Re: Re: [Zynot-pkgmgr] Repoteus: Zynot Tree Vision

On Monday 14 July 2003 15:37, Mark Guertin wrote:
> On 7/14/03 4:24 PM, "jesse" <[email protected]> wrote:
> > If they are isgned by our devs who are on your keyring .. then you
> > should be able to trust. Esp if it's got 2 or more valid sigs.
> >
> > Over any  distrib medium a package that had this requirement would be
> > considered pristine. You would be able to check those sigs agains
> > keyservers as well as your local copy of the pubkeys.you could trust
> > that package if all those check were ok.
> >
> > If random joe-schmo  builds a binary and pops it on p2portage signed. It
> > doesnt give it any more credability in the eyes of porteous. ( not part
> > of or keysystem ).
>
> That given I would still never allow this on my system, signed or not
> signed.  Also this would divert a lot of dev attention from working on the
> distro proper.. Instead they would be building (and yielding TONS of emails
> from users if they signed the builds as good and they are not).  I know
> this from experience doing this stuff with Gentoo.
>
> IMO this is something we should still avoid for now.
>
> If you haven't noticed I have problems with the whole concept of p2p
> distribution of anything for an operating system, and I am not alone on
> this stuff.
>
> If p2p ever gets implemented I for one will want HUGE guarantees that the
> option not only be able to be disabled, but that there also be a version of
> the pkgmgr that this option literally does not even exist in.  One user
> turning on something like this unchecked can have massive repercussions on
> a large LAN.  It goes against the grain in corporate environment in a very
> big way here.
>
> Potentially this could make M$ email virii look tame from a security
> standpoint...if one signed pkg gets compromised and distributed as trusted
> (signed) into a p2p system.  With p2p you have zero control after it has
> gotten into nodes, that compromised build could live forever, revoking or
> no.  At least on (semi) controlled mirrors we can properly revoke it if the
> need should ever arise.
>
> Mark
>
>
> _______________________________________________
> Zynaut mailing list
> [email protected]
> http://lists.zynot.org/mailman/listinfo/zynaut

	Just gonna add my thoughts.  I have a feeling that p2p implementation will be 
so much extra design, coding, and implementation getting it to work that it 
should be put off for now.  And I agree there should be an option to disable 
the filesharing when p2p source file sharing is implemented.  Being on dialup 
I suffer whenever I have to upload a file.  Normally I end up lagging out, 
the file stalls, and all the time was wasted anyway.  My internet connection 
would be virtually unusable if multiple cable users tried to download X or 
KDE from me (even in part).  And they'd likely never know, and I wouldn't 
have fun trying to figure out why google's front page takes 5 minutes to 
load.  

	I would REALLY like to see binary packages available.  Not for every package 
in the tree, but the base install (X and a few common WM also) at the least.  
Also it would be nice to have different CFLAGS for them.  Again, not 
everything.  i586, Pentium2, and Athlon for x86 would make many people happy.  
You can always run `nice -n 19 emerge -e world` in a screen or VC once you're 
in X and going about your thing and want "better" CFLAGS and never notice 
your box was working.  A 6 hour base install on the average speed box is 
enough to scare a lot of users away when they find out that's without Xfree.  
Basically the run down of how I think things will/should/could look soon:
Stage1 - Build it all yourself.
Stage2 - You have a compiler and a few libraries.
Stage3 - Working Non-X box (sans kernel)
Stage4 - Working X box with your choice of WM available as a seperate binary 
to keep the stage tarball size down (also no precompiled kernel)
Stage5 - Quick Install, bloated, bubblie crap that people new to the distro 
want to give it a quick try.  X, KDE/Gnome, desktop apps a plenty, prebuilt 
modularized kernel.  Basically whatever the devs can stuff in a 640/700MB 
ISO.  

	Yes, the "stage5" I recommend will be very large and use up much bandwidth, 
but most users will likely avoid ever downloading it.  Only those that need 
it to just get their box up and running quickly to try out Zynot (or whatever 
it will be called then) will pick this install method.  We could even look at 
something like jidgo (which debian uses to make CD-r and DVD-r ISOs) to 
create the "stage5" installer CDs on the fly from multiple source servers.  
The problem with jidgo is its complicated usage.  Ok  I'm starting to rant, 
so I'll stop on this unless anyone requests more out of me. :)

	This is probably getting way off-topic, but the last thing I'd like to 
suggest is a GUI installer.  If anyone can point me to the right place to 
read up and learn how to code widgets I'd like to get involved in a gtk2 
installer project that will make people think they're installing something 
officially better than RedHat because it's prettier and even easier ;) to 
install.

--Will (Sif/SanityInFlux - if you didn't know)