Am 24.10.2011 16:41, schrieb Pascal Bleser:

On 2011-10-25 01:14:31 (+0200), Will Stephenson wrote:

...

On Monday 24 Oct 2011 22:35:37 Ilya Chernykh wrote:

...

I think you could add info on KDE3 being included in 12.1. Possibly it worth mentioning that this makes asylum for at least a part of users who dislike Gnome 3. This is my strong objection to mentioning KDE 3 in our 12.1 marketing and release notes. SUSE has a long and undistinguished history of letting noisy tails wag the whole dog, but there is no need for the openSUSE project to continue this. [...]

+1 to everything you wrote (and I was a strong proponent of keeping KDE3 with KDE4 in.. I don't even remember which version that was.. :))

But the situation has changed, a lot. KDE3 really is a dead cow.

The wording of Ilya to call his project KDE3 is unfortunate. But you, and others, take to context and put the word "dead" close to Trinity, which is of course based on KDE3. Still you are not talking about KDE3. You talk about Trinity and the Trinities teams work in this thread. We all know how much of love goes in most peoples projects. It is in most cases a very personal thing. I am shocked seeing you beating a smaller project on this emotional level. Such vocal killings are IMO non sensible, especially so close inside the openSUSE community.

Otherwise the openSUSE

community as being welcoming looses value.While the point back then was that almost everyone was on KDE3 and that KDE4 wasn't ready for prime time, and that we would alienate a lot of users, this is absolutely not the case any more as of today. Everyone besides a small niche has moved to KDE4, and KDE4 is definitely ready for the job.

I am pretty sure you have useful arguments about, why you do not want to support a KDE3 fork. That's easily understandable as argument. No need to spread bad feeling around. kind regards Kai-Uwe PS: sorry, if my post distracts from the original topic. But a direct answer seems most appropriate. -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

Am 25.10.2011 19:14, schrieb Sven Burmeister:

Am Dienstag, 25. Oktober 2011, 08:15:12 schrieb Kai-Uwe Behrmann:

...

We all know how much of love goes in most peoples projects. It is in most cases a very personal thing. I am shocked seeing you beating a smaller project on this emotional level. Such vocal killings are IMO non sensible, especially so close inside the openSUSE community. What's so shocking about stating facts? Ignoring facts is shocking and Will gave you facts about the security and maintenance issues.

I am not shocked about any facts brought up in this discussion. I am shocked about the emotional stressful and disrespectful tone of some posters. That lessens seriously my joy while reading facts. kind regards Kai-Uwe -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On Tue 25 Oct 2011 12:41:26 NZDT +1300, Pascal Bleser wrote:

But the situation has changed, a lot. KDE3 really is a dead cow.

As is KDE4 if it's not really careful really soon.

While the point back then was that almost everyone was on KDE3 and that KDE4 wasn't ready for prime time, and that we would alienate a lot of users, this is absolutely not the case any more as of today. Everyone besides a small niche has moved to KDE4, and KDE4 is definitely ready for the job.

It's ready for some jobs, if you're prepared to put up with a lot of nonsense. I was using KDE3 on 11.1 and was looking forward to 11.4 a few months ago. konqueror3 was getting very long in the tooth and failing with lockups on many sites, or failing outright on javascript, but in comparison konqueror4 is just rubbish - it doesn't even handle the pfsense (firewall) UI just to mention one of the many javascript site that actually work in 3 and are dead in 4. I was trying hard to avoid the mozbloat, but bloat beats dead duck. Quite a few apps are nowhere to be seen in KDE4, like quanta. KDE4 has quite some way to go to reach where KDE3 used to be. It's way to buggy. https://bugs.kde.org/show_bug.cgi?id=258916 must about take the prize for duplicates - KDE parts crashing more than once a day and no idea where to start looking for the bug after 9 months. The only KDE bug report I had an instant response to was about the desktop 3D-flipcrap gizmos. I hope that's not indicative for where the development effort is concentrated. Gtk apps are getting steadily better, soon there'll be no point in having KDE at all. With KDE4 not having caught up yet there's talk about qt5. Is that going to be a repeat of years of unfinished deadlined 4 with gutless useless 5? Sure there are a few good things in KDE 4 but sorry the bottom line is a disappointment. I appreciate the apps from 3 that are still around and working. Volker -- Volker Kuhlmann http://volker.dnsalias.net/ Please do not CC list postings to me. -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

Le 25/10/2011 10:33, Matt Gray a écrit :

It is a fine thing that opensuse is flexible thing interested in accommodating the needs of many, but marketing what is demonstrably the past will not help opensuse grow, and will distract potential users from the real innovations contained therein.

I don't agree. I can perfectly accept the security reasons, but is kde so exposed to security risks (apart may be konkeror)? But the fact that openSUSE follow the user for a long time is very good. New user may be glad to understand that openSUSE wont let him down at the next unnecessary change, if ever once kde developpers (or any other) want to change to what ever they imagine is better, like they did for kde3->kde4. What do think koffice users? This don't mean we have to follow everything, but is some users are voluteer enough to make a follow up, we have to thank them and advertise the result. If not, why advertise evergreen? or Tumbleweed (how many maintainer have them??) Of course, we have to word this accordingly. having kde3 is not the last brand new info, but having a "we wont let you alone" chapter is good. jdd -- http://www.dodin.net http://pizzanetti.fr -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

Le 25/10/2011 11:27, Pascal Bleser a écrit :

...

I can perfectly accept the security reasons, but is kde so exposed to security risks (apart may be konkeror)?

Yes. Cmon, if Will says so, it's yes. How much C++ coding in Qt3 and KDE3 have you done to question his opinion on this ?

and why should I have? All the ports of my computer are closed and I don't use kde for browsing, my firewall is up. where can I have problems? I see in the wild many package that are not maintained, think of wodim, for example. I agree that kde if a big one :-). But still, what harm can do it's use? better do you have any example of big problems really seen?

But still, it's just wrong to advertise that as a new feature of 12.1 and to emphasize it.

of course it's not a "new" feature

If the handful of people who currently maintain KDE3 give up, which is very likely to happen because: 1) almost no one uses KDE3 any more, so the effort is rather futile,

is there a real way to know that? (obs statistics?)

2) they're just a handful of people and it's doubtful they know

looks like that people are only packaging. so yes, soon or late we will have to let this out, like we will have to let out 11.1 jdd -- http://www.dodin.net http://pizzanetti.fr -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

Le 25/10/2011 11:41, Vincent Untz a écrit :

Vulnerabilities do not always come from ports that are open. It can be a PDF file that is mis-interpreted, for instance...

well... and then? I don't want to be too long, nor hijack a thread. but have real threat be signaled against kde3 (links, please)? I mean, it's the same as using any distro: there are major bugs that have to be fixed for security (ssh bug, firefox ones...), and usual bugs that may give data loss but we can live with. for me security is the risk of opening my computer to bad people. is there a known list of major such security break in kde3? (it's a real question, I hope you can say yes and give me the link) I say so, because I every day experiment situations where security is more an obsessive compulsion than a real threat. This is not a bad thing when dealing with new products, but don't have to go too far. I "manage" a server driven by a debian 3.0 not updated since ages and never compromised - I simply can't update it (hardware too old) and work on openSUSE when I should take time building a replacement server. It runs since year 2000 and I wonder why it's still up and running :-). I don't advertise anybody to do the same, only that the risk may not be always as big as one think jdd -- http://www.dodin.net http://pizzanetti.fr -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On 10/25/2011 05:58 AM, jdd wrote:

Le 25/10/2011 11:41, Vincent Untz a écrit :

...

Vulnerabilities do not always come from ports that are open. It can be a PDF file that is mis-interpreted, for instance...

well... and then?

I don't want to be too long, nor hijack a thread. but have real threat be signaled against kde3 (links, please)?

I mean, it's the same as using any distro: there are major bugs that have to be fixed for security (ssh bug, firefox ones...), and usual bugs that may give data loss but we can live with.

for me security is the risk of opening my computer to bad people.

is there a known list of major such security break in kde3? (it's a real question, I hope you can say yes and give me the link)

Will already answered this question about 20 minutes prior to your post: "http://www.kde.org/info/security/ is a start. Nobody cares to systematically correlate bugs found and fixed in KDE 4 with KDE 3 any more though. Some maintainers have mass-closed their KDE 3 bugs. The Trinity bugtracker is mainly concerned with integration issues with recent Kubuntu releaeses. I occasionally get a CVE vs KDE 3 code which I fix, but there must be a lot of stuff getting by, simply due to the high degree of commonality of non-Plasma KDE3 and KDE4 code. " Later, Robert -- Robert Schweikert MAY THE SOURCE BE WITH YOU SUSE-IBM Software Integration Center LINUX Tech Lead rjschwei@suse.com rschweik@ca.ibm.com 781-464-8147 -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On 10/25/2011 07:33 AM, jdd wrote:

Le 25/10/2011 13:17, Robert Schweikert a écrit :

...

Will already answered this question about 20 minutes prior to your post:

seems like some posts go to project and some others to factory

Yes, the problem with people cross-posting, annoying.

...

correlate bugs found and fixed in KDE 4 with KDE 3 any more though. Some

do you mean kde3 and kde4 suffers same bugs?

No it means that no one is tracking the existing security vulnerabilities in KDE3 anymore because the majority of KDE developers have moved on to the current version.

I got the image than kde3 and kde4 where completely different coding

jdd

-- Robert Schweikert MAY THE SOURCE BE WITH YOU SUSE-IBM Software Integration Center LINUX Tech Lead rjschwei@suse.com rschweik@ca.ibm.com 781-464-8147 -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On Tuesday, October 25, 2011 11:58:29 jdd wrote:

is there a known list of major such security break in kde3?

You can answer that one yourself, a good start are security fixes which never made it into Qt3. To give you a headstart, I would not use SSL for anything from Qt3 since the certificates it shipped have never been updated -- and that's just a very recent one one can find without digging. There are so many security-critical components in there, it's not even funny. I'd strongly advise against using KDE3 nowadays, and would certainly not advertise it. So yes, there are _real_ security problems when using KDE 3. It's basically one big brown paperbag filled brown paper bags. -- sebas http://www.kde.org | http://vizZzion.org | GPG Key ID: 9119 0EF9 -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On Tuesday, October 25, 2011 11:31:08 AM jdd wrote:

do you have practical example of problems?

Recently one certification authority (company) was removed from all browsers that are still maintained. Reason for that is that they were tricked to issue few fake certificates. KDE3 list is not updated so users are vulnerable. -- Regards, Rajko -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

jdd wrote:

Le 26/10/2011 03:36, Rajko M. a écrit :

...

On Tuesday, October 25, 2011 11:31:08 AM jdd wrote:

...

do you have practical example of problems?

Recently one certification authority (company) was removed from all browsers that are still maintained. Reason for that is that they were tricked to issue few fake certificates. KDE3 list is not updated so users are vulnerable.

but do you know of computer compromised by this? When I mean practical, I mean real problem, not virtual ones. For example what the fake certificates where used for?

Well, you have to ask some affected Iranian. This list likely has the wrong audience. Anyways, in general no package must include it's own list of root CA certificates but rather use the distro provided defaults. If you find some package that includes it's own list please file a bug and let the package maintainer fix it (CC security). Should be an easy task. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg) -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

Rajko M. wrote:

On Wednesday, October 26, 2011 02:05:37 AM Ludwig Nussel wrote:

...

Anyways, in general no package must include it's own list of root CA certificates but rather use the distro provided defaults. If you find some package that includes it's own list please file a bug and let the package maintainer fix it (CC security). Should be an easy task.

Is that valid for Mozilla products and Chromium?

It would be desirable, yes. The system list is Mozilla's anyways. AFAIK Chromium uses NSS too so if NSS was able to read an external source instead of only the compiled in(!) ones both browsers would automatically use the system certs. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On Wednesday, October 26, 2011 01:53:27 AM jdd wrote: ...

but do you know of computer compromised by this? When I mean practical, I mean real problem, not virtual ones. For example what the fake certificates where used for?

To let man in the middle pretend it is a Google and few other, including Dutch government. Company is DigiNotar and you can check Wikipedia for digest of what happened.

... jdd

-- Regards, Rajko -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

Le 27/10/2011 11:42, Carlos E. R. a écrit :

The danger is for any non-upated browser on any OS.

I don't know if our KDE3 was updated for this one.

better not use konkeror then for going out of the computer jdd -- http://www.dodin.net http://pizzanetti.fr -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

Le jeudi 27 octobre 2011, à 09:51 -0500, Larry Finger a écrit :

The Testing Core Team discussed the issue of setting the default boot method and how one might switch between SystemV and systemd. Would it be possible to include some language in the release notes that tell what one needs to do? If the default is systemd and it fails for a given machine, it is a real pain to need to use the F5 method every time. I know that adding "init=/sbin/sysvinit" to the boot options line will use SystemV, but something about the "approved" method should be included.

To get something mentioned in the release notes, please file a bug against the release notes component in openSUSE 12.1. But you'll likely need to have the text first, so someone would need to answer your question (it might be that removing the systemd-sysvinit package is all you need) Cheers, Vincent -- Les gens heureux ne sont pas pressés. -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2011-10-25 11:27, Pascal Bleser wrote:

That boldly advertised great new feature of 12.1 will explode in our face. Well, not your face, you won't have to maintain the code base.

Can't you (plural) come with a phrase that somehow advertises that KDE3 is somehow still available here, without implying that it has the same level of maintenance that KDE4 has? A compromise? It is a fact that there are people still using or wanting to use KDE3. Why not tell them? Sure, not at the same level as KDE4, that's obvious. - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iEYEARECAAYFAk6mh7EACgkQtTMYHG2NR9U2yQCghJ4WOls3XEEIr9ULznLWU4rQ Tb8An3yQ+nVXPcPRNmHcAJZg/7qiwS0r =yUJ1 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

Please open up a new thread for kde3. Its deviated too much from the topic / subject On Tue, Oct 25, 2011 at 6:49 PM, Per Jessen wrote:

Pascal Bleser wrote:

...

On 2011-10-25 10:57:48 (+0200), jdd wrote:

...

Le 25/10/2011 10:33, Matt Gray a écrit :

...

It is a fine thing that opensuse is flexible thing interested in accommodating the needs of many, but marketing what is demonstrably the past will not help opensuse grow, and will distract potential users from the real innovations contained therein.

I don't agree.

I can perfectly accept the security reasons, but is kde so exposed to security risks (apart may be konkeror)?

Yes. Cmon, if Will says so, it's yes. How much C++ coding in Qt3 and KDE3 have you done to question his opinion on this ? Thought so, so it's "yes". There are lots and lots of places in the code base that are potentially subject to security issues.

The biggest security risk is usually sat in front of the screen. Regardless, it is difficult to accept that the security flaws in KDE3 should have increased since KDE4 was introduced.

-- Per Jessen, Zürich (11.4°C)

-- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

-- Regards Manu Gupta -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

Le 25/10/2011 15:19, Per Jessen a écrit :

The biggest security risk is usually sat in front of the screen. Regardless, it is difficult to accept that the security flaws in KDE3 should have increased since KDE4 was introduced.

thnak you for help :-). However, I try to be fair, and it's possible that big holes be discovered recently, or happen with new hardware. kde3 maintainers that want to continue should at least quote these (if any). I keep thinking that having such group (kde3 maintainer) is a plus for openSUSE, whatever risk it gives. I'm not so sure that the risk of having new software is not present also and we have to live with it. as we have to use metaphors, some use cars, let me use sail boats. I used to sail. I like to read wreck comments, let alone to see what was wrong and what can be done to prevent them. I wouls like to read stories of people having they server highjacked through a security hole or by kde3 security problem. I certainly wont run kde3 on any critical system, but if we should remove all the softaware nobody should run on a critical system, we would not even have internet... jdd NB: I have *lot* of such tales for windows machines :-)) -- http://www.dodin.net http://pizzanetti.fr -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org