service accepting commands from the network by default

[Zbigniew Jędrzejewski-Szmek]

Are Fedora packages allowed to have a default configuration in which
the service accepts commands from the network in the default
configuration?

The daemon is not enabled by default, so the administrator has to do a
systemctl enable/start first.  This means that just installing the
package does not create a problem, and an explicit admin action is
necessary for the daemon to start listening. Nevertheless, I'm still
worried that people will start the service to try it out without
reading the fine print and will be vulnerable to attack. I would think
that the Packaging Guidelines cover this, but I don't think they do.

Zbyszek

[M. Edward (Ed) Borasky]

Yes, I would think:

a) all services should be disabled and their ports closed by default, and
b) the documentation should describe how to enable the service and
open the ports

On Sun, Feb 22, 2015 at 6:04 AM, Zbigniew Jędrzejewski-Szmek
<zbyszek(a)in.waw.pl&gt; wrote:
>  Are Fedora packages allowed to have a default configuration in which
>  the service accepts commands from the network in the default
>  configuration?
>
>  The daemon is not enabled by default, so the administrator has to do a
>  systemctl enable/start first.  This means that just installing the
>  package does not create a problem, and an explicit admin action is
>  necessary for the daemon to start listening. Nevertheless, I'm still
>  worried that people will start the service to try it out without
>  reading the fine print and will be vulnerable to attack. I would think
>  that the Packaging Guidelines cover this, but I don't think they do.
>
>  Zbyszek
>  --
>  devel mailing list
>  devel(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/devel
>  Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct 


-- 
OSJourno: Robust Power Tools for Digital Journalists
http://www.znmeb.mobi/stories/osjourno-robust-power-tools-for-digital-jou...

Remember, if you're traveling to Bactria, Hump Day is Tuesday and Thursday.

[Reindl Harald]

Am 22.02.2015 um 19:46 schrieb M. Edward (Ed) Borasky:
>  Yes, I would think:
>
>  a) all services should be disabled and their ports closed by default, and
>  b) the documentation should describe how to enable the service and
>  open the ports 
and then comes the default firewall on F21 workstation with all ports > 
1024 open because things "have to work out of the box"

>  On Sun, Feb 22, 2015 at 6:04 AM, Zbigniew Jędrzejewski-Szmek
>  <zbyszek(a)in.waw.pl&gt; wrote:
> > Are Fedora packages allowed to have a default configuration in which
> > the service accepts commands from the network in the default
> > configuration?
> >
> > The daemon is not enabled by default, so the administrator has to do a
> > systemctl enable/start first.  This means that just installing the
> > package does not create a problem, and an explicit admin action is
> > necessary for the daemon to start listening. Nevertheless, I'm still
> > worried that people will start the service to try it out without
> > reading the fine print and will be vulnerable to attack. I would think
> > that the Packaging Guidelines cover this, but I don't think they do.

[Zbigniew Jędrzejewski-Szmek]

On Sun, Feb 22, 2015 at 07:51:06PM +0100, Reindl Harald wrote:
>  and then comes the default firewall on F21 workstation with all
>  ports > 1024 open because things "have to work out of the box" 
Yes,
this is the reason why I'm asking. If there was a restrictive
firewall by default, this would not be an issue.

>  Am 22.02.2015 um 19:46 schrieb M. Edward (Ed) Borasky:
>  >Yes, I would think:
>  >
>  >a) all services should be disabled and their ports closed by default, and
>  >b) the documentation should describe how to enable the service and
>  >open the ports 
It's not really clear what you mean by your answer. Does "yes" mean
that this *should* be allowed? Also please note that the service in
question is disabled by default, and requires a 'systemctl start' to
start. Is this enough?

Zbyszek


>  >On Sun, Feb 22, 2015 at 6:04 AM, Zbigniew Jędrzejewski-Szmek
>  ><zbyszek(a)in.waw.pl> wrote:
>  >>Are Fedora packages allowed to have a default configuration in which
>  >>the service accepts commands from the network in the default
>  >>configuration?
>  >>
>  >>The daemon is not enabled by default, so the administrator has to do a
>  >>systemctl enable/start first.  This means that just installing the
>  >>package does not create a problem, and an explicit admin action is
>  >>necessary for the daemon to start listening. Nevertheless, I'm still
>  >>worried that people will start the service to try it out without
>  >>reading the fine print and will be vulnerable to attack. I would think
>  >>that the Packaging Guidelines cover this, but I don't think they do.
>   


>  -- 
>  devel mailing list
>  devel(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/devel
>  Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

[Kevin Fenzi]

On Sun, 22 Feb 2015 15:04:18 +0100
Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; wrote:

>  Are Fedora packages allowed to have a default configuration in which
>  the service accepts commands from the network in the default
>  configuration? 
Commands from the network what sort of commands? 
Perhaps you had an example package in mind that caused you to bring
this up?

There's nothing I can think of off hand in the packaging guidelines
about accepting commands from the network in default config. It sounds
like common sense would be to avoid such a thing tho. 

>  The daemon is not enabled by default, so the administrator has to do
> a
>  systemctl enable/start first.   
Right, there are guidelines on this 

>  This means that just installing the
>  package does not create a problem, and an explicit admin action is
>  necessary for the daemon to start listening. Nevertheless, I'm still
>  worried that people will start the service to try it out without
>  reading the fine print and will be vulnerable to attack. I would think
>  that the Packaging Guidelines cover this, but I don't think they do. 
As the saying goes "It's hard to legislate common sense" (ie, it's hard
to write down every single thing people should/should not do). 

Many packages in this situation at least listen only on localhost, so
the issue isn't remote access anyhow. 

IMHO, I would talk to the package maintainer(s) and ask them to do
something to improve the situation. 

kevin

[Zbigniew Jędrzejewski-Szmek]

On Sun, Feb 22, 2015 at 01:08:34PM -0700, Kevin Fenzi wrote:
>  On Sun, 22 Feb 2015 15:04:18 +0100
>  Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; wrote:
>  
>  > Are Fedora packages allowed to have a default configuration in which
>  > the service accepts commands from the network in the default
>  > configuration?
>  
>  Commands from the network what sort of commands?  
Monitoring status, bringing the
service down, extracting data, adding
data, deleting data. I'm not aware of further escalation, but it certainly
could be possible.

>  Perhaps you had an example package in mind that caused you to bring
>  this up? 
Yes, this was about elasticsearch review. I left that piece of
information out on purpose, because was hoping for a general rule.

>  As the saying goes "It's hard to legislate common
> sense" (ie, it's hard
>  to write down every single thing people should/should not do). 
>  
>  Many packages in this situation at least listen only on localhost, so
>  the issue isn't remote access anyhow. 
>  
>  IMHO, I would talk to the package maintainer(s) and ask them to do
>  something to improve the situation.  
So, my problem is whether the package should
go through review in current
state. My gut feeling is that it shouldn't, but I don't want to overstep
my role as a reviewer.

Zbyszek

[Kevin Fenzi]

On Sun, 22 Feb 2015 21:25:01 +0100
Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; wrote:

>  So, my problem is whether the package should go through review in
>  current state. My gut feeling is that it shouldn't, but I don't want
>  to overstep my role as a reviewer. 
I'd personally agree. Can they not at least make it only listen on
localhost unless configured otherwise?

kevin

[Till Maas]

On Sun, Feb 22, 2015 at 01:55:31PM -0700, Kevin Fenzi wrote:
>  On Sun, 22 Feb 2015 21:25:01 +0100
>  Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; wrote:
>  
>  > So, my problem is whether the package should go through review in
>  > current state. My gut feeling is that it shouldn't, but I don't want
>  > to overstep my role as a reviewer.
>  
>  I'd personally agree. Can they not at least make it only listen on
>  localhost unless configured otherwise? 
Yes, I agree here, access to elasticsearch allowed to execute arbitrary
code in the past.

Regards
Till

[Christopher Meng]

Elasticsearch was never safe:

http://www.elasticsearch.org/community/security/
https://bugzilla.redhat.com/show_bug.cgi?id=1124252

So it shouldn't go ahead in current status.

-- 

Yours sincerely,
Christopher Meng

http://cicku.me

[Zbigniew Jędrzejewski-Szmek]

On Mon, Feb 23, 2015 at 09:16:48AM +0800, Christopher Meng wrote:
>  Elasticsearch was never safe:
>  
>  http://www.elasticsearch.org/community/security/
>  https://bugzilla.redhat.com/show_bug.cgi?id=1124252
>  
>  So it shouldn't go ahead in current status. 
Thanks to everyone for their comments. Elasticsearch has now been modified to
listen on localhost only.

Zbyszek

Is Fedora Have Backdoor ?!

[مصعب الزعبي]

Hi , I got a message from my friend a programmer.

And he asked me , Is Fedora have a backdoor !!!

He got a two domains without any control of him and without updates enabled and controlled
by NetworkManager , domains are :

vm3.fedora.ibiblio.org

proxy3.fedoraproject.org

And both directed to https://apps.fedoraproject.org/#FedoraApps


I check my (
lsof -i :443 
) and didn't detect any connection ..
---------

Can any body explain ...


Regards
Mosaab

Is Fedora Have Backdoor ?!

[Reindl Harald]

Am 22.02.2015 um 21:41 schrieb مصعب الزعبي:
>  Hi , I got a message from my friend a programmer.
>
>  And he asked me , Is Fedora have a backdoor !!!
>
>  He got a two domains without any control of him and without updates
>  enabled and controlled by NetworkManager , domains are :
>  vm3.fedora.ibiblio.org
>  proxy3.fedoraproject.org
>
>  And both directed to https://apps.fedoraproject.org/#FedoraApps
>
>
>  I check my (||lsof -i :443 ) ||and didn't detect any connection ..
>  ---------
>
>  Can any body explain ... 
"He got a two domains without any control of him" makes no sense

Is Fedora Have Backdoor ?!

[مصعب الزعبي]

No it's a real problem .. What the information by 443 port that shared by
NetworkManager !!! to un-local servers .

THIS IS THE DEFINITION OF BACKDOOR !!!

Regards
Mosaab

Date: Sun, 22 Feb 2015 21:48:57 +0100
From: h.reindl(a)thelounge.net
To: devel(a)lists.fedoraproject.org
Subject: Re: Is Fedora Have Backdoor ?!

 
Am 22.02.2015 um 21:41 schrieb مصعب الزعبي:
>  Hi , I got a message from my friend a programmer.
>
>  And he asked me , Is Fedora have a backdoor !!!
>
>  He got a two domains without any control of him and without updates
>  enabled and controlled by NetworkManager , domains are :
>  vm3.fedora.ibiblio.org
>  proxy3.fedoraproject.org
>
>  And both directed to https://apps.fedoraproject.org/#FedoraApps
>
>
>  I check my (||lsof -i :443 ) ||and didn't detect any connection ..
>  ---------
>
>  Can any body explain ...
>  
 
"He got a two domains without any control of him" makes no sense
 

-- 
devel mailing list
devel(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Is Fedora Have Backdoor ?!

[Kevin Fenzi]

On Sun, 22 Feb 2015 22:59:06 +0200
مصعب الزعبي <moceap(a)hotmail.com&gt; wrote:

>  No it's a real problem .. What the information by 443 port that
>  shared by NetworkManager !!! to un-local servers .
>  
>  THIS IS THE DEFINITION OF BACKDOOR !!! 
It's hard to say what you are talking about here, but I suspect it may
be the NetworkManager connectivity check. 

You can disable it by commenting out the lines
in /etc/NetworkManager/conf.d/20-connectivity-fedora.conf or removing 
the NetworkManager-config-connectivity-fedora package (however this
will remove gnome-shell and gdm and others). 

It's not by any means a backdoor. It's intended on the workstation
spin. It's used to check that you are on-line or behind a captive
portal or the like. 

kevin

Is Fedora Have Backdoor ?!

[Tomasz Torcz]

On Sun, Feb 22, 2015 at 10:59:06PM +0200, مصعب الزعبي wrote:
>  No it's a real problem .. What the information by 443 port that
> shared by NetworkManager !!! to un-local servers .
>  
>  THIS IS THE DEFINITION OF BACKDOOR !!! 
 
  What you probably see is network connectivity check, done by NetworkManager
and governed by config in NetworkManager-config-connectivity-fedora RPM package.
  It tries to open https://fedoraproject.org/static/hotspot.txt URL. If it gets
”OK”, NM assumes you have network connectivity and no captive portal along the
way.

  Please tone down your emails a bit.

-- 
Tomasz Torcz                        To co nierealne -- tutaj jest normalne.
xmpp: zdzichubg(a)chrome.pl          Ziomale na życie mają tu patenty specjalne.

Is Fedora Have Backdoor ?!

[Reindl Harald]

Am 22.02.2015 um 21:59 schrieb مصعب الزعبي:
>  No it's a real problem .. What the information by 443 port that
> shared
>  by NetworkManager !!! to un-local servers . 
the problem is that *nobody* knows what you are talking about

>  THIS IS THE DEFINITION OF BACKDOOR !!! 
you first need to define the "this" before talk about definitions

and if you are at it

* don't post HTML
* don't post right aligned content in english

>  Date: Sun, 22 Feb 2015 21:48:57 +0100
>  From: h.reindl(a)thelounge.net
>  To: devel(a)lists.fedoraproject.org
>  Subject: Re: Is Fedora Have Backdoor ?!
>
>  Am 22.02.2015 um 21:41 schrieb مصعب الزعبي:
> > Hi , I got a message from my friend a programmer.
> >
> > And he asked me , Is Fedora have a backdoor !!!
> >
> > He got a two domains without any control of him and without updates
> > enabled and controlled by NetworkManager , domains are :
> > vm3.fedora.ibiblio.org
> > proxy3.fedoraproject.org
> >
> > And both directed tohttps://apps.fedoraproject.org/#FedoraApps
> >
> >
> > I check my (||lsof -i :443 ) ||and didn't detect any connection ..
> > ---------
> >
> > Can any body explain ...
>
>  "He got a two domains without any control of him" makes no sense

Is Fedora Have Backdoor ?!

[Florian Weimer]

* Reindl Harald:

>  "He got a two domains without any control of him" makes no
> sense 
Come on, Harald, please try to be a little bit more constructive.
Mosaab's question is pretty easy to understand, and his concerns
are shared by some Fedora contributors:

  <https://fedorahosted.org/fesco/ticket/1411>

Is Fedora Have Backdoor ?!

[Reindl Harald]

Am 22.02.2015 um 22:14 schrieb Florian Weimer:
>  * Reindl Harald:
>
> > "He got a two domains without any control of him" makes no sense
>
>  Come on, Harald, please try to be a little bit more constructive.
>  Mosaab's question is pretty easy to understand, and his concerns
>  are shared by some Fedora contributors:
>
>   <https://fedorahosted.org/fesco/ticket/1411> 
sorry *but* "He got a two domains without any control of him" does not 
make any sense to me, it still does not

Is Fedora Have Backdoor ?!

[Florian Weimer]

* Reindl Harald:

>  sorry *but* "He got a two domains without any control of
> him" does not
>  make any sense to me, it still does not 
The two host names he mentioned are used to host
wildcard.fedoraproject.org.  His friend is concerned because he sees
connection attempts to them even though they are not related to his
system setup, and he is not aware of having configured them
explicitly.

Has this never happened to you?  That a piece of new software you have
installed triggers some network activity you cannot immediately
explain?

Is Fedora Have Backdoor ?!

[Reindl Harald]

Am 22.02.2015 um 22:20 schrieb Florian Weimer:
>  * Reindl Harald:
>
> > sorry *but* "He got a two domains without any control of him" does not
> > make any sense to me, it still does not
>
>  The two host names he mentioned are used to host
>  wildcard.fedoraproject.org.  His friend is concerned because he sees
>  connection attempts to them even though they are not related to his
>  system setup, and he is not aware of having configured them
>  explicitly. 
that has some meaning and in case of taking strong words like "backdoor" 
in my mouth and accuse the distribution that way i expect it not 
expressed in riddles nor am i really open for "my friend said backdoor" 
because in that case that friend should express what he sees by himself 
and not like "a friend of my friends mother said"

>  Has this never happened to you?  That a piece of new software you
> have
>  installed triggers some network activity you cannot immediately
>  explain? 
surely, but that's not "got two domains" and if someone is blamig every 
otgoing connection he has a fulltime job

Is Fedora Have Backdoor ?!

[Florian Weimer]

* Reindl Harald:

>  that has some meaning and in case of taking strong words like
>  "backdoor" in my mouth and accuse the distribution that way i expect 
Please read the Fesco ticket I referenced.  Such concerns are far from
isolated.  (I think they are unwarranted, but they neverless exist.)

As to the word ‘backdoor’, it's likely that Mosaab's first language
isn't English.  The word has some strong implications, sure, but it
brings across his concerns quite clearly.

Considering your own use of strong language, I find it rather strange
that you suddenly object to it, but maybe it helps you to understand
why some of us find it problematic.

>  it not expressed in riddles nor am i really open for "my friend
> said
>  backdoor" because in that case that friend should express what he sees
>  by himself and not like "a friend of my friends mother said" 
The friend might not feel comfortable writing in English.

Please try to be a bit more welcoming.

> > Has this never happened to you?  That a piece of new software you
> have
> > installed triggers some network activity you cannot immediately
> > explain?
>
>  surely, but that's not "got two domains" 
He ended up with the two domains after doing a DNS reverse lookup.

Is Fedora Have Backdoor ?!

[Samuel Sieb]

On 02/22/2015 01:14 PM, Florian Weimer wrote:
>  * Reindl Harald:
>
> > "He got a two domains without any control of him" makes no sense
>
>  Come on, Harald, please try to be a little bit more constructive.
>  Mosaab's question is pretty easy to understand, and his concerns
>  are shared by some Fedora contributors:
>  
I'm glad someone did understand the question.  I puzzled over it for a 
while and couldn't figure it out at all.  Harald wasn't saying the 
concern was wrong, just that the question itself was indecipherable.

Is Fedora Have Backdoor ?!

[Florian Weimer]

* مصعب الزعبي:

>  Hi , I got a message from my friend a programmer.
>
>  And he asked me , Is Fedora have a backdoor !!!
>
>  He got a two domains without any control of him and without updates enabled and
> controlled by NetworkManager , domains are :
>
>  vm3.fedora.ibiblio.org
>
>  proxy3.fedoraproject.org
>
>  And both directed to https://apps.fedoraproject.org/#FedoraApps 
Hi Mosaab,

Fedora uses a mirror list service.  This service tells the Fedora
updater where it can download updates.  Please tell your friend that
this is completely normal.  In fact, it is required to keep his Fedora
installation up to date and secure.

Florian

PS: Please do not start a new discussion by replying to an existing
message.  Please write your question as an email message from scratch.

Is Fedora Have Backdoor ?!

[مصعب الزعبي]

Thank You for Care .. from everybody for this case .. 

I know that talking about Fedora as a backdoor container makes us angry .. But we must be
careful about these sensitive issues.

As a reply :

My friend didn't have enabled auto-update.
He completely Surprised of un-human-authorized connection by fedora.
He disabled these actions by :

sudo echo  127.0.0.1 vm3.fedora.ibiblio.org proxy3.fedoraproject.org
apps.fedoraproject.org 6-55-236-85.rev.customer-net.de >> /etc/hosts

As a Fedora Developers .. We must be Transparents

Kind Regards
Mosaab

>  From: fw(a)deneb.enyo.de
>  To: moceap(a)hotmail.com
>  CC: devel(a)lists.fedoraproject.org
>  Subject: Re: Is Fedora Have Backdoor ?!
>  Date: Sun, 22 Feb 2015 22:11:23 +0100
>  
>  * مصعب الزعبي:
>  
>  > Hi , I got a message from my friend a programmer.
>  >
>  > And he asked me , Is Fedora have a backdoor !!!
>  >
>  > He got a two domains without any control of him and without updates enabled and
> controlled by NetworkManager , domains are :
>  >
>  > vm3.fedora.ibiblio.org
>  >
>  > proxy3.fedoraproject.org
>  >
>  > And both directed to https://apps.fedoraproject.org/#FedoraApps
>  
>  Hi Mosaab,
>  
>  Fedora uses a mirror list service.  This service tells the Fedora
>  updater where it can download updates.  Please tell your friend that
>  this is completely normal.  In fact, it is required to keep his Fedora
>  installation up to date and secure.
>  
>  Florian
>  
>  PS: Please do not start a new discussion by replying to an existing
>  message.  Please write your question as an email message from scratch.
>

Is Fedora Have Backdoor ?!

[Florian Weimer]

* مصعب الزعبي:

>  Thank You for Care .. from everybody for this case .. 
>
>  I know that talking about Fedora as a backdoor container makes us angry .. But we must be
> careful about these sensitive issues.
>
>  As a reply :
>
>  My friend didn't have enabled auto-update. 
The archive meta-data can be updated automatically even if the actual
updates are not installed.

>  He completely Surprised of un-human-authorized connection by fedora.
>  He disabled these actions by :
>
>  sudo echo  127.0.0.1 vm3.fedora.ibiblio.org proxy3.fedoraproject.org
> apps.fedoraproject.org 6-55-236-85.rev.customer-net.de >> /etc/hosts 
This does not work, for two reasons: “>>” is evaluated before the sudo
privilege escalation, and Fedora will not use the host names you
listed.  This means that adding them /etc/hosts will not block their
use.

You need to look at the network traffic with Wireshark and figure out
what the original host names are (“sudo tcpdump -i any -s 0 -v port
53” would work as well). This will also tell you what is actually
going on.

Is Fedora Have Backdoor ?!

[Matthew Miller]

On Mon, Feb 23, 2015 at 12:37:44AM +0200, مصعب الزعبي wrote:
>  My friend didn't have enabled auto-update. 
There was an earlier discussion here. Even without updates
automatically applied, metadata about potential updates is downloaded
automatically.


>  He completely Surprised of un-human-authorized connection by fedora.
Preventing automatic system network interactions is not explicitly a
project goal, and we don't have any strong guidelines on this. If you
think it _should_ be, you wouldn't be alone — but on the other hand,
there are strong user benefits in making sure the system is up to date,
there's no waiting for metadata downloads, network connectivity is correct,
and so on; so, you'll need to build a strong case that this concern is
the most important.

>  He disabled these actions by :
>  sudo echo  127.0.0.1 vm3.fedora.ibiblio.org proxy3.fedoraproject.org
> apps.fedoraproject.org 6-55-236-85.rev.customer-net.de >> /etc/hosts 
Since these connections really are innocuous, this seems more likely to
do harm than good, but of course your friend can do this if wanted.


-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader

Is Fedora Have Backdoor ?!

[مصعب الزعبي]

Even it just a Meta headers , the user approve must be taken. May at Fedora installation ,
and a way to stop must be available , too.

These issues must be in control by user .

Kind Regards
Mosaab

>  Date: Sun, 22 Feb 2015 17:44:59 -0500
>  From: mattdm(a)fedoraproject.org
>  To: devel(a)lists.fedoraproject.org
>  Subject: Re: Is Fedora Have Backdoor ?!
>  
>  On Mon, Feb 23, 2015 at 12:37:44AM +0200, مصعب الزعبي wrote:
>  > My friend didn't have enabled auto-update.
>  
>  There was an earlier discussion here. Even without updates
>  automatically applied, metadata about potential updates is downloaded
>  automatically.
>  
>  
>  > He completely Surprised of un-human-authorized connection by fedora.
>  
>  Preventing automatic system network interactions is not explicitly a
>  project goal, and we don't have any strong guidelines on this. If you
>  think it _should_ be, you wouldn't be alone — but on the other hand,
>  there are strong user benefits in making sure the system is up to date,
>  there's no waiting for metadata downloads, network connectivity is correct,
>  and so on; so, you'll need to build a strong case that this concern is
>  the most important.
>  
>  > He disabled these actions by :
>  > sudo echo  127.0.0.1 vm3.fedora.ibiblio.org proxy3.fedoraproject.org
> apps.fedoraproject.org 6-55-236-85.rev.customer-net.de >> /etc/hosts
>  
>  Since these connections really are innocuous, this seems more likely to
>  do harm than good, but of course your friend can do this if wanted.
>  
>  
>  -- 
>  Matthew Miller
>  <mattdm(a)fedoraproject.org&gt;
>  Fedora Project Leader
>  -- 
>  devel mailing list
>  devel(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/devel
>  Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
>

Is Fedora Have Backdoor ?!

[Christopher Meng]

On 2/23/15, مصعب الزعبي <moceap(a)hotmail.com&gt; wrote:
>  Even it just a Meta headers , the user approve must be taken. May at
> Fedora
>  installation , and a way to stop must be available , too.
>
>  These issues must be in control by user . 
And your friend can freely switch to other distributions as well if he
really wants to control something trivial.
-- 

Yours sincerely,
Christopher Meng

http://cicku.me

Is Fedora Have Backdoor ?!

[Pierre-Yves Chibon]

On Mon, Feb 23, 2015 at 08:44:28AM +0800, Christopher Meng wrote:
>  On 2/23/15, مصعب الزعبي <moceap(a)hotmail.com&gt; wrote:
>  > Even it just a Meta headers , the user approve must be taken. May at Fedora
>  > installation , and a way to stop must be available , too.
>  >
>  > These issues must be in control by user .
>  
>  And your friend can freely switch to other distributions as well if he
>  really wants to control something trivial. 
And you can be a little more welcoming to someone else's concern.

We are entitled to our own opinion, we are allowed to disagree that does not
mean that we should all use a different distributions, on the contrary, we need
people with different views, different opinions.
Otherwise we'll end up in an echo chamber with anyone but ourselves to talk to
and this is clearly not a situation we want. So inviting people that disagree to
leave is not something we a) want to do b) ought to do.

Pierre

Is Fedora Have Backdoor ?!

[Michael Catanzaro]

On Sun, Feb 22, 2015 at 5:15 PM, مصعب الزعبي 
<moceap(a)hotmail.com&gt; wrote:
>  Even it just a Meta headers , the user approve must be taken. May at
>
>  Fedora installation , and a way to stop must be available , too.
>  
>  These issues must be in control by user .
>  
>  Kind Regards
>  Mosaab 
Hi,

You can disable this by running the following command:

$ systemctl disable dnf-makecache.timer

Cheers,

Michael