2:05 a.m.
About three weeks ago, I've run into multiple package review requests
being marked FE_NEEDSPONSOR by a person who is a sponsored already
with a different email address [at Red Hat]:
http://bugzilla.redhat.com/554234#c6
Sometimes FE_NEEDSPONSOR is set by mistake, because submitters
misunderstand the purpose of that extra tracking and think packages
need a sponsor. I've removed the tracking links from the review tickets
and have asked for clarification.
According to yesterday's reply, the person really wants to create a second
account. Whatever the full plan may be, so far it only creates confusion.
--
Michael Schwendt
Fedora release 12 (Constantine) - Linux 2.6.32.7-37.fc12.i686.PAE
http://mschwendt.fedorapeople.org/staticbugstat.html
2:24 a.m.
On Tue, 2010-02-02 at 09:05 +0100, Michael Schwendt wrote:
About three weeks ago, I've run into multiple package review
requests
being marked FE_NEEDSPONSOR by a person who is a sponsored already
with a different email address [at Red Hat]:
http://bugzilla.redhat.com/554234#c6
Sometimes FE_NEEDSPONSOR is set by mistake, because submitters
misunderstand the purpose of that extra tracking and think packages
need a sponsor. I've removed the tracking links from the review tickets
and have asked for clarification.
According to yesterday's reply, the person really wants to create a second
account. Whatever the full plan may be, so far it only creates confusion.
How convenient. I could review my own packages.. and take over Fedora!
*manic laughter*
--
Jussi Lehtola
Fedora Project Contributor
jussilehtola(a)fedoraproject.org
3:59 a.m.
I would refuse to allow two accounts.
On Tue, 2010-02-02 at 09:05 +0100, Michael Schwendt wrote:
According to yesterday's reply, the person really wants to create a second
account. Whatever the full plan may be, so far it only creates confusion.
--
Michael Schwendt
Fedora release 12 (Constantine) - Linux 2.6.32.7-37.fc12.i686.PAE
http://mschwendt.fedorapeople.org/staticbugstat.html
8:25 a.m.
On Tue, 2 Feb 2010, Michael Schwendt wrote:
About three weeks ago, I've run into multiple package review
requests
being marked FE_NEEDSPONSOR by a person who is a sponsored already
with a different email address [at Red Hat]:
http://bugzilla.redhat.com/554234#c6
Sometimes FE_NEEDSPONSOR is set by mistake, because submitters
misunderstand the purpose of that extra tracking and think packages
need a sponsor. I've removed the tracking links from the review tickets
and have asked for clarification.
According to yesterday's reply, the person really wants to create a second
account. Whatever the full plan may be, so far it only creates confusion.
http://fedoraproject.org/wiki/Infrastructure/AccountSystem#Account_Termin...
Specifically: "Individuals using multiple accounts without prior written
approval will have all but one account terminated. "
-Mike
8:51 a.m.
On Tue, 2 Feb 2010, Mike McGrath wrote:
Specifically: "Individuals using multiple accounts without prior
written
approval will have all but one account terminated. "
And what does that matter when everyone can create enough nick
names and free email addresses to join Fedora? :)
In security point of view, that rule is a joke.
Tuju
--
Ajatteleva ihminen tarvitsee unta.
9:01 a.m.
On Tue, 2 Feb 2010, Juha Tuomala wrote:
On Tue, 2 Feb 2010, Mike McGrath wrote:
> Specifically: "Individuals using multiple accounts without prior written
> approval will have all but one account terminated. "
And what does that matter when everyone can create enough nick
names and free email addresses to join Fedora? :)
In security point of view, that rule is a joke.
It's not automatically enforcable that's true but we catch you doing it
(and we have) and we'll do something about it. Turns out the honor system
wasn't enough to keep people honorable so we had to make a rule.
-Mike
9:50 a.m.
On Tue, 2 Feb 2010, Juha Tuomala wrote:
On Tue, 2 Feb 2010, Mike McGrath wrote:
> but we catch you doing it (and we have) and we'll do something about it.
Just for curiosity, what? Prevent doing it again? How?
Like said, it's a joke.
We'd keep banning you and if you kept abusing the system I'd go the board
explaining what was going on and eventually we'd ban you. If some jerk
wanted to keep finding ways around the system and get re-sponsored in the
packager group (a tricky thing to do) then they can spend their time doing
that but we're not going to make it easy for people to route round our
systems and procedures. I assure you, it's not a joke just because it's
not automatically detectable.
-Mike
9:52 a.m.
On Tue, 2 Feb 2010, Mike McGrath wrote:
On Tue, 2 Feb 2010, Juha Tuomala wrote:
>
>
>
> On Tue, 2 Feb 2010, Mike McGrath wrote:
>> but we catch you doing it (and we have) and we'll do something about it.
>
> Just for curiosity, what? Prevent doing it again? How?
>
> Like said, it's a joke.
>
We'd keep banning you and if you kept abusing the system I'd go the board
explaining what was going on and eventually we'd ban you. If some jerk
wanted to keep finding ways around the system and get re-sponsored in the
packager group (a tricky thing to do) then they can spend their time doing
that but we're not going to make it easy for people to route round our
systems and procedures. I assure you, it's not a joke just because it's
not automatically detectable.
And I'd suspect that intentionally entering into an agreement with
knowingly false information is a kind of Fraud in just about every
country.
-sv
10:19 a.m.
On Tue, 2 Feb 2010, Seth Vidal wrote:
And I'd suspect that intentionally entering into an agreement
with knowingly
false information is a kind of Fraud in just about every country.
Feel free to sue that 0 euros email-address, which provider doesn't
know who uses it.
Tuju
--
Ajatteleva ihminen tarvitsee unta.
10:23 a.m.
On Tue, 2 Feb 2010, Juha Tuomala wrote:
On Tue, 2 Feb 2010, Seth Vidal wrote:
> And I'd suspect that intentionally entering into an agreement with knowingly
> false information is a kind of Fraud in just about every country.
Feel free to sue that 0 euros email-address, which provider doesn't
know who uses it.
Out of curiosity is your point to be antagonistic or are you actually
trying to improve things? If it is just the former then you are welcome to
NOT be involved.
If it is the latter then suggestions are welcome.
Security is a balance. We want more involvement so we tip the scales
toward more openness.
-sv
10:39 a.m.
On Tue, 2 Feb 2010, Seth Vidal wrote:
Out of curiosity is your point to be antagonistic or are you actually
trying
to improve things?
If cleaning false assumptions and admitting that some areas are real
problems - is improving, that's what I'm doing.
If it is just the former then you are welcome to NOT be involved.
And pulling out the welcomness from this particular identity is
actually the only thing that can be done - considering the context ;)
If it is the latter then suggestions are welcome.
Security is a balance. We want more involvement so we tip the scales toward
more openness.
What I see is only possible way to do that is some kind of
sertificate thing that would require global network of trusted
fedora people (like already met in meetings) able to sign those
fedora contributor certificates after checking the id documents
first (against ban lists).
There are around 200 countries and some have quite long distances,
requiring to meet people face to face doesn't really sound very
feasible. Not being feasible doesn't remove the problem however.
Easier would be to write red warning into wiki that "We actually
don't know who took part of building fedora, so consider yourself
warned."
Didn't someone just crack berlios site to inject something into
projects? In fedora you don't even need to crack anything, you get
invited to commit.
Tuju
--
Ajatteleva ihminen tarvitsee unta.
10:50 a.m.
On Tue, 2 Feb 2010, Juha Tuomala wrote:
> Out of curiosity is your point to be antagonistic or are you
actually trying
> to improve things?
If cleaning false assumptions and admitting that some areas are real
problems - is improving, that's what I'm doing.
You don't appear to be doing that. You seem to just be attempting the
'gadfly' method of helping matters. I'd like you to remember what
result that achieved for Socrates.
> If it is just the former then you are welcome to NOT be
involved.
And pulling out the welcomness from this particular identity is
actually the only thing that can be done - considering the context ;)
Just having an account doesn't mean you have access to anything or are
trusted. It only means you have an account. You have to maliciously want
to lie and do harm.
What I see is only possible way to do that is some kind of
sertificate thing that would require global network of trusted
fedora people (like already met in meetings) able to sign those
fedora contributor certificates after checking the id documents
first (against ban lists).
Those work only to limit access. And even then it just turns into a clique
or a cabal-driven exercise.
There are around 200 countries and some have quite long distances,
requiring to meet people face to face doesn't really sound very
feasible. Not being feasible doesn't remove the problem however.
No - but it makes you question your goals and priorities.
Our goals are openness and productivity. We do our due dilligence on
security and I think we
Easier would be to write red warning into wiki that "We
actually
don't know who took part of building fedora, so consider yourself
warned."
You mean like all open source/free software? Great. I'd like to invite you
again to not be involved if this is your belief about the whole system.
Or if you'd like to point out a linux distribution that doesn't have the
above problem, I'm all ears.
Didn't someone just crack berlios site to inject something into
projects? In fedora you don't even need to crack anything, you get
invited to commit.
And they didn't crack berlios by being involved and tricking their way in.
The cracked berlios b/c of poor system maintenance.
If the only way to make something safe is to shut it down entirely then
there's not much point in having it at all.
You should not cut off your nose to spite your face.
-sv
11:09 a.m.
On Tue, 2 Feb 2010, Seth Vidal wrote:
You don't appear to be doing that. You seem to just be attempting
the
'gadfly' method of helping matters. I'd like you to remember what
result that achieved for Socrates.
Whatever. I'm not interested in talking *about us* or getting
personal, so let's drop the topic. I apologize if I offended you
anyhow.
Tuju
--
Ajatteleva ihminen tarvitsee unta.
12:55 a.m.
On Tue, 2010-02-02 at 18:39 +0200, Juha Tuomala wrote:
There are around 200 countries and some have quite long distances,
requiring to meet people face to face doesn't really sound very
feasible. Not being feasible doesn't remove the problem however.
Easier would be to write red warning into wiki that "We actually
don't know who took part of building fedora, so consider yourself
warned."
Didn't someone just crack berlios site to inject something into
projects? In fedora you don't even need to crack anything, you get
invited to commit.
This applies to virtually every software project in the world (with the
possible exception of anything developed by the NSA, but then you'd have
to trust the NSA when they say 'noooo, we didn't put any secret
backdoors in. Doesn't sound like something we'd do.') Proprietary
vendors may claim to know everyone who wrote code in their projects, but
how would you know they're telling the truth? And how can you trust them
to have properly vetted all those people? With single person projects
that isn't a problem, but as you so acutely pointed out, you have no way
of knowing who that person actually is.
Asking these kinds of questions may seem like you're being clever and
pointing out scary stuff but in the end it's a bit like pointing out
that the universe is, like, huge, man, and nothing we do really, like,
matters, you know? Everyone involved knows these things, but it's just a
*tad* impossible to do a lot about it, if you're going to get really
anal about pointing out the potential problems.
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Fedora Talk: adamwill AT fedoraproject DOT org
http://www.happyassassin.net
10:16 a.m.
On Tue, 2 Feb 2010, Mike McGrath wrote:
that but we're not going to make it easy for people to route
round our
systems and procedures. I assure you, it's not a joke just because it's
not automatically detectable.
And how does that happen? You don't know even *now*
a) who am i
b) am i who i claim to be
and in my understanding some people have not even given their full
names so as long as you cannot prevent people from accessing
internet, those are just pretty threats in wiki page.
As long as nobody meets me and checks my id against some kind
of black/revocation list, I'm just a random text string in Internet
for fedora who commits to CVS. If I would get caught for wrongdoing,
I could start it all over again at the same day.
It's easier, that I generate pair of PGP keys and build intrest
towards to that identity, which then can be easily proved apart
from fakes.
In case you're constantly opening doors for new and fresh people
and try to keep those bad apples out, you need something that
cannot be re-genrated. In fedora's global case, that's more or
less impossible to do. Thus threats you write to wiki are just
air to those who want to abuse the system.
Tuju
--
Ajatteleva ihminen tarvitsee unta.
9:39 a.m.
On Tue, Feb 02, 2010 at 09:01:25AM -0600, Mike McGrath wrote:
It's not automatically enforcable that's true but we catch
you doing it
(and we have) and we'll do something about it. Turns out the honor system
wasn't enough to keep people honorable so we had to make a rule.
IIRC this change was not announced, was it?
Regards
Till
9:47 a.m.
On Tue, 2 Feb 2010, Till Maas wrote:
On Tue, Feb 02, 2010 at 09:01:25AM -0600, Mike McGrath wrote:
> It's not automatically enforcable that's true but we catch you doing it
> (and we have) and we'll do something about it. Turns out the honor system
> wasn't enough to keep people honorable so we had to make a rule.
IIRC this change was not announced, was it?
It's been in place for years so I don't know if it was announced or not.
Consider it announced.
-Mike
10:21 a.m.
On Tue, Feb 02, 2010 at 09:47:13AM -0600, Mike McGrath wrote:
On Tue, 2 Feb 2010, Till Maas wrote:
> On Tue, Feb 02, 2010 at 09:01:25AM -0600, Mike McGrath wrote:
>
> > It's not automatically enforcable that's true but we catch you doing
it
> > (and we have) and we'll do something about it. Turns out the honor system
> > wasn't enough to keep people honorable so we had to make a rule.
>
> IIRC this change was not announced, was it?
>
It's been in place for years so I don't know if it was announced or not.
Consider it announced.
It was certainly discussed. I believe on fab-list although it's been so
long I don't remember. Whether there was an announcement after the
discussion ended, I don't recall but there was action taken on the new
policy right after the discussion ended.
-Toshio
12:27 p.m.
On Tue, Feb 02, 2010 at 09:47:13AM -0600, Mike McGrath wrote:
On Tue, 2 Feb 2010, Till Maas wrote:
> On Tue, Feb 02, 2010 at 09:01:25AM -0600, Mike McGrath wrote:
>
> > It's not automatically enforcable that's true but we catch you doing
it
> > (and we have) and we'll do something about it. Turns out the honor system
> > wasn't enough to keep people honorable so we had to make a rule.
>
> IIRC this change was not announced, was it?
>
It's been in place for years so I don't know if it was announced or not.
Consider it announced.
According to the wiki, the change was 17 months ago:
https://fedoraproject.org/w/index.php?title=Account_System&diff=48371...
Regards
Till
5187
days inactive
5190
days old
20 comments
10 participants
participants (10)
-
Adam Williamson -
Juha Tuomala -
leigh scott -
Michael Schwendt -
Mike McGrath -
Rex Dieter -
Seth Vidal -
Susi Lehtola -
Till Maas -
Toshio Kuratomi