JBoss and Fedora

[Tim Spaulding]

What's going on with the JBoss acquisition?  Are there plans in place to get JBoss
packaged with
Fedora and released as an open source product?  Any insights?

Thanks,

tims


 
____________________________________________________________________________________
Sucker-punch spam with award-winning protection. 
Try the free Yahoo! Mail Beta.
http://advision.webevents.yahoo.com/mailbeta/features_spam.html

[John Poelstra]

Timothy Spaulding said the following on 04/05/2007 04:21 PM Pacific Time:
>  What's going on with the JBoss acquisition?  Are there plans in
> place to get JBoss packaged with
>  Fedora and released as an open source product?  Any insights?
>  
>  Thanks,
>  
>  tims
>   
Lots of stuff is already here: http://labs.jboss.com/portal/

[Nicolas Mailhot]

Le Ven 6 avril 2007 01:42, John Poelstra a écrit :
>  Timothy Spaulding said the following on 04/05/2007 04:21 PM Pacific
> Time:
> > What's going on with the JBoss acquisition?  Are there plans in place to
> > get JBoss packaged with
> > Fedora and released as an open source product?  Any insights? 
>  Lots of stuff is already here: http://labs.jboss.com/portal/ 
Nothing properly packaged in rpm form in a yum repo (what John asked for).
That's useless for people who don't want to hand-deploy their software
(and a big reason why java in general never took of under Linux)

John: you can't package JBoss properly if you don't package a JVM, Fedora
will only package FLOSS code and the consensus seems to be it's more
efficient to wait for the actual Java 7 SUN GPL release than make gcj
feature-complete enough for JBoss. If no JBoss packages appear in Fedora
after this JVM release, please yell.

In the meanwhile you can try the jpackage JBoss packaging.

Regards,

-- 
Nicolas Mailhot

[Andrew Haley]

Nicolas Mailhot writes:
>  
>  the consensus seems to be it's more efficient to wait for the
>  actual Java 7 SUN GPL release than make gcj feature-complete enough
>  for JBoss. 
Really?  The consensus among whom?  I wonder what that's based on.

Andrew.

-- 
Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, UK
Registered in England and Wales No. 3798903

[Nicolas Mailhot]

Le vendredi 06 avril 2007 à 11:07 +0100, Andrew Haley a écrit :
>  Nicolas Mailhot writes:
>   > 
>   > the consensus seems to be it's more efficient to wait for the
>   > actual Java 7 SUN GPL release than make gcj feature-complete enough
>   > for JBoss.
>  
>  Really?  The consensus among whom?  I wonder what that's based on. 
The consensus as expressed by the Fedora Java team on this list in the
past

-- 
Nicolas Mailhot

[Tim Spaulding]

If that is the case, why not just package Java 7 directly rather than make gcj
feature-complete? 
Are both Java 7 and gcj going to be available as part of the Fedora install?  Is there a
roadmap
wiki page that lays all this out somewhere?

Thanks,

tims

--- Nicolas Mailhot <nicolas.mailhot(a)laposte.net&gt; wrote:

>  Le vendredi 06 avril 2007 à 11:07 +0100, Andrew Haley a écrit :
>  > Nicolas Mailhot writes:
>  >  > 
>  >  > the consensus seems to be it's more efficient to wait for the
>  >  > actual Java 7 SUN GPL release than make gcj feature-complete enough
>  >  > for JBoss.
>  > 
>  > Really?  The consensus among whom?  I wonder what that's based on.
>  
>  The consensus as expressed by the Fedora Java team on this list in the
>  past
>  
>  -- 
>  Nicolas Mailhot
>  > -- 
>  fedora-devel-list mailing list
>  fedora-devel-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-devel-list 


 
____________________________________________________________________________________
8:00? 8:25? 8:40? Find a flick in no time 
with the Yahoo! Search movie showtime shortcut.
http://tools.search.yahoo.com/shortcuts/#news

[Jesse Keating]

On Friday 06 April 2007 07:07:06 Timothy Spaulding wrote:
>  If that is the case, why not just package Java 7 directly rather than
> make
>  gcj feature-complete? 
Because Java 7 is still not FLOSS enough.

-- 
Jesse Keating
Release Engineer: Fedora

[Oliver Falk]

On 04/06/2007 01:16 PM, Jesse Keating wrote:
>  On Friday 06 April 2007 07:07:06 Timothy Spaulding wrote:
> > If that is the case, why not just package Java 7 directly rather than make
> > gcj feature-complete?
>  
>  Because Java 7 is still not FLOSS enough. 
And when it finally is, it will be funny to build it under ppc, alpha or 
s390 :-) Will for sure make a lot of head-aches...

-of

[Nicolas Mailhot]

Le vendredi 06 avril 2007 à 13:23 +0200, Oliver Falk a écrit :
>  On 04/06/2007 01:16 PM, Jesse Keating wrote:
>  > On Friday 06 April 2007 07:07:06 Timothy Spaulding wrote:
>  >> If that is the case, why not just package Java 7 directly rather than make
>  >> gcj feature-complete?
>  > 
>  > Because Java 7 is still not FLOSS enough.
>  
>  And when it finally is, it will be funny to build it under ppc, alpha or 
>  s390 :-) Will for sure make a lot of head-aches... 
But will be very useful for people that don't want to learn the quirks
of a new jvm codebase every time they move from one arch to another

-- 
Nicolas Mailhot

[Rahul Sundaram]

Timothy Spaulding wrote:
>  If that is the case, why not just package Java 7 directly rather than
> make gcj feature-complete?  
Sun Java is not completely under a Free and open source license yet. 
There are still proprietary bits that needs to be replaced. This has 
been discussed in this list multiple times before. See the archives.

>  Are both Java 7 and gcj going to be available as part of the Fedora
> install? 
GCJ is already part of Fedora. When Sun Java is completely under a open 
source license, it will very like replace GCJ.

Rahul

Ps: Avoid top posting.

[Andrew Haley]

Nicolas Mailhot writes:
>  Le vendredi 06 avril 2007 à 11:07 +0100, Andrew Haley a écrit :
>  > Nicolas Mailhot writes:
>  >  > 
>  >  > the consensus seems to be it's more efficient to wait for the
>  >  > actual Java 7 SUN GPL release than make gcj feature-complete enough
>  >  > for JBoss.
>  > 
>  > Really?  The consensus among whom?  I wonder what that's based on.
>  
>  The consensus as expressed by the Fedora Java team on this list in the
>  past 
I could only find one posting under
site://www.redhat.com/archives/fedora-devel-list/site://www.redhat.com/ar...
jboss

-- 
Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, UK
Registered in England and Wales No. 3798903

[Andrew Haley]

Andrew Haley writes:
>  
>  I could only find one posting under
> site://www.redhat.com/archives/fedora-devel-list/site://www.redhat.com/ar...
> jboss 
This is obviously not true; I hit "send" before I'd finished composing
the message.  :-(

Andrew.

-- 
Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, UK
Registered in England and Wales No. 3798903

[Andrew Haley]

Nicolas Mailhot writes:
>  Le vendredi 06 avril 2007 à 11:07 +0100, Andrew Haley a écrit :
>  > Nicolas Mailhot writes:
>  >  > 
>  >  > the consensus seems to be it's more efficient to wait for the
>  >  > actual Java 7 SUN GPL release than make gcj feature-complete enough
>  >  > for JBoss.
>  > 
>  > Really?  The consensus among whom?  I wonder what that's based on.
>  
>  The consensus as expressed by the Fedora Java team on this list in the
>  past 
I doubt it.  I could only find one posting with the  Google query 
site://www.redhat.com/archives/fedora-devel-list/ jboss gcj
and that was from one "Nicolas Mailhot".

Andrew.

-- 
Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, UK
Registered in England and Wales No. 3798903

[Nicolas Mailhot]

Le vendredi 06 avril 2007 à 13:45 +0100, Andrew Haley a écrit :
>  Nicolas Mailhot writes:
>   > Le vendredi 06 avril 2007 à 11:07 +0100, Andrew Haley a écrit :
>   > > Nicolas Mailhot writes:
>   > >  > 
>   > >  > the consensus seems to be it's more efficient to wait for the
>   > >  > actual Java 7 SUN GPL release than make gcj feature-complete enough
>   > >  > for JBoss.
>   > > 
>   > > Really?  The consensus among whom?  I wonder what that's based on.
>   > 
>   > The consensus as expressed by the Fedora Java team on this list in the
>   > past
>  
>  I doubt it.  I could only find one posting with the  Google query 
>  site://www.redhat.com/archives/fedora-devel-list/ jboss gcj
>  and that was from one "Nicolas Mailhot". 
Then it was on one of the other Linux & Java technical lists
(fedora-maintainers, fedora-extras, fedora-devel-java,
jpackage-discuss(a)zarb.org). Java team members participate in many
different public forums, and I won't pretend I track each of their
messages.

If you deem gcj ready for JBoss feel free to submit a set of JBoss
packages. I certainly won't stop you. You can take the jpackage rpms as
starting point (though now JBoss is Red Hat the submission should
probably come from the JBoss division itself)

-- 
Nicolas Mailhot

[Andrew Haley]

Nicolas Mailhot writes:
>  Le vendredi 06 avril 2007 à 13:45 +0100, Andrew Haley a écrit :
>  > Nicolas Mailhot writes:
>  >  > Le vendredi 06 avril 2007 à 11:07 +0100, Andrew Haley a écrit :
>  >  > > Nicolas Mailhot writes:
>  >  > >  > 
>  >  > >  > the consensus seems to be it's more efficient to wait for the
>  >  > >  > actual Java 7 SUN GPL release than make gcj feature-complete
> enough
>  >  > >  > for JBoss.
>  >  > > 
>  >  > > Really?  The consensus among whom?  I wonder what that's based on.
>  >  > 
>  >  > The consensus as expressed by the Fedora Java team on this list in the
>  >  > past
>  > 
>  > I doubt it.  I could only find one posting with the  Google query 
>  > site://www.redhat.com/archives/fedora-devel-list/ jboss gcj
>  > and that was from one "Nicolas Mailhot".
>  
>  Then it was on one of the other Linux & Java technical lists
>  (fedora-maintainers, fedora-extras, fedora-devel-java,
>  jpackage-discuss(a)zarb.org). Java team members participate in many
>  different public forums, and I won't pretend I track each of their
>  messages. 
It seems this consensus is rather fleeting.

>  If you deem gcj ready for JBoss feel free to submit a set of JBoss
>  packages. 
I'll be sure to let you know.

Andrew.

-- 
Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, UK
Registered in England and Wales No. 3798903

[Nicolas Mailhot]

Le vendredi 06 avril 2007 à 16:35 +0100, Andrew Haley a écrit :

>  It seems this consensus is rather fleeting. 
Maybe. Or maybe not. I may not remember exactly where I saw people @rh
writing JBoss wouldn't happen before Sun Java 1.7, but I definitely
never saw any message that claimed "we will package JBoss with gcj and
push it to fedora-devel". And despite all your prodding I'm not seeing
it still¹. In fact I don't remember anyone @rh ever posting there and
writing "I'm x from the JBoss division, we're planing Y for Fedora"

¹ Like it was done for FDS

-- 
Nicolas Mailhot

[Mark Wielaard]

Nicolas Mailhot <nicolas.mailhot <at> laposte.net> writes:
>  I may not remember exactly where I saw people  <at> rh
>  writing JBoss wouldn't happen before Sun Java 1.7, but I definitely
>  never saw any message that claimed "we will package JBoss with gcj and
>  push it to fedora-devel". And despite all your prodding I'm not seeing
>  it still¹. In fact I don't remember anyone  <at> rh ever posting there and
>  writing "I'm x from the JBoss division, we're planing Y for Fedora"
It would help if you could remember since it seems nobody else
remembers it and I follow a couple of fedora and java lists and
have also not seen such statements (all statements I have seen
say the opposite). But if people say that then we aren't coordinating
enough and it would help to get everybody up to date on the various
plans around libre-java, fedora, jboss and the rest.

And why should it have to come from @rh and/or the JBoss division?
We are a team here trying to work together. I know JBoss was
featured in the original planning items for libre-java on Fedora 7
last year.

http://www.redhat.com/archives/fedora-devel-java-list/2006-December/msg00...

And yes it is an optional item because we know it is a lot of work.
But why do you not help out, Fedora is not just about what @rh says
will be in there. Even though I have never seen any @rh say that it
wouldn't. All emails from @rh on the various lists seem to indicate
that they would like to see this sooner rather than later and they
are hard at work making it possible. And if you help out it will
happen sooner!

Thanks,

Mark

[Nicolas Mailhot]

Le vendredi 06 avril 2007 à 17:04 +0000, Mark Wielaard a écrit :

>  And why should it have to come from @rh and/or the JBoss division?
>  We are a team here trying to work together. 
Because we all know/hope Red Hat has an internal plan for his own
software, and collisions between such internal plans and community
efforts in the past have not been pretty? You get the usual maintainer
protectiveness plus the corporate / volunteer barrier.

-- 
Nicolas Mailhot

[Jesse Keating]

On Friday 06 April 2007 13:44:40 Nicolas Mailhot wrote:
>  Because we all know/hope Red Hat has an internal plan for his own
>  software, and collisions between such internal plans and community
>  efforts in the past have not been pretty? You get the usual maintainer
>  protectiveness plus the corporate / volunteer barrier. 
That's assuming that every part of Red Hat has the same plan / goal as every 
other part of Red Hat, and that isn't always the case.  The JBoss folks have 
a goal to continue delivering things to their existing customers that they 
were before RH acquired them.  Fedora has a different set of goals, which 
involves native packaging of JBOSS software for use on Fedora.  These are 
just two examples of what the two groups might have for goals.  There are 
many many others, and surprise, some of them may directly conflict.  
Thankfully different people will be working on them differently and there is 
a chance that these goals may be achieved.

-- 
Jesse Keating
Release Engineer: Fedora

[seth vidal]

On Fri, 2007-04-06 at 13:53 -0400, Jesse Keating wrote:
>  On Friday 06 April 2007 13:44:40 Nicolas Mailhot wrote:
>  > Because we all know/hope Red Hat has an internal plan for his own
>  > software, and collisions between such internal plans and community
>  > efforts in the past have not been pretty? You get the usual maintainer
>  > protectiveness plus the corporate / volunteer barrier.
>  
>  That's assuming that every part of Red Hat has the same plan / goal as every 
>  other part of Red Hat, and that isn't always the case.  The JBoss folks have 
>  a goal to continue delivering things to their existing customers that they 
>  were before RH acquired them.  Fedora has a different set of goals, which 
>  involves native packaging of JBOSS software for use on Fedora.  These are 
>  just two examples of what the two groups might have for goals.  There are 
>  many many others, and surprise, some of them may directly conflict.  
>  Thankfully different people will be working on them differently and there is 
>  a chance that these goals may be achieved.
>   
I think a fair goal for fedora that we won't get any objection on is
this:

if it is free software and legal to ship then we are for including it.

If jboss can be packaged to work with gcj in that way, then there is no
reason to oppose it.

If someone can come up with a compelling reason why we should not follow
the above then, by all means, come and talk about it.

-sv

[Jef Spaleta]

On 4/6/07, Nicolas Mailhot <nicolas.mailhot(a)laposte.net&gt; wrote:
>  Because we all know/hope Red Hat has an internal plan for his own
>  software, and collisions between such internal plans and community
>  efforts in the past have not been pretty? You get the usual maintainer
>  protectiveness plus the corporate / volunteer barrier. 
yes, the last thing I want to see is a external contributor led
packaging effort which will be superceded by an internal push 6 months
to 1 year out.  I'd like to see jboss team take a leading role in
managing the available volunteer labor pool for the integration
process by proposing a public timeline for integration into fedora (if
they haven't already), including some very specific action items for
community volunteers to work on appropriate in the timeline.  If jboss
isn't ready for packaging now, that should be obvious from the action
item schedule in a public timeline as seen by the driving group of
internal developers.

-jef"

[Nicolas Mailhot]

Also :
- as a volunteer I don't want to be caught in internal Red Hat
crossfire. (I know probably as well as you how internal politics play
out in big corporations)
- as a Red Hat & JBoss customer I expect the JBoss and Red Hat divisions
talk to each other, and have the JBoss folks support what I find in
Fedora and RHEL. And also be able to point my R&D folks to Fedora and
have the result work in next years RHEL without retooling

Please make sure other Red Hat entities are in the look before inciting
community members to serve as cannon fodder.

-- 
Nicolas Mailhot

[Tom Tromey]

> >>>> "Nicolas" == Nicolas Mailhot
> <nicolas.mailhot(a)laposte.net&gt; writes: 
> > > the consensus seems to be it's more efficient to wait
> for the
> > > actual Java 7 SUN GPL release than make gcj feature-complete enough
> > > for JBoss.
> > 
> > Really?  The consensus among whom?  I wonder what that's based on. 
Nicolas> The consensus as expressed by the Fedora Java team on this
Nicolas> list in the past

I don't remember that.  Anyway what Andrew doesn't say is that much of
JBoss is working:

    http://thread.gmane.org/gmane.linux.redhat.fedora.java/2150

Tom

[Mark Wielaard]

Nicolas Mailhot <nicolas.mailhot <at> laposte.net> writes:
>  Le vendredi 06 avril 2007 à 11:07 +0100, Andrew Haley a écrit :
>  > Nicolas Mailhot writes:
>  >  > 
>  >  > the consensus seems to be it's more efficient to wait for the
>  >  > actual Java 7 SUN GPL release than make gcj feature-complete enough
>  >  > for JBoss.
>  > 
>  > Really?  The consensus among whom?  I wonder what that's based on.
>  
>  The consensus as expressed by the Fedora Java team on this list in the
>  past 
I cannot remember that being the consensus. Which team member said that? Are you
sure you are speaking for all the hackers that work on libre java for Fedora?

Sure, if Sun manages to release their full java implementation under the GPL
that will be great. But they have already said that won't happen, there are
parts they will just not be able to liberate because their "partners" won't
let
them. Most parts will and I am sure the community will try to help out with
liberating the encumbered parts. We had a pretty constructive meeting at Fosdem
to discuss some upcoming issues:
http://www.fosdem.org/2007/schedule/tracks/gnuclasspathopenjdkdevjam

But at the same time we need to support our current users, we care about more
platforms than just x86/x86_64 that Sun might deliver. And the work on fedora,
gcj and jboss is in full gear:
http://gnu.wildebeest.org/diary/2007/03/30/fedora-7-test-3/
http://gnu.wildebeest.org/diary/2007/04/04/gcj-jboss-ahoy/

Cheers,

Mark

[Fernando Nasser]

Timothy Spaulding wrote:
>  What's going on with the JBoss acquisition?  Are there plans in
> place to get JBoss packaged with
>  Fedora and released as an open source product?  Any insights?
>   
This is a multipart question:

1) Open source

It always has been, as far as I remember at least

2) Packaged as RPMs

Available since times immemorial at www.jpackage.org

3) Fedora

Although you can use the JPackage.org RPMs with proprietary JDKs (maybe 
even with GCJ, I haven't tried), what you want is a set of RPMs 
pre-compiled with GCJ and bundled with Fedora.

While I can't tell if that is in the plans, I can tell that it needs 
maven2 and that will come in Fedora 7.  So, at least for Fedora 7+ there 
is hoe.  For FC6 and previous there is no chance.


Regards,
Fernando

httpd installed by default on desktops! bad gnome-user-share, bad!

[Matthew Miller]

Here's my thought process this morning....

 0) Why is the Apache web server installed on this desktop?
 1) Hmmm -- gnome-user-share depends on httpd.
 2) gnome-user-share is in the Gnome Desktop Environment group by default.
 3) Having httpd pulled in by default for a desktop install is bad.
 4) Fortunately, httpd doesn't start by default.
 5) But in that case, really, what's the point anyway?
 6) Or, wait: the gnome-user-share readme file says "when file sharing is 
    enabled a webdav server is started.
 7) Oh god, this thing spawns an Apache httpd subprocess.
 8) Seriously.
 9) Hey, I know! Here's a gun. Let's shoot our users in the feet some more.
10) Dance, end users, dance!

Seriously, easy file sharing is nifty and all, but this is just asking for
it. Please, we need to stop installing this by default. Think of the
children.

<https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235682>

-- 
Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>

httpd installed by default on desktops! bad gnome-user-share, bad!

[Jesse Keating]

On Monday 09 April 2007 11:57:40 Matthew Miller wrote:
>  Seriously, easy file sharing is nifty and all, but this is just
> asking for
>  it. Please, we need to stop installing this by default. Think of the
>  children. 
Perhaps this conversation belongs in upstream gnome, but it starts an http 
session AS the user for the specific directory the user wants to share.  
Other than the knee jerk "OMG http is running!" reactions, what is the major 
problem here?

-- 
Jesse Keating
Release Engineer: Fedora

httpd installed by default on desktops! bad gnome-user-share, bad!

[Jon Ciesla]

+1.  If the nailgun is unplugged, in the box, and the nails are in a
separate box, why not ship them?  Provide the functionality, but in a safe
manner.  Is this not the current state?

>  On Monday 09 April 2007 11:57:40 Matthew Miller wrote:
> > Seriously, easy file sharing is nifty and all, but this is just asking
> > for
> > it. Please, we need to stop installing this by default. Think of the
> > children.
>
>  Perhaps this conversation belongs in upstream gnome, but it starts an http
>  session AS the user for the specific directory the user wants to share.
>  Other than the knee jerk "OMG http is running!" reactions, what is the
>  major
>  problem here?
>
>  --
>  Jesse Keating
>  Release Engineer: Fedora
>  --
>  fedora-devel-list mailing list
>  fedora-devel-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-devel-list 

-- 
novus ordo absurdum

httpd installed by default on desktops! bad gnome-user-share, bad!

[Matthew Miller]

On Mon, Apr 09, 2007 at 11:10:52AM -0500, Jon Ciesla wrote:
>  +1.  If the nailgun is unplugged, in the box, and the nails are in a
>  separate box, why not ship them?  Provide the functionality, but in a safe
>  manner.  Is this not the current state? 
a) It's really easy to turn on without recognizing the implications.
b) It's fairly easy to turn on full httpd without recognizing the
   implications.
c) The most secure code is the code that's not on the box.
d) Having a) means that it's more difficult to notice when b) happens.


-- 
Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>

httpd installed by default on desktops! bad gnome-user-share, bad!

[Jon Ciesla]

>  On Mon, Apr 09, 2007 at 11:10:52AM -0500, Jon Ciesla wrote:
> > +1.  If the nailgun is unplugged, in the box, and the nails are in a
> > separate box, why not ship them?  Provide the functionality, but in a
> > safe
> > manner.  Is this not the current state?
>
>  a) It's really easy to turn on without recognizing the implications.
>  b) It's fairly easy to turn on full httpd without recognizing the
>     implications.
>  c) The most secure code is the code that's not on the box.
>  d) Having a) means that it's more difficult to notice when b) happens. 
Can a) occur without root access?  If not, I don't think it's a huge
issue.    I can also turn on telnetd with root, or NFS share / with root,
also failry easily.  But they're secured by default as well.  IF we're
going to go down the path of removing software that's "Too dangerous" for
users, why ship Perl?

If a) is possible without root, then we do have an issue, as long as it
allow access to system data.  If it's just the user's data, then, well,
isn't that the point?

>  --
>  Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
>  Boston University Linux      ------>              <http://linux.bu.edu/>
>
>  --
>  fedora-devel-list mailing list
>  fedora-devel-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-devel-list
>  

-- 
novus ordo absurdum

httpd installed by default on desktops! bad gnome-user-share, bad!

[Matthew Miller]

On Mon, Apr 09, 2007 at 11:45:07AM -0500, Jon Ciesla wrote:
>  Can a) occur without root access?  If not, I don't think it's
> a huge
>  issue.    I can also turn on telnetd with root, or NFS share / with root, 
         
                     ^^^^^^^^^^^^^^^^^

Guess what we don't ship by default.



-- 
Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>

httpd installed by default on desktops! bad gnome-user-share, bad!

[Jon Ciesla]

Point taken.  But my question stands, isn't root required to do something
REALLY stupid?  It should be.  I think if that's met we're as safe as we
can reasonably be, if WebDAV sharing provides helpful functionality.

I don't know, I've never used it.

>  On Mon, Apr 09, 2007 at 11:45:07AM -0500, Jon Ciesla wrote:
> > Can a) occur without root access?  If not, I don't think it's a huge
> > issue.    I can also turn on telnetd with root, or NFS share / with
> > root,
>                                 ^^^^^^^^^^^^^^^^^
>
>  Guess what we don't ship by default.
>
>
>
>  --
>  Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
>  Boston University Linux      ------>              <http://linux.bu.edu/>
>  

-- 
novus ordo absurdum

httpd installed by default on desktops! bad gnome-user-share, bad!

[Matthew Miller]

On Mon, Apr 09, 2007 at 11:50:06AM -0500, Jon Ciesla wrote:
>  Point taken.  But my question stands, isn't root required to do
> something
>  REALLY stupid?  It should be.  I think if that's met we're as safe as we
>  can reasonably be, if WebDAV sharing provides helpful functionality.
>  I don't know, I've never used it. 
I guess I'd be somewhat mollified if the apache server configuration were
broken out from whatever is needed to run this package. And hey, that'd be a
size win too.


-- 
Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>

httpd installed by default on desktops! bad gnome-user-share, bad!

[Jon Ciesla]

That'd be great.  Is it possible?  It looks like it currently calls the
httpd binary using a config file in /usr/share/gnome-user-share/.

It looks like all it uses from the httpd package is the binary, but the
config isn't split out into a separate RPM.  You could take it up with the
Apache maintainer.  The thing is, then what happens when I wan to set up a
host as a web server?  I install httpd, move files to /var/www/html/foo
and fire it up, and nothing works.  Maybe move the httpd binary to
httpd-something and keep the rest in httpd, with the config, then change
the g-u-s R to httpd-something.

Just my $0.02.

>  On Mon, Apr 09, 2007 at 11:50:06AM -0500, Jon Ciesla wrote:
> > Point taken.  But my question stands, isn't root required to do
> > something
> > REALLY stupid?  It should be.  I think if that's met we're as safe as we
> > can reasonably be, if WebDAV sharing provides helpful functionality.
> > I don't know, I've never used it.
>
>  I guess I'd be somewhat mollified if the apache server configuration were
>  broken out from whatever is needed to run this package. And hey, that'd be
>  a
>  size win too.
>
>
>  --
>  Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
>  Boston University Linux      ------>              <http://linux.bu.edu/>
>  

-- 
novus ordo absurdum

httpd installed by default on desktops! bad gnome-user-share, bad!

[Mark]

i was also wondering WHY the httpd package was installed.. now it isn`t much
of a problem for me because i play alot with httpd and php anyway so i need
it but still it`s installed... for nothing on the other users.

BTW that`s not the only thing where gnome-user-share depends on.. here is
the full list (that would be if you only install fedora with the pure
basics) everything in the list below that`s depends on httpd can be removed
if (obviously) httpd wasn`t installed. and those are: atleast 5 rpms.

Packages needed for: gnome-user-share (x86_64)

GConf2 - required for: gnome-user-share
ORBit2 - required for: GConf2
libIDL - required for: ORBit2
glibc - required for: libIDL
glibc-common - required for: glibc
tzdata - required for: glibc-common
-- basesystem - required for: glibc
-- setup - required for: basesystem
---- filesystem - required for: basesystem
---- libgcc - required for: glibc
-- glib2 - required for: libIDL
-- openldap - required for: GConf2
-- openssl - required for: openldap
-- e2fsprogs-libs - required for: openssl
-- device-mapper-libs - required for: e2fsprogs-libs
-- libselinux - required for: device-mapper-libs
-- libsepol - required for: libselinux
---- mcstrans - required for: libselinux
---- libcap - required for: mcstrans
---- krb5-libs - required for: openssl
---- grep - required for: krb5-libs
---- pcre - required for: grep
---- libstdc++ - required for: pcre
------ coreutils - required for: krb5-libs
------ pam - required for: coreutils
------ audit-libs - required for: pam
-------- cracklib - required for: pam
---------- cracklib-dicts - required for: pam
------------ mktemp - required for: pam
-------------- sed - required for: pam
------ zlib - required for: openssl
---- cyrus-sasl-lib - required for: openldap
---- libxml2 - required for: GConf2
-- httpd - required for: gnome-user-share
-- gawk - required for: httpd
---- initscripts - required for: httpd
---- SysVinit - required for: initscripts
------ bash - required for: initscripts
------ ncurses - required for: bash
-------- udev - required for: initscripts
-------- MAKEDEV - required for: udev
---------- libvolume_id - required for: udev
---------- e2fsprogs - required for: initscripts
---------- device-mapper - required for: e2fsprogs
------------ ethtool - required for: initscripts
-------------- mingetty - required for: initscripts
---------------- module-init-tools - required for: initscripts
------------------ util-linux - required for: initscripts
------------------ ConsoleKit-libs - required for: util-linux
------------------ dbus - required for: ConsoleKit-libs
------------------ chkconfig - required for: dbus
-------------------- expat - required for: dbus
---------------------- libxml2-python - required for: dbus
---------------------- python - required for: libxml2-python
---------------------- bzip2-libs - required for: python
------------------------ db4 - required for: python
-------------------------- gdbm - required for: python
---------------------------- python-libs - required for: python
------------------------------ readline - required for: python
-------------------------------- sqlite - required for: python
-------------------- popt - required for: util-linux
-------------------- net-tools - required for: initscripts
---------------------- syslog-ng - required for: initscripts
---------------------- eventlog - required for: syslog-ng
------------------------ tcp_wrappers-libs - required for: syslog-ng
-------------------------- logrotate - required for: syslog-ng
------------------------ sysklogd - required for: initscripts
------ apr - required for: httpd
-------- apr-util - required for: httpd
---- libX11 - required for: gnome-user-share
---- libXau - required for: libX11
------ libXdmcp - required for: libX11
-------- xorg-x11-filesystem - required for: libX11
------ atk - required for: gnome-user-share
-------- avahi - required for: gnome-user-share
-------- dbus-python - required for: avahi
-------- dbus-glib - required for: dbus-python
---------- libdaemon - required for: avahi
---------- avahi-glib - required for: gnome-user-share
------------ cairo - required for: gnome-user-share
------------ libXrender - required for: cairo
-------------- fontconfig - required for: cairo
-------------- freetype - required for: fontconfig
---------------- libpng - required for: cairo
-------------- gtk2 - required for: gnome-user-share
-------------- hicolor-icon-theme - required for: gtk2
---------------- libXcursor - required for: gtk2
---------------- libXfixes - required for: libXcursor
------------------ libXext - required for: gtk2
-------------------- libXi - required for: gtk2
---------------------- libXinerama - required for: gtk2
------------------------ libXrandr - required for: gtk2
-------------------------- cups-libs - required for: gtk2
-------------------------- gnutls - required for: cups-libs
-------------------------- libgcrypt - required for: gnutls
-------------------------- libgpg-error - required for: libgcrypt
---------------------------- libjpeg - required for: cups-libs
------------------------------ libtiff - required for: cups-libs
---------------------------- pango - required for: gtk2
---------------------------- libXft - required for: pango
------------------------------ libthai - required for: pango
---------------- libglade2 - required for: gnome-user-share

Total RPMS to install: 102

2007/4/9, Jon Ciesla <limb(a)jcomserv.net&gt;:
>  That'd be great.  Is it possible?  It looks like it currently calls the
>  httpd binary using a config file in /usr/share/gnome-user-share/.
>
>  It looks like all it uses from the httpd package is the binary, but the
>  config isn't split out into a separate RPM.  You could take it up with the
>  Apache maintainer.  The thing is, then what happens when I wan to set up a
>  host as a web server?  I install httpd, move files to /var/www/html/foo
>  and fire it up, and nothing works.  Maybe move the httpd binary to
>  httpd-something and keep the rest in httpd, with the config, then change
>  the g-u-s R to httpd-something.
>
>  Just my $0.02.
>
>  > On Mon, Apr 09, 2007 at 11:50:06AM -0500, Jon Ciesla wrote:
>  >> Point taken.  But my question stands, isn't root required to do
>  >> something
>  >> REALLY stupid?  It should be.  I think if that's met we're as safe as
>  we
>  >> can reasonably be, if WebDAV sharing provides helpful functionality.
>  >> I don't know, I've never used it.
>  >
>  > I guess I'd be somewhat mollified if the apache server configuration
>  were
>  > broken out from whatever is needed to run this package. And hey, that'd
>  be
>  > a
>  > size win too.
>  >
>  >
>  > --
>  > Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
>  > Boston University Linux      ------>              <http://linux.bu.edu/>
>  >
>
>
>  --
>  novus ordo absurdum
>
>  --
>  fedora-devel-list mailing list
>  fedora-devel-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-devel-list
>

httpd installed by default on desktops! bad gnome-user-share, bad!

[Nicolas Mailhot]

Le lundi 09 avril 2007 à 12:14 -0500, Jon Ciesla a écrit :
>  That'd be great.  Is it possible?  It looks like it currently
> calls the
>  httpd binary using a config file in /usr/share/gnome-user-share/. 
OMG, can't the package just drop the right file in /etc/httpd/conf.d ?
Or is the Gnome track record on daemons so good we'll let it pilot
apache now ?

I'm not afraid of apache as a dep, or apache running as daemon, as long
as it's done in an industrial way by people who understand this stuff.
Gnome daemons just seem to take 20 times the maintenance of good old
daemons like apache or postfix.

-- 
Nicolas Mailhot

httpd installed by default on desktops! bad gnome-user-share, bad!

[Matthew Miller]

On Mon, Apr 09, 2007 at 12:06:14PM -0400, Jesse Keating wrote:
>  Perhaps this conversation belongs in upstream gnome, but it starts an
> http 
>  session AS the user for the specific directory the user wants to share.  
>  Other than the knee jerk "OMG http is running!" reactions, what is the major 
>  problem here? 
We've come a long way in reducing out-of-the-box vulnerabilities in Fedora
since the Red Hat Linux days. SE Linux and other "overlay" security measures
are good, but the major factor is: don't install complicated network servers
by default. This is serious backsliding.

We can count on everyone applying security updates for supported releases.
(Of course we can!) But, every couple of days someone on fedora-list posts
questions about Fedora Core 4 or older. "It works fine, I can't bother to
upgrade right now." The more stuff like this we ship, the more those people
are going to be part of botnets.

We can say "tough, their problem" -- just like historically a certain big OS
vendor I hate to bring into the conversation for Godwin's law-related
reasons -- but that's irresponsible. If we stop caring about this issue,
it's only a matter of time before "Linux Security Worse than Proprietary OS
/ Linux-based Worm Brings Down The Internets!" is the headline news -- and
it'll be right.


-- 
Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>

httpd installed by default on desktops! bad gnome-user-share, bad!

[Owen Taylor]

On Mon, 2007-04-09 at 12:34 -0400, Matthew Miller wrote:
>  On Mon, Apr 09, 2007 at 12:06:14PM -0400, Jesse Keating wrote:
>  > Perhaps this conversation belongs in upstream gnome, but it starts an http 
>  > session AS the user for the specific directory the user wants to share.  
>  > Other than the knee jerk "OMG http is running!" reactions, what is the
> major 
>  > problem here?
>  
>  We've come a long way in reducing out-of-the-box vulnerabilities in Fedora
>  since the Red Hat Linux days. SE Linux and other "overlay" security measures
>  are good, but the major factor is: don't install complicated network servers
>  by default. This is serious backsliding.
>  
>  We can count on everyone applying security updates for supported releases.
>  (Of course we can!) But, every couple of days someone on fedora-list posts
>  questions about Fedora Core 4 or older. "It works fine, I can't bother to
>  upgrade right now." The more stuff like this we ship, the more those people
>  are going to be part of botnets.
>  
>  We can say "tough, their problem" -- just like historically a certain big OS
>  vendor I hate to bring into the conversation for Godwin's law-related
>  reasons -- but that's irresponsible. If we stop caring about this issue,
>  it's only a matter of time before "Linux Security Worse than Proprietary OS
>  / Linux-based Worm Brings Down The Internets!" is the headline news -- and
>  it'll be right. 
Would you be happier if turning on file sharing started a custom-written
HTTP server hacked up just for the purpose?

 If so, why?

 If not, what's the problem? (*)

The long-standing policy is that installing httpd doesn't start httpd
as a system service, so in either case, we are talking about a server
process running as the user serving a very limited set of files. The
only difference I see is that using Apache HTTP, we use a much more
tested and mature code base.

						- Owen

(*) Saying that user file sharing is a bad idea and shouldn't have been
    done to begin with isn't a useful response here.

httpd installed by default on desktops! bad gnome-user-share, bad!

[Matthew Miller]

On Mon, Apr 09, 2007 at 03:50:56PM -0400, Owen Taylor wrote:
>  Would you be happier if turning on file sharing started a
> custom-written
>  HTTP server hacked up just for the purpose?
>   If so, why? 
Clearly not.

>   If not, what's the problem? (*) 
It's bringing in more than it should.


-- 
Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>

httpd installed by default on desktops! bad gnome-user-share, bad!

[Arthur Pemberton]

On 4/9/07, Matthew Miller <mattdm(a)mattdm.org&gt; wrote:
>  On Mon, Apr 09, 2007 at 03:50:56PM -0400, Owen Taylor wrote:
>  > Would you be happier if turning on file sharing started a custom-written
>  > HTTP server hacked up just for the purpose?
>  >  If so, why?
>
>  Clearly not.
>
>  >  If not, what's the problem? (*)
>
>  It's bringing in more than it should. 
I don't care either way since I don't use Gnome, but have you made any
recommendations? Or is your recommendation to _not_ include
gnome-user-share by default?

I have to say though, I think Apache is a fairly secure piece of
software. Esp. by it's lonesome, sans CGI.


-- 
Fedora Core 6 and proud

httpd installed by default on desktops! bad gnome-user-share, bad!

[Matthew Miller]

On Mon, Apr 09, 2007 at 03:14:28PM -0500, Arthur Pemberton wrote:
>  I don't care either way since I don't use Gnome, but have you
> made any
>  recommendations? Or is your recommendation to _not_ include
>  gnome-user-share by default? 
  
I don't care either way, but I like to drop into threads and ask people
whether they said things in other posts in the thread rather than actually
reading to see.

-- 
Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>

httpd installed by default on desktops! bad gnome-user-share, bad!

[Arthur Pemberton]

On 4/9/07, Matthew Miller <mattdm(a)mattdm.org&gt; wrote:
>  On Mon, Apr 09, 2007 at 03:14:28PM -0500, Arthur Pemberton wrote:
>  > I don't care either way since I don't use Gnome, but have you made any
>  > recommendations? Or is your recommendation to _not_ include
>  > gnome-user-share by default?
>
>
>  I don't care either way, but I like to drop into threads and ask people
>  whether they said things in other posts in the thread rather than actually
>  reading to see.
>  
Being a bit aggressive aren't you? I read through the entire thread.

-- 
Fedora Core 6 and proud

httpd installed by default on desktops! bad gnome-user-share, bad!

[Jason L Tibbitts III]

> >>>> "MM" == Matthew Miller
> <mattdm(a)mattdm.org&gt; writes: 
MM> Why is the Apache web server installed on this desktop?

May I suggest a shorter route to the answer?

1) htpasswd is an essential end-user command line tool which the httpd
   maintainer refuses to break out into a separate package.

 - J<

[Andrew Haley]

Fernando Nasser writes:
>  Timothy Spaulding wrote:
>  > What's going on with the JBoss acquisition?  Are there plans in place to get
> JBoss packaged with
>  > Fedora and released as an open source product?  Any insights?
>  > 
>  
>  This is a multipart question:
>  
>  1) Open source
>  
>  It always has been, as far as I remember at least
>  
>  2) Packaged as RPMs
>  
>  Available since times immemorial at www.jpackage.org
>  
>  3) Fedora
>  
>  Although you can use the JPackage.org RPMs with proprietary JDKs (maybe 
>  even with GCJ, I haven't tried), what you want is a set of RPMs 
>  pre-compiled with GCJ and bundled with Fedora.
>  
>  While I can't tell if that is in the plans, I can tell that it needs 
>  maven2 and that will come in Fedora 7.  So, at least for Fedora 7+ there 
>  is hoe.  For FC6 and previous there is no chance. 
Seems reasonable.  Actually building JBoss from source will be harder
than running it from the tarballs available from
http://labs.jboss.com/portal/ .  gcj isn't missing anything that JBoss
requires, but there are bugs in gcj's class library that need first to
be fixed.

Andrew.

-- 
Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, UK
Registered in England and Wales No. 3798903