was hacked, you are only giving hackers more for them to 'get their rocks off'. confusion and panic is what they want.
well, i for one, among several others that i have conversed with *off list*, would like to end it.
only reason i am replying now is because this picked up on a post i made.
so i ask you, please have a look at my post of 08/20/2008 04:54 PM.
think about what you are doing.
more importantly, start thinking about what you would like to see done to improve things and when time comes and fedora team ask for suggestions, send them in.
this is my last post to this thread.
thank you.
- -- tc,hago.
g .
in a free world without fences, who needs gates.
learn linux: 'Rute User's Tutorial and Exposition' http://rute.2038bug.com/index.html.gz 'The Linux Documentation Project' http://www.tldp.org/ 'HowtoForge' http://howtoforge.com/
On Thu, 21 Aug 2008 10:10:30 -0500, Les Mikesell wrote:
What is easier? To read fedora-announce-list every day (roughly a single message per month or so) or to skim over hundreds of messages on fedora-list every day?
Which is harder: subscribe to fedora-list and read it, or subscribe to fedora-list _and_ fedora-announce-list, and read fedora-list _and_ fedora-announce-list every day?
Yes, the fedora-list traffic makes it harder.
:-p
On Thu, 21 Aug 2008 15:10:08 +0000, g wrote:
marcelo, michael, rodger,
after reading in a previous post that 'infrastructure' hit news announcements on, of all places, zdnet,
Those vague announcements deserved such publicity. I would have been surprised if the press had not covered those "issues".
more importantly, start thinking about what you would like to see done to improve things and when time comes and fedora team ask for suggestions, send them in.
That's easy. I've commented on this already in another fedora related place. In this thread I only commented on the mailing-list subscription topic.
this is my last post to this thread.
Good, because I think you exaggerated by far in that post.
Michael Schwendt wrote:
On Thu, 21 Aug 2008 15:10:08 +0000, g wrote:
marcelo, michael, rodger,
after reading in a previous post that 'infrastructure' hit news announcements on, of all places, zdnet,
Those vague announcements deserved such publicity. I would have been surprised if the press had not covered those "issues".
Yes I would have to agree, its actually in the best interests of everyone that they do get covered. I don't like being kept in the dark anymore than the rest but I don't think its unreasonable to do what can be done i.e. use the tools available to make a determination if your compromised or not and then wait and see what the Infrastructure Team has to say when all is said and done. At this point it seems they will have no choice but to release some statement or another, whether or not it satisfies people is going to be another matter entirely. The last thing I want is for them to be rushed to a wrong conclusion because everyone is impatient for any answer, I'd prefer the right(by which I mean honest and truthful) answer that has been arrived at after all investigations have been carried to conclusion. Speculation will get us nowhere. What works on that other OS would have a hard time succeeding on a properly administered Linux box but that just means using unconventional methods to do it instead. A task that would be both more difficult and more rewarding for the attacker not to mention harder to detect and of course harder to investigate for the victim.
On Thu, Aug 21, 2008 at 14:17:13 -0400, max maximilianbianco@gmail.com wrote:
Yes I would have to agree, its actually in the best interests of everyone that they do get covered. I don't like being kept in the dark anymore than the rest but I don't think its unreasonable to do what can be done i.e. use the tools available to make a determination if your
What they did seems unreasonable to me. There is no reason I can think of that should have prevented them for explaining what was going on in general. If someone's account was compromized and they didn't know if any of the distributed rpms were trojaned, then that's what they should have said. The way it has been handled is not appropiate for an open project and I expect things to be handled much more openly the next time something similar happens. Just because people didn't know the full extent of the problem doesn't excuse them from letting the community know what was going on and in general terms why.
Bruno Wolff III wrote:
What they did seems unreasonable to me. There is no reason I can think of that should have prevented them for explaining what was going on in general.
In https://www.redhat.com/archives/fedora-advisory-board/2008-August/msg00078.h...
Tom Callaway writes:
Without being specific, know that your concerns have been heard, and are in the process of being addressed. Please don’t ask me for more details, it is not my place to give them.
Thanks,
Tom Callaway, Fedora Legal
That’s the first time on that list this year that Tom has signed himself anything other than “~spot”. Now this may be because he was writing to a non-board member, and wanted to explain who he was. Or he may have been giving us a clue that there are legal reasons why Fedora is keeping quiet.
I can think of two possibilities: either law enforcement has got involved and arrests may be forthcoming, or Fedora became aware of a problem through something like vendor-sec (a mailing list that various distributors use to share information about vulnerabilities), and Fedora is legally obliged to keep information to itself until other distributors have had a chance to prepare and test security patches. (Depending on the vulnerability, Fedora may feel that any clarification of which part of the system was vulnerable would amount to disclosure to someone with enough knowledge of the programs in question.)
And I suppose I should say that I have absolutely no way of knowing whether my guesses are accurate.
James.
Arthur Pemberton wrote:
Why can't people just read http://fedoraproject.org/wiki/Communicate and come to a decision on what lists they want to be on? What's with all the hand holding?
Because the selection of lists is long and the primary lists people frequent are adequate to add an additional announcement from time to time on important information.
There is no hand holding needed. Send it to the major lists also for important information.
Live with it! Not everyone would subscribe to a low traffic and generically named list called Announce.
I did sign up for the list a few minutes back. Still, throw important information toward the higher subscribed lists.
Jim
Jim Cornette wrote:
I did sign up for the list a few minutes back. Still, throw important information toward the higher subscribed lists.
Come to think of it... There is no reason to subscribe to the "announce" list. When something of great importance happens someone not in the know will ask "what is going on" and someone on the "announce" list will repost it here. :-)
Ed Greshko wrote:
Jim Cornette wrote:
I did sign up for the list a few minutes back. Still, throw important information toward the higher subscribed lists.
Come to think of it... There is no reason to subscribe to the "announce" list. When something of great importance happens someone not in the know will ask "what is going on" and someone on the "announce" list will repost it here. :-)
Thus we go in the completed circle. That is how I originally heard about the problem. :-) - The revolving door syndrome.
Jim
On Thu, 21 Aug 2008, Marcelo M. Garcia wrote:
Okay, but Fedora is the distribution released by the Fedora Project, so related announcements should be of interest to anyone having to do something with Fedora. The online list archive shows that only a very few announcements have been made before.
Humm. I think you are confirming what I said. If every user should be in both, since they have something to do with Fedora, why to separated lists?
You're looking at this backwards. No one "should" be on the fedora-list. It's likely most people will be but it's not a critical list. However the announce list is the one list that should have everyone, and I mean EVERYONE, even remotely dealing with fedora subscribed to. The announce list should be mandatory if anything should be.
Even in a high volume list like "Fedora-list", if I see a header "[INFRASTRUCTURE TEAM - Urgent] ..." I will read the message.
Only if you read the list on a daily basis or if you know what special subject marker to search for in your filters.
Yes. I read the list every day.
Most of us don't. I'm lucky if I can get through it once a week. If you'd like to personally forward all announce announcements to everyone who can't read all the lists daily that could solve the problem.
Maybe because English is not my native tongue, but the word "announcement" doesn't to suggest something that important.
Announcements at the airport or at the train-station, do you ignore them?
If I remember right, the announcements in airports or train stations are made to all users and it's user's responsibility to decide what to do.
Now image the opposite situation, that you have to go to a specific place, a room, to have announcements. I think that the life of travelers would be much more difficult.
I think it might be a problem of language here. On the 'Net, an "announce" list is akin to being an important/emergency/manditory information list. If you ever run across a <listname>-announce that's the one list you must subscribe to.
On Thu, 21 Aug 2008, Roger Grosswiler wrote:
ok, you are somehow about right, but finding the right medium seems to be the problem here...do we bring the mountain to the prophet or the other way around? Even not at the train station you have to subscribe to the broadcast...just be there. as you are, if you make your update. why not letting tell the update-app, that it does not want to??
This isn't a bad idea but whatever is done would have to be able to work in yum, yumex, pup (or whatever things are called these days). If it's something you really think should be done then I encourage you to get the source and add it. That is what this whole thing is about, after all.
Joe
On Thu, 21 Aug 2008, Roger Grosswiler wrote:
why does everybody expect, that enduser search their information? If it is important, it has to be brought...i think...
they are interested in having a working distro, not being subscribed in list here and list there and list everywhere. and perhaps, it would be nice, if they get an info, if something is not working. even your browser brings the information, if internet is not available on a workstation, you don't have to subscribe to a list... "an error has occurred while updating your system please have a look at http://find.error.here"
i would find this kind of very nice ;)
It would be, and probably should be, something you'd have with a commercial product. However, do not forget that the Fedora Project and it's products are 100% volunteer supported. No one is paid by Fedora to work on anything. Most, if not all, of the HW is donated in some way or other. If you want to have the kind of setup where you get the "announcements" where you want them and all the infrastructure and management of said infrastructure then buy RHEL or some other commercially supported product.
Alternatively, you can pay me and I'll do anything you like. I have support options starting at $175K/yr. :-)
Joe