Yuri Vasilevski posted <[EMAIL PROTECTED]>, excerpted below, on Thu, 16 Jun 2005 13:20:44 -0500:
> So I think it may be good for some packages to be split in several > packages (but right now I can't think of any), but I think it'll be much > better introduce more granularity into many ebuils with use flags. This is > specially the case (in my opinion) of packages that can have both client > and server functionality (the best example I can think of is net-fs/samba, > which I mostly use just to mount shares form other servers). The client/server thing is a concern for me here, as well, for security reasons. If I don't have an SSH server merged, it can't inadvertently be turned on somehow. SSH is apparently a dependency for something I have merged, and currently, it includes the SSH server. That worries me, as it's a server component on a normally client system, and is thus a potential security vuln. IMO, having it there when it's not used and the human behind the machine has no intention of running it, is just /asking/ for security issues. It shouldn't be there in the first place. Unfortunately, there's no USE flag to turn it off. Similarly with a couple of the DHCP packages I was looking at a few weeks ago. I normally run static IPs on a LAN behind a NAPT based router, giving me a /bit/ more leeway in terms of security on my Linux box, but decided to install some form of DHCP just in case. Several of those packages have both clients and servers, with apparently no way to only install the client, short of hacking the ebuild. IMO, that's not the way it should be. Gentoo isn't supposed to work that way, and PARTICULARLY in this sort of instance, where getting mixed up in your configuration may mean you start the server instead of the client, is a security risk that simply shouldn't have to be there in the first place. I'm sure there are other instances... IMO as a Gentoo user... -- Duncan - List replies preferred. No HTML msgs. "Every nonfree program has a lord, a master -- and if you use the program, he is your master." Richard Stallman in http://www.linuxdevcenter.com/pub/a/linux/2004/12/22/rms_interview.html -- gentoo-dev@gentoo.org mailing list
