Re: Evolving away from source package realms

From	Charles Plessy <plessy@debian.org>
Newsgroups	linux.debian.project
Subject	Re: Evolving away from source package realms
Date	2022-10-18 00:20 +0200
Message-ID	<FhGCJ-eWiP-9@gated-at.bofh.it> (permalink)
References	<FdVK2-cFgY-15@gated-at.bofh.it> <Ffxkd-dDLa-5@gated-at.bofh.it> <FfxWV-dEco-1@gated-at.bofh.it> <Fh3Bn-eyro-1@gated-at.bofh.it> <Fh8rn-eBgk-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi Nilesh,

Le Sun, Oct 16, 2022 at 03:16:11PM +0530, Nilesh Patra a écrit :
> 
> IMHO the "risk assessment" for most DDs is already done via NM process.
> Usually people are mindful of when they upload, and do ask others
> for opinions when they do NMU's.

The risk assessment I suggest is for the archive, not for each people
individually.  Simple questions (please let's not discuss answers) such
as:

 - What if a DD gets their keys plus password lost and found or stolen
   by a third party ?
 - What if a DD turns so spiteful that harming Debian becomes more
   important than protecting their reputation ?
 - What if a hostile upload happens and is undetected for a while ?
 - What if a hostile upload happens and is removed before it does harm ?
 - What if a hostile upload happens and is blocked even before it
   reaches the mirrors ?  Will the world applause or will our reputation
   be harmed anyway ?
 - What is a hostile upload ?  Have we thought about all possible case ?

Not all answers to these questions imply that limiting upload rights is
of high importance.  But I think that it is important to take the time
to think about them.

> I can understand. However that is not true for a lot of DDs (including me).
> Many people do need archive-wide previledges. Tobias gave a rather crisp reason
> in their mail.

That is very true.  Upload restrictions come with a cost.  The main
message I would like to pass is that maybe in the course the development
or maintenance of our infrastructures, that cost will drop.  If it is
easy for those who need to get archive-wide priviledges, it is also easy
to start without that priviledge as a default.

Have a nice day,

Charles

-- 
Charles Plessy                         Nagahama, Yomitan, Okinawa, Japan
Debian Med packaging team         http://www.debian.org/devel/debian-med
Tooting from work,           https://mastodon.technology/@charles_plessy
Tooting from home,                 https://framapiaf.org/@charles_plessy

Thread

Evolving away from source package realms Didier Raboud <odyx@debian.org> - 2022-10-07 15:40 +0200
  Re: Evolving away from source package realms Charles Plessy <plessy@debian.org> - 2022-10-12 02:00 +0200
    Re: Evolving away from source package realms Scott Kitterman <debian@kitterman.com> - 2022-10-12 02:40 +0200
      Re: Evolving away from source package realms Charles Plessy <plessy@debian.org> - 2022-10-16 06:40 +0200
        Re: Evolving away from source package realms Tobias Frost <tobi@debian.org> - 2022-10-16 11:30 +0200
        Re: Evolving away from source package realms Nilesh Patra <nilesh@debian.org> - 2022-10-16 11:50 +0200
          Re: Evolving away from source package realms Charles Plessy <plessy@debian.org> - 2022-10-18 00:20 +0200
            Re: Evolving away from source package realms Thomas Goirand <zigo@debian.org> - 2022-10-18 13:10 +0200
              Re: Evolving away from source package realms Russ Allbery <rra@debian.org> - 2022-10-18 16:30 +0200
                Re: Evolving away from source package realms Thomas Goirand <zigo@debian.org> - 2022-10-19 17:50 +0200
                Re: Evolving away from source package realms Bastian Blank <waldi@debian.org> - 2022-10-19 20:50 +0200
              Re: Evolving away from source package realms "M. Zhou" <lumin@debian.org> - 2022-10-18 17:30 +0200
  Re: Evolving away from source package realms Pierre-Elliott Bécue <peb@debian.org> - 2022-10-12 09:40 +0200
    Re: Evolving away from source package realms Russ Allbery <rra@debian.org> - 2022-10-13 01:30 +0200
      Re: Evolving away from source package realms Tobias Frost <tobi@debian.org> - 2022-10-13 07:20 +0200
        Re: Evolving away from source package realms Russ Allbery <rra@debian.org> - 2022-10-13 09:20 +0200
          Re: Evolving away from source package realms Tobias Frost <tobi@debian.org> - 2022-10-13 14:50 +0200
        Bug#1021714: lists.debian.org: Request for new mailing list: collab-maint (was: Evolving away from source package realms) Santiago Ruano Rincón <santiagorr@riseup.net> - 2022-10-13 14:30 +0200
          Bug#1021714: lists.debian.org: Request for new mailing list: collab-maint (was: Evolving away from source package realms) Andreas Metzler <ametzler@bebt.de> - 2022-10-16 18:40 +0200
      Re: Evolving away from source package realms "M. Zhou" <lumin@debian.org> - 2022-10-18 04:40 +0200
    Re: Evolving away from source package realms Thomas Goirand <zigo@debian.org> - 2022-10-13 09:20 +0200
  Re: Evolving away from source package realms Nilesh Patra <nilesh@debian.org> - 2022-10-12 10:20 +0200
  Re: Evolving away from source package realms Johannes Schauer Marin Rodrigues <josch@debian.org> - 2022-10-12 11:00 +0200
    Re: Evolving away from source package realms Timo Röhling <roehling@debian.org> - 2022-10-19 20:00 +0200
  Re: Evolving away from source package realms Didier Raboud <odyx@debian.org> - 2022-10-23 16:50 +0200
    Re: Evolving away from source package realms Raphael Hertzog <hertzog@debian.org> - 2023-01-19 10:40 +0100

csiph-web