Re: Introducing security hardening features for Lenny

2008-03-05 Thread Pierre Habouzit
On Wed, Mar 05, 2008 at 05:48:57PM +, Kees Cook wrote: > On Wed, Mar 05, 2008 at 10:16:52AM +0100, Pierre Habouzit wrote: > > On Wed, Mar 05, 2008 at 06:16:33AM +, Kees Cook wrote: > > > I finally got some time to run some benchmarks. I checked the results[1] > > > into the "hardening" svn

Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)

2008-03-05 Thread Mike Bird
On Wed March 5 2008 14:52:04 Raphael Hertzog wrote: > On Wed, 05 Mar 2008, Mike Bird wrote: > > Please post the URL for this policy. I apologize if you've already > > posted and I missed it, but Google couldn't find it for me. > > http://wiki.debian.org/Teams/Dpkg/GitUsage Hi Raphael, I had alre

Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)

2008-03-05 Thread Raphael Hertzog
On Wed, 05 Mar 2008, Mike Bird wrote: > Please post the URL for this policy. I apologize if you've already > posted and I missed it, but Google couldn't find it for me. http://wiki.debian.org/Teams/Dpkg/GitUsage Now I would appreciate if you could stop spreading lies and aggressive remarks in th

Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)

2008-03-05 Thread Mike Bird
On Wed March 5 2008 13:30:06 Otavio Salvador wrote: > Mike Bird <[EMAIL PROTECTED]> writes: > > On Wed March 5 2008 12:29:08 Raphael Hertzog wrote: > >> I've been added to dpkg's Uploader a few weeks ago, I'm not dpkg's main > >> coordinator. I have no veto power, I was mainly trying to give my vie

Re: Bits from the listmaster team

2008-03-05 Thread Henrique de Moraes Holschuh
On Wed, 05 Mar 2008, Mike Hommey wrote: > ... and in a "do what i say, not what i do" fashion, the default sa-exim > setup (at least in etch) leads to receiving bounce notification because > of spam being rejected. What *is* valid in the context of this thread is the following policy: IF the r

Re: Introducing security hardening features for Lenny

2008-03-05 Thread Don Armstrong
On Wed, 05 Mar 2008, Kees Cook wrote: > On Wed, Mar 05, 2008 at 01:29:01AM -0800, Don Armstrong wrote: > > Just for future reference, it'd probably be better to run more than 5 > > tests of each population in the future > > Getting larger data sets will be rather time-consuming -- especially > for

Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)

2008-03-05 Thread Loïc Minier
On Wed, Mar 05, 2008, Mike Bird wrote: > May I suggest then that if no dpkg maintainer objects here > within 48 hours that Ian should proceed with his update? May you stop in the next hour giving executive advice when you're not representing anybody whatsoever? -- Loïc Minier -- To UNSUBSCR

ITP: rain8net -- Rain8Net sprinkler controller application

2008-03-05 Thread rain8net
Package: wnpp Severity: wishlist Owner: Torin Ford <[EMAIL PROTECTED]> * Package name: rain8net Version : 0.0.1 Upstream Author : Torin Ford <[EMAIL PROTECTED]> * URL : http://rain8net.sourceforge.net/ * License : GPLv3 Programming Lang: (C, C++, C#, Perl, P

Re: Bits from the listmaster team

2008-03-05 Thread Mike Hommey
On Tue, Mar 04, 2008 at 03:49:30PM +, Thomas Viehmann wrote: > Better bounce handling > ~~ > We checked our bounce handling because we have more than 500 bounces > for some lists, and in the process found that we didn't have working > bounce handling for other lists (other-*

Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)

2008-03-05 Thread Otavio Salvador
Mike Bird <[EMAIL PROTECTED]> writes: > On Wed March 5 2008 12:29:08 Raphael Hertzog wrote: >> I've been added to dpkg's Uploader a few weeks ago, I'm not dpkg's main >> coordinator. I have no veto power, I was mainly trying to give my view >> of the situation ... > > May I suggest then that if no

Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)

2008-03-05 Thread Mike Bird
On Wed March 5 2008 12:29:08 Raphael Hertzog wrote: > I've been added to dpkg's Uploader a few weeks ago, I'm not dpkg's main > coordinator. I have no veto power, I was mainly trying to give my view > of the situation ... May I suggest then that if no dpkg maintainer objects here within 48 hours t

Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)

2008-03-05 Thread Raphael Hertzog
On Wed, 05 Mar 2008, Ian Jackson wrote: > > What's the difference, really? Isn't it a case of people on all sides > > trying to control each other instead of cooperating? > > What would you like me to do ? Either do the supplementary work or wait patiently with some _friendly_ nagging from time t

Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)

2008-03-05 Thread Ian Jackson
Clint Adams writes ("Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)"): > On Wed, Mar 05, 2008 at 12:55:00AM -0300, Henrique de Moraes Holschuh wrote: > > Isn't this going way out of proportion? That's the first I hear from any > > *refuses* to merge, as opposed to "the merge no

Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)

2008-03-05 Thread Ian Jackson
Henrique de Moraes Holschuh writes ("Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)"): > On Tue, 04 Mar 2008, Mike Bird wrote: > > Raphael seems to have the power to block your packages but he has > > no rational excuse. Can the tech committee overrule Raphael or > > does Debia

Re: Introducing security hardening features for Lenny

2008-03-05 Thread Matthew Rosewarne
While these benchmarks should show any differences in raw processing performance, there's also the question of what differences the hardening measures make to application start-up times. PIE in particular should cause some slowdown when the executables are first run, but it would take some oth

Re: Who to contact about pointless Ubuntu differences?

2008-03-05 Thread Russ Allbery
Scott Kitterman <[EMAIL PROTECTED]> writes: > Definitely. I'll upload a new revision removing this gratuitous > difference and leave a note to make clear it's appropriate to sync the > package. Thank you very much to both you and Steve. If this happens again, I'll mail the Ubuntu maintainer add

Re: Introducing security hardening features for Lenny

2008-03-05 Thread Steinar H. Gunderson
On Wed, Mar 05, 2008 at 09:55:37AM -0800, Kees Cook wrote: >>> t.test(x=c(10.87,10.873,10.854,10.809,10.877),y=c(10.807,10.824,10.963,10.84,10.838)) > What tool is this you're using? GNU R. Takes a while to get into, but hard to beat for statistics. >> data: c(10.87, 10.873, 10.854, 10.809, 10.8

Re: Introducing security hardening features for Lenny

2008-03-05 Thread Kees Cook
On Wed, Mar 05, 2008 at 01:29:01AM -0800, Don Armstrong wrote: > Just for future reference, it'd probably be better to run more than 5 > tests of each population in the future, as 5 tests means you'll only > detect very large differences in performance at any reasonable level > of signifigance. I

Re: Introducing security hardening features for Lenny

2008-03-05 Thread Kees Cook
On Wed, Mar 05, 2008 at 10:16:52AM +0100, Pierre Habouzit wrote: > On Wed, Mar 05, 2008 at 06:16:33AM +, Kees Cook wrote: > > I finally got some time to run some benchmarks. I checked the results[1] > > into the "hardening" svn tree, in case other people want to contribute > > more stuff. > >

Re: Who to contact about pointless Ubuntu differences?

2008-03-05 Thread Scott Kitterman
On Wednesday 05 March 2008 03:44, Steve Langasek wrote: > Hi Russ, > > On Tue, Mar 04, 2008 at 11:26:02PM -0800, Russ Allbery wrote: > > Does anyone know the right contact point to ask Ubuntu to stop making > > pointless changes to a Debian package? See: > > > > http://patches.ubuntu.com/x/xfo

Re: git bikeshedding (Re: triggers in dpkg, and dpkg maintenance)

2008-03-05 Thread Clint Adams
On Wed, Mar 05, 2008 at 12:55:00AM -0300, Henrique de Moraes Holschuh wrote: > Isn't this going way out of proportion? That's the first I hear from any > *refuses* to merge, as opposed to "the merge not going to be done the way I > would like it to happen", and "it is taking too long for it to get

Bug#469470: ITP: elisa-plugins-ugly -- Elisa plugins from the "ugly" set

2008-03-05 Thread Philippe Normand
Package: wnpp Severity: wishlist Owner: Philippe Normand <[EMAIL PROTECTED]> The Elisa project is now shipped in various upstream source distributions. The -bad plugins set contains Elisa plugins known to be working well but with code needing more QA (unittests, code reviews). Moreover the plugins

Bug#469464: ITP: elisa-plugins-bad -- Elisa plugins from the "bad" set

2008-03-05 Thread Philippe Normand
Package: wnpp Severity: wishlist Owner: Philippe Normand <[EMAIL PROTECTED]> The Elisa project is now shipped in various upstream source distributions. The -bad plugins set contains Elisa plugins known to be working well but with code needing more QA (unittests, code reviews). * Package name:

Bug#469460: ITP: ocamlduce -- OCaml extended with datatypes to manipulate XML documents

2008-03-05 Thread Pietro Abate
Package: wnpp Severity: wishlist Owner: Pietro Abate <[EMAIL PROTECTED]> * Package name: ocamlduce Version : 3.10.0 Upstream Author : Alain Frisch <[EMAIL PROTECTED]> * URL : http://cduce.org/ocaml.html * License : LGPL, QPL Programming Lang: OCaml Descript

Bug#469456: ITP: elisa-plugins-good -- Elisa plugins from the "good" set

2008-03-05 Thread Philippe Normand
Package: wnpp Severity: wishlist Owner: Philippe Normand <[EMAIL PROTECTED]> The Elisa project is now shipped in various upstream source distributions. The -good plugins set contains Elisa plugins known to be well tested, working and being compatible with the Elisa licensing model. * Package name

Re: Introducing security hardening features for Lenny

2008-03-05 Thread Don Armstrong
On Tue, 04 Mar 2008, Kees Cook wrote: > mplayer doesn't compile with PIE due to the various ASM routines. (I've > noted this failure mode in the wiki[2] now.) However, with everything > else enabled (including FORTIFY_SOURCE), there was no measurable > difference (it was below the percentage diff

Re: Introducing security hardening features for Lenny

2008-03-05 Thread Pierre Habouzit
On Wed, Mar 05, 2008 at 06:16:33AM +, Kees Cook wrote: > Hi, > > I finally got some time to run some benchmarks. I checked the results[1] > into the "hardening" svn tree, in case other people want to contribute > more stuff. > > On Wed, Jan 30, 2008 at 08:46:55PM +0100, Moritz Muehlenhoff wr

Re: Who to contact about pointless Ubuntu differences?

2008-03-05 Thread Steve Langasek
Hi Russ, On Tue, Mar 04, 2008 at 11:26:02PM -0800, Russ Allbery wrote: > Does anyone know the right contact point to ask Ubuntu to stop making > pointless changes to a Debian package? See: > http://patches.ubuntu.com/x/xfonts-jmk/xfonts-jmk_3.0-16ubuntu1.patch > I mailed the person listed i