Re: [Rd] Proposal to limit Internet access during package load

2022-09-28 Thread Blätte , Andreas
Dear Tomas, thank you so much for the explanation. Very helpful for myself, and relevant for the wider context of packages using rwinlib! Andreas Am 27.09.22, 20:18 schrieb "Tomas Kalibera" : On 9/27/22 18:42, Blätte, Andreas wrote: > Dear all, > > my apologies for a dull quest

Re: [Rd] Proposal to limit Internet access during package load

2022-09-27 Thread Tomas Kalibera
On 9/27/22 18:42, Blätte, Andreas wrote: Dear all, my apologies for a dull question. I think I do understand that unnoticed Internet access requires scrutiny and a more explicit approach. But I am not sure how this would impact on the practice on many Windows machines to download static libra

Re: [Rd] Proposal to limit Internet access during package load

2022-09-27 Thread Iñaki Ucar
El mar., 27 sept. 2022 18:42, Blätte, Andreas escribió: > Dear all, > > my apologies for a dull question. I think I do understand that unnoticed > Internet access requires scrutiny and a more explicit approach. > > But I am not sure how this would impact on the practice on many Windows > machines

Re: [Rd] Proposal to limit Internet access during package load

2022-09-27 Thread Blätte , Andreas
Dear all, my apologies for a dull question. I think I do understand that unnoticed Internet access requires scrutiny and a more explicit approach. But I am not sure how this would impact on the practice on many Windows machines to download static libraries from one of the rwinlib repositories?

Re: [Rd] Proposal to limit Internet access during package load

2022-09-27 Thread Iñaki Ucar
El mar., 27 sept. 2022 4:22, Dirk Eddelbuettel escribió: > > Regarding 'system' libraries: Packages like stringi and nloptr download the > source of, respectively, libicu or libnlopt and build a library _if_ the > library is not found locally. If we outlaw this, more users may hit a > brick > wa

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Gabriel Becker
Ah, thats embarrassing. Thats a bug in how/where I handle lack of connectivity, rather than me not doing it. I've just push a fix to the github repo that now cleanly passes check with no internet connectivity (much more stringent). Using a canned file is a bit odd, because in the case where there

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Dirk Eddelbuettel
Regarding 'system' libraries: Packages like stringi and nloptr download the source of, respectively, libicu or libnlopt and build a library _if_ the library is not found locally. If we outlaw this, more users may hit a brick wall because they cannot install system libraries (for lack of permissi

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Bob Rudis
I would personally like something like an Android/iOS permissions required/requested manifest document describing what the pkg needs with R doing what it can to enforce said permissions. R would be breaking some ground in this space, but it does that regularly in many respects. Yes, I know I just 1

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
BTW: It is a good question whether packages that require internet access in order to function at all should be flagged as such so they can be removed from server installations. Let's say if a package provides an API for retrieving stock quotes online and it's all it does then perhaps it does mak

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
> On 27/09/2022, at 11:02 AM, Gabriel Becker wrote: > > For the record, the only things switchr (my package) is doing internet wise > should be hitting the bioconductor config file > (http://bioconductor.org/config.yaml) so that it knows the things it need to > know about Bioc repos/version

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Gabriel Becker
For the record, the only things switchr (my package) is doing internet wise should be hitting the bioconductor config file ( http://bioconductor.org/config.yaml) so that it knows the things it need to know about Bioc repos/versions/etc (at load time, actually, not install time, but since install do

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
> On 27/09/2022, at 10:21 AM, Iñaki Ucar wrote: > > On Mon, 26 Sept 2022 at 23:07, Simon Urbanek > wrote: >> >> Iñaki, >> >> I'm not sure I understand - system dependencies are an entirely different >> topic and I would argue a far more important one (very happy to start a >> discussion a

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Iñaki Ucar
On Mon, 26 Sept 2022 at 23:07, Simon Urbanek wrote: > > Iñaki, > > I'm not sure I understand - system dependencies are an entirely different > topic and I would argue a far more important one (very happy to start a > discussion about that), but that has nothing to do with declaring downloads. >

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
Iñaki, I'm not sure I understand - system dependencies are an entirely different topic and I would argue a far more important one (very happy to start a discussion about that), but that has nothing to do with declaring downloads. I assumed your question was about large files in packages which p

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
Gabe, that's a great example how **not** to do it and why it is such a bad idea. icu4c is a system library, so it is generally available and it already includes the data in the system library, so embedding data from an outdated version is generally bad. I'm not sure why it should be needed in t

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Iñaki Ucar
On Mon, 26 Sept 2022 at 21:50, Simon Urbanek wrote: > > [snip] > Sure, I fully agree that it would be a good first step, but I'm still waiting > for examples ;). Oh, you want me to actually name specific packages? I thought that this was a well-established fact from your initial statement "I ful

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Gabriel Becker
Hi Simon, The example of this I'm aware of that is most popular and widely used "in the wild" is the stringi package (which is a dep of the widely used stringr pkg) whose configure file downloads the ICU Data Library (icudt). See https://github.com/gagolews/stringi/blob/master/configure#L5412 No

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Simon Urbanek
> On Sep 27, 2022, at 8:25 AM, Iñaki Ucar wrote: > > On Sat, 24 Sept 2022 at 01:55, Simon Urbanek > wrote: >> >> Iñaki, >> >> I fully agree, this a very common issue since vast majority of server >> deployments I have encountered don't allow internet access. In practice this >> means that

Re: [Rd] Proposal to limit Internet access during package load

2022-09-26 Thread Iñaki Ucar
On Sat, 24 Sept 2022 at 01:55, Simon Urbanek wrote: > > Iñaki, > > I fully agree, this a very common issue since vast majority of server > deployments I have encountered don't allow internet access. In practice this > means that such packages are effectively banned. > > I would argue that not ev

Re: [Rd] Proposal to limit Internet access during package load

2022-09-23 Thread Simon Urbanek
Iñaki, I fully agree, this a very common issue since vast majority of server deployments I have encountered don't allow internet access. In practice this means that such packages are effectively banned. I would argue that not even (1) or (2) are really an issue, because in fact the CRAN policy

Re: [Rd] Proposal to limit Internet access during package load

2022-09-23 Thread Iñaki Ucar
On Fri, 23 Sept 2022 at 17:22, Iñaki Ucar wrote: > > [snip] > Now, what if connection is suppressed during package load? There are > basically three use cases out there: > > (1) The package requires additional files for the installation (e.g. > the source code of an external library) that cannot b

[Rd] Proposal to limit Internet access during package load

2022-09-23 Thread Iñaki Ucar
Hi all, I'd like to open this debate here, because IMO this is a big issue. Many packages do this for various reasons, some more legitimate than others, but I think that this shouldn't be allowed, because it basically means that installation fails in a machine without Internet access (which happen