Re: Review of new English templates for wireshark

--a3K6cN0EDr7dTwYi
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Bálint Réczey wrote:
> I forgot to point out that the template is just a slight modification
> of the already reviewed wireshark template.
> There were multiple threads about reviewing the wireshark template on
> this list, thus probably the best entry point to past discussions is
> this:
> https://lists.debian.org/cgi-bin/search?P=wireshark&DEFAULTOP=or&B=Gdebian-l10n-english&SORT=&HITSPERPAGE=10&xP=wireshark&xFILTERS=Gdebian-l10n-english%7E-%7E%7E4294967295

Yes, I've seen variants on this text passing through d-l-e every now
and then since 2009; details have changed but we haven't really looked
at the overall effect, and this new one introduces a few new slightly
obscure things at once.
 
> Please CC me on the replies, I'm not on this list.
> 
> I'll discuss the "scap" group name on debian-devel, just haven't got
> into it yet. I guess replacing the group name in the template would be
> fine without another round of language review.

Yes.  Meanwhile here are some ideas for a rewrite - inline commented
version plus attached actual diff file.  Comments?
 
 --- template.orig	2025-09-28 14:58:38.628690488 +0100
 +++ template	2025-09-29 10:14:25.122556373 +0100
 @@ -2,17 +2,17 @@
  Type: boolean
  Default: false
  _Description: Should non-superusers be able to capture system calls?

This phrasing is unsatisfying but so are the alternatives.

 - The falcodump external capture utility (extcap) can be installed in a
 - way that allows members of the "scap" system group to capture system
 - calls. This is recommended over the alternative of running Stratoshark
 - directly as root, because less of the code will run with elevated
 - privileges.
 + The falcodump external capture utility for Stratoshark can be

I'm assuming that anyone who already knows what an extcap is will
understand the long version, while the important thing for a user
reading this in the middle of a big batch of package installs is to
establish the context that it's a tool used by Stratoshark.

 + installed in a way that allows members of the "scap" system group
 + to capture system calls without needing to run Stratoshark directly
 + as root.

(Delaying some of this until later)

   .
   For more detailed information please see
 - /usr/share/doc/wireshark-common/README.Debian.
 + /usr/share/doc/wireshark-common/README.Debian.gz.

(In fact I mentioned this back in 2019, then forgot.)

   .
 - Enabling this feature may be a security risk, so it is disabled by
 - default. If in doubt, it is suggested to leave it disabled.
 + Using this feature has the security advantage that less of the code
 + will run with elevated privileges. However, since it makes the
 + "scap" group more security-sensitive it is disabled by default.

This version takes the approach of just summarising the pros and cons
and letting readers decide for themselves.
  
  Template: stratoshark/addgroup-failed
  Type: error
 @@ -26,7 +26,7 @@
  
  Template: stratoshark/group-is-user-group
  Type: error
 -_Description: The "scap" group is a system group
 +_Description: The "scap" group should be a system group

(Because the problem is that it *isn't* currently a system group.)

   The "scap" group exists as a user group, but the preferred
   configuration is for it to be created as a system group.
   .

-- 
JBR	with qualifications in linguistics, experience as a Debian
	sysadmin, and probably no clue about this particular package

--a3K6cN0EDr7dTwYi
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="template.diff"

--- template.orig	2025-09-28 14:58:38.628690488 +0100
+++ template	2025-09-29 10:14:25.122556373 +0100
@@ -2,17 +2,17 @@
 Type: boolean
 Default: false
 _Description: Should non-superusers be able to capture system calls?
- The falcodump external capture utility (extcap) can be installed in a
- way that allows members of the "scap" system group to capture system
- calls. This is recommended over the alternative of running Stratoshark
- directly as root, because less of the code will run with elevated
- privileges.
+ The falcodump external capture utility for Stratoshark can be
+ installed in a way that allows members of the "scap" system group
+ to capture system calls without needing to run Stratoshark directly
+ as root.
  .
  For more detailed information please see
- /usr/share/doc/wireshark-common/README.Debian.
+ /usr/share/doc/wireshark-common/README.Debian.gz.
  .
- Enabling this feature may be a security risk, so it is disabled by
- default. If in doubt, it is suggested to leave it disabled.
+ Using this feature has the security advantage that less of the code
+ will run with elevated privileges. However, since it makes the
+ "scap" group more security-sensitive it is disabled by default.
 
 Template: stratoshark/addgroup-failed
 Type: error
@@ -26,7 +26,7 @@
 
 Template: stratoshark/group-is-user-group
 Type: error
-_Description: The "scap" group is a system group
+_Description: The "scap" group should be a system group
  The "scap" group exists as a user group, but the preferred
  configuration is for it to be created as a system group.
  .

--a3K6cN0EDr7dTwYi--