On Tue, 28 Feb 2012, Bryen M Yunashko wrote:

And the time issue isn't just about timezones, but also about changing time itself and/or syncing up to NTP. And from an administrated-machine standpoint, there may be reasons why we don't want our users to fiddle with the clock itself.

Oh, I get the part about the clock. However, I am not suggesting the user shall change time or date, I am focusing on timezone here. If this requires the same set of privileges, the security design may be in need to some love and care. I'm also fine having a more liberal default when the underlying device is detected to be portable (notebook, tablet,...). Just treating Daniela's or "significant other"'s notebook like one of those multi-user UNIX servers in the old days does not make sense. Those could not be hauled around nearly as easy to begin with. :-)

As for printers... I see the issue being installation of drivers. If we're setting up a printer which has a driver already installed on the machine, then no, password should not be required like that.

Great, we agree on that.

But if setting up the printer means downloading the driver... then it should be treated the same way as any other software installation which requires system authentication.

And I can agree on that. Installation of new software, not yet on the systems or authorized somehow (for example, Linus could have put all acceptable drivers somewhere on the machine for the system to pick up in case of need) is a different beast. Let's focus on the simple cases for now: Timezone (not clock) and printers (no new drivers). Gerald -- Dr. Gerald Pfeifer || SUSE || Director Product Management -- To unsubscribe, e-mail: opensuse-gnome+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-gnome+owner@opensuse.org

On Wed, 2012-02-29 at 02:36 +0100, Carlos E. R. wrote:

On 2012-02-29 00:36, Gerald Pfeifer wrote:

...

Oh, I get the part about the clock. However, I am not suggesting the user shall change time or date, I am focusing on timezone here. If this requires the same set of privileges, the security design may be in need to some love and care.

I don't see what problem there could be about changing one's timezone. In the CLI you can do that as user, because you are not changing the system clock. It is just your own environment variables, you can change any.

If gnome doesn't allow it, then it is indeed a bug.

In the UI, the process is as follows: 1. Click on the clock in the top bar 2. Click on "Date and Time Settings". This will open up the same module that is found in System Settings > System > Date and Time. 3. Options for changing timezone, date, time are greyed out. Option for showing 24-hour or 12-hour clock is not greyed out. 4. Click the Unlock button and enter your system administrator password. 5. Now you may make your changes. Step 4 is the contention here. If this can be divided so that timezone can be user-changed and time/date requires password as Gerald was saying, that would make good sense, IMO. And I join in, as a user, with Gerald in supporting the request to adjust these user experiences. I should also point out that in the original G+ post by Linus, he ssys he had isues with requiring admin access to connect to a wifi network and that it was subsequently resolved at some point. I'm on 12.1 and I'm still getting those admin password requests when attempting to connect to a new wifi network. I'm unsure if this really was resolved anywhere since its the same experience for me as all along. Bryen -- To unsubscribe, e-mail: opensuse-gnome+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-gnome+owner@opensuse.org

On Wed, 2012-02-29 at 03:23 +0100, Carlos E. R. wrote:

However, printer configuration, as that is a hardware thing, is traditionally a task for the administrator, but perhaps something could be devised that allowed the user to do it if the administrator allows. However, if a driver has to be installed, then it is "no way".

With the exception of requiring actual driver installations, I don't agree with even needing an administrator allowance. I think that tradition needs to go out the door in today's more modern mobility world. Last thing I need if I'm on the road and need to hook up to a printer for an important document is to call my IT admin guy and say Hey, can you allow my machine to connect to this printer?? Of course, there is an exception to every rule. :-) We may not want users to connect to certain network printers. I certainly recall one of my clients back when I was in consulting, having to put in restrictions so students would not send prank printouts to the principal's printer. :-) But in the case of default shipment, I would rather see us be a bit more liberal for printer setups and let the administrator choose a more paranoid lock-down method by choice rather than by default. Bryen -- To unsubscribe, e-mail: opensuse-gnome+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-gnome+owner@opensuse.org

Hello, On Feb 29 00:36 Gerald Pfeifer wrote (excerpt):

On Tue, 28 Feb 2012, Bryen M Yunashko wrote:

...

As for printers... I see the issue being installation of drivers. If we're setting up a printer which has a driver already installed on the machine, then no, password should not be required like that.

Great, we agree on that.

Of course it is not as easy as you think. Your current point of view "printer setup on my own machine" does not apply in any case. In corporate environments where an admin maintains the workstations it is usually not wanted that users can change how workstations print because this can cause printing security issues in the whole network, see "print job phishing" at http://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

...

But if setting up the printer means downloading the driver... then it should be treated the same way as any other software installation which requires system authentication.

And I can agree on that. Installation of new software, not yet on the systems or authorized somehow (for example, Linus could have put all acceptable drivers somewhere on the machine for the system to pick up in case of need) is a different beast.

For you current use case "printer setup on my own machine" why shold the user not also install a driver on his own machine? More and more printers require a driver from the manufacturer. In particular low-level printers which are of major interest for the use case "printer setup on my own machine". Of course long ago I had aready filed a matching FATE request https://features.opensuse.org/307745 but nobody - in particular nobody of the management - cares. Kind Regards Johannes Meixner -- SUSE LINUX Products GmbH -- Maxfeldstrasse 5 -- 90409 Nuernberg -- Germany HRB 16746 (AG Nuernberg) GF: Jeff Hawn, Jennifer Guild, Felix Imendoerffer -- To unsubscribe, e-mail: opensuse-gnome+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-gnome+owner@opensuse.org

On Wed, 29 Feb 2012, Johannes Meixner wrote:

In corporate environments where an admin maintains the workstations it is usually not wanted that users can change how workstations print because this can cause printing security issues in the whole network, see "print job phishing"

In corporate environments where an admin maintains the workstations, said admins can easily increase whatever security levels she desires to increase. A vanilla openSUSE installation is not exactly most common in such environments. It's a lot more common, as we see every day, in those cases Linus and me are concerned about. (In fact, a couple of SUSE employees contacted me in the last 24 hours indicating "Yes, I do have the root password, but this really has annoyed me all the time.")

Of course long ago I had aready filed a matching FATE request https://features.opensuse.org/307745 but nobody - in particular nobody of the management - cares.

I am sorry your request did not get picked up for openSUSE. As far as all SUSE products go, indeed I am (Mr. Product) Management. openSUSE is not a SUSE product, though, and there I am just a lowly contributor like everyone else. :-) With a bit of influence, admittedly, in suggesting what SUSE engineering teams contribute to openSUSE, but not in the sense of classic (product) management. Gerald -- Dr. Gerald Pfeifer || SUSE || Director Product Management -- To unsubscribe, e-mail: opensuse-gnome+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-gnome+owner@opensuse.org

On Tue, 2012-02-28 at 22:38 -0700, Sankar P wrote:

Disclaimer: Have not used openSUSE for the past two months (due to dayjob requirements) so my data may be obsolete/wrong (not verified)

When the time is stored in UTC in the system (yast), we can change the timezone as a non-root user, otherwise we can't (or that is how I remember it). Windows does not store time in UTC and so in multi-boot machines, changing timezone is not possible, as a normal user.

This is how I remember this. But I may be wrong and could not verify now. Just check once if time is stored in UTC in yast and then try to see if you can change the timezone.

Sankar http://psankar.blogspot.com

Attempting to follow your steps: 1. Click on System Settings 2. Click on YaST icon 3. Administrator password dialog pops up. Guess that didn't work. :-) Bryen -- To unsubscribe, e-mail: opensuse-gnome+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-gnome+owner@opensuse.org