Re: Security concerns with minified javascript code

2015-09-02 Thread Vincent Bernat
❦ 3 septembre 2015 12:23 +1000, Dmitry Smirnov  : >> Amazon did a study that showed every ~100ms of page load >> delay lost them 1% in sales. > > It could be that small percentage of Amazon users are impulsive trigger-happy > buyers. :) > However that conclusion is probably wrong due to number

Re: Security concerns with minified javascript code

2015-09-02 Thread Dmitry Smirnov
On Tuesday 01 September 2015 17:46:30 Josh Triplett wrote: > Nikolaus Rath wrote: > > I don't think 28 kB vs 73 kB is a difference that people will notice > > over the network in *most* situations. Even at just 100 kB/s that's > > 0.28 vs 0.73 seconds, and only when the page is first loaded. > > T

Bug#797837: ITP: node-hashish -- maniuplate hash data structures in Node.js

2015-09-02 Thread Bastien Roucariès
Package: wnpp Severity: wishlist Owner: "Bastien Roucariès" * Package name: node-hashish Version : 0.4.0 Upstream Author : James Halliday * URL : https://github.com/substack/node-hashish/ * License : X11 Programming Lang: js Description : maniuplate ha

Re: Security concerns with minified javascript code

2015-09-02 Thread Russ Allbery
The below is very much a tangent from the minified Javascript case, and not applicable to that case. Bas Wijnen writes: > Here's a rule to limit the selection a bit: a file is certainly not > source if it was originally generated from a different file, and has not > been modified. This makes fi

Re: Security concerns with minified javascript code

2015-09-02 Thread Bas Wijnen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Sep 02, 2015 at 07:33:10PM +0100, Neil Williams wrote: > On Wed, 2 Sep 2015 13:33:57 -0400 > Marvin Renich wrote: > > > * Ben Hutchings [150902 10:12]: > > > My preferred form is a git repository of code written in C, Python, > > > or some o

Re: Security concerns with minified javascript code

2015-09-02 Thread Jeroen Dekkers
At Tue, 1 Sep 2015 18:56:45 +0200, Raphael Hertzog wrote: > For me, the javascripts bits in wordpress/publican are not part of the > product, they are external libraries whose preferred form of use is > by embedding a copy of the library... that sucks but it's the way it is. > > I do not see signi

Bug#797820: ITP: r-cran-bayesfactor -- GNU R package providing a suite of functions for computing various Bayes factors for simple designs

2015-09-02 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-bayesfactor Version : 0.9.11-1 Upstream Author : Richard D. Morey * URL : http://bayesfactorpcl.r-forge.r-project.org/ * License : GPL Programming Lang: R, C Description : GNU R pa

Bug#797819: ITP: r-cran-afex -- GNU R package providing convenience functions for analyzing factorial experiments using ANOVA or mixed models

2015-09-02 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-afex Version : 0.14-2 Upstream Author : Henrik Singmann * URL : https://github.com/singmann/afex * License : GPL Programming Lang: R Description : GNU R package providing convenien

Bug#797818: ITP: r-cran-coin -- GNU R package providing conditional inference procedures for the general independence problem

2015-09-02 Thread Jonathon
Package: wnpp Severity: wishlist Owner: Jonathon * Package name: r-cran-coin Version : 1.1-0 Upstream Author : Torsten Hothorn * URL : http://coin.r-forge.r-project.org/ * License : GPL Programming Lang: R, C Description : GNU R package providing condi

Re: Security concerns with minified javascript code

2015-09-02 Thread Neil Williams
On Wed, 2 Sep 2015 13:33:57 -0400 Marvin Renich wrote: > * Ben Hutchings [150902 10:12]: > > My preferred form is a git repository of code written in C, Python, > > or some other language I know. That doesn't mean that a tarball of > > Haskell code is non-free! > No, "A preferred form" is what

Re: Security concerns with minified javascript code

2015-09-02 Thread Neil Williams
On Wed, 2 Sep 2015 13:14:31 -0400 Marvin Renich wrote: > * Neil Williams [150902 10:22]: > > Upstream is another recipient of code distributed under copyleft. > > Having changes in a format which upstream can use is absolutely a > > sensible and sane criterion for what is regarded as the form of

Re: Security concerns with minified javascript code

2015-09-02 Thread Marvin Renich
* Ben Hutchings [150902 10:12]: > My preferred form is a git repository of code written in C, Python, or > some other language I know. That doesn't mean that a tarball of > Haskell code is non-free! I can't tell whether you are agreeing or disagreeing with me! > The preferred form for modificat

Bug#797803: ITP: libcsp -- The Cubesat Space Protocol Library

2015-09-02 Thread Agustin Henze
Package: wnpp Severity: wishlist X-Debbugs-CC: debian-devel@lists.debian.org Package name: libcsp Version: 1.4 Upstream Author: 2012 GomSpace ApS (http://www.gomspace.com) 2012 AAUSAT3 Project (http://aausat3.space.aau.dk) URL: https://github.com/GomSpace/libcsp Li

Re: Security concerns with minified javascript code

2015-09-02 Thread Marvin Renich
* Neil Williams [150902 10:22]: > Upstream is another recipient of code distributed under copyleft. > Having changes in a format which upstream can use is absolutely a > sensible and sane criterion for what is regarded as the form of the > code for modification. To do otherwise is to make the main

Re: Strange units in systemd graphical.target

2015-09-02 Thread Jayson Willson
Thank you, everything is clear now.

Re: Strange units in systemd graphical.target

2015-09-02 Thread Michael Biebl
Am 02.09.2015 um 17:00 schrieb Jayson Willson: > systemctl list-dependencies: > http://pastebin.com/EkdYjp7X > > In my system default.target is symlink to graphical.target. > It does not seem obvious to me, why such services as exim4, tor, gpm, > fail2ban are both in default.target==graphical.tar

Bug#797798: ITP: bagel -- Computational Chemistry Package

2015-09-02 Thread Michael Banck
Package: wnpp Severity: wishlist Owner: Debichem Team * Package name: bagel Version : (git snapshot) Upstream Author : Shiozaki Group, Northwestern University * URL : http://www.nubakery.org/ * License : GPL3+ Programming Lang: C++ Description : Computa

Strange units in systemd graphical.target

2015-09-02 Thread Jayson Willson
systemctl list-dependencies: http://pastebin.com/EkdYjp7X In my system default.target is symlink to graphical.target. It does not seem obvious to me, why such services as exim4, tor, gpm, fail2ban are both in default.target==graphical.target and in multi-user.target. Seems like only lightdm is s

Re: Security concerns with minified javascript code

2015-09-02 Thread Neil Williams
On Wed, 2 Sep 2015 08:59:11 -0400 Marvin Renich wrote: > * Thorsten Glaser [150902 07:50]: > > There is (I just had an epiphany) another possible criterium to > > apply for to determine what the preferred form of modification is: >^ for > [Okay, so I

Re: Security concerns with minified javascript code

2015-09-02 Thread Ben Hutchings
On Wed, 2015-09-02 at 08:59 -0400, Marvin Renich wrote: > * Thorsten Glaser [150902 07:50]: > > There is (I just had an epiphany) another possible criterium to apply > > for to determine what the preferred form of modification is: >^ for > [Okay, so I'

Bug#797775: ITP: python-tosca-parser -- parser for TOSCA Simple Profile in YAML

2015-09-02 Thread Thomas Goirand
Package: wnpp Severity: wishlist Owner: Thomas Goirand * Package name: python-tosca-parser Version : 0.1.0 Upstream Author : OpenStack Foundation * URL : https://github.com/openstack/tosca-parser * License : Apache-2.0 Programming Lang: Python Description

Re: Security concerns with minified javascript code

2015-09-02 Thread Marvin Renich
* Thorsten Glaser [150902 07:50]: > There is (I just had an epiphany) another possible criterium to apply > for to determine what the preferred form of modification is: ^ for [Okay, so I'm being pedantic, but this is a common mistake.] > Does upstream

Re: Security concerns with minified javascript code

2015-09-02 Thread Thorsten Glaser
Vincent Bernat debian.org> writes: > 2. Upstream may generate the final pre-minification file with complex > tools, like an AMD loader or an ES6/ES5 transpiler, along with the > use of non-packaged build tools like Grunt. > problem. For the second one, a solution would be to consider th

Re: Security concerns with minified javascript code

2015-09-02 Thread Samuel Thibault
Vincent Bernat, le Wed 02 Sep 2015 11:20:32 +0200, a écrit : > ❦ 2 septembre 2015 10:18 +0200, Samuel Thibault  : > >> Or maybe you propose to just ship the whole "node_modules" directory > >> (which has all the dependencies) with jQuery sources? > > > > That'd be a lot better than nothing. > >

Re: Security concerns with minified javascript code

2015-09-02 Thread Vincent Bernat
❦ 2 septembre 2015 10:18 +0200, Samuel Thibault  : >> Or maybe you propose to just ship the whole "node_modules" directory >> (which has all the dependencies) with jQuery sources? > > That'd be a lot better than nothing. OK. Also, node_modules for jQuery is 76M (for 3.x, 70M for 2.x). I still f

Bug#797749: ITP: python-jsonpath-rw-ext -- extensions for JSONPath RW

2015-09-02 Thread Thomas Goirand
Package: wnpp Severity: wishlist Owner: Thomas Goirand * Package name: python-jsonpath-rw-ext Version : 0.1.7 Upstream Author : Mehdi Abaakouk * URL : https://github.com/sileht/python-jsonpath-rw-ext * License : Apache-2.0 Programming Lang: Python Descript

Re: Security concerns with minified javascript code

2015-09-02 Thread Samuel Thibault
Vincent Bernat, le Wed 02 Sep 2015 10:10:55 +0200, a écrit : > ❦ 2 septembre 2015 09:54 +0200, Samuel Thibault  : > > >> If you talk about Grunt, > > > > That's what I'm talking about. > > > >> Grunt comes with a lot of plugins (and does almost nothing without > >> those) and each upstream will

Re: Security concerns with minified javascript code

2015-09-02 Thread Vincent Bernat
❦ 2 septembre 2015 09:54 +0200, Samuel Thibault  : >> If you talk about Grunt, > > That's what I'm talking about. > >> Grunt comes with a lot of plugins (and does almost nothing without >> those) and each upstream will require different plugins with different >> versions (Grunt plugin versions a

Re: Security concerns with minified javascript code

2015-09-02 Thread Samuel Thibault
Vincent Bernat, le Wed 02 Sep 2015 09:47:23 +0200, a écrit : > If you talk about Grunt, That's what I'm talking about. > Grunt comes with a lot of plugins (and does almost nothing without > those) and each upstream will require different plugins with different > versions (Grunt plugin versions ar

Re: Security concerns with minified javascript code

2015-09-02 Thread Vincent Bernat
❦ 2 septembre 2015 09:28 +0200, Samuel Thibault  : >> Healthy language communities have their own metadata systems and >> standardized build systems that allow Debian packaging to be nearly >> automated, *provided* that we use the same unit of distribution as >> upstream. > > I understand that u

Re: Security concerns with minified javascript code

2015-09-02 Thread Vincent Bernat
❦ 2 septembre 2015 09:32 +0300, Lars Wirzenius  : > However, I want to raise the point that upstreams do not always make > sensible decisions, and if they don't, it's good to raise that with > them. For example, there was recently an ITP bug for > node-number-is-nan. Upstream source code is at >

Re: Security concerns with minified javascript code

2015-09-02 Thread Samuel Thibault
Russ Allbery, le Tue 01 Sep 2015 18:05:09 -0700, a écrit : > Healthy language communities have their own metadata systems and > standardized build systems that allow Debian packaging to be nearly > automated, *provided* that we use the same unit of distribution as > upstream. I understand that usi