On Tuesday 25 October 2011 07:09:28 Ilya Chernykh wrote:
On Tuesday 25 October 2011 03:14:31 Will Stephenson wrote: <snip>
1) Quality and security. Despite the KDE:KDE3 maintainer's high degree of activity in packaging every KDE 3 app out there and adapting the KDE 3 platform to build on current distributions, it is a mistake to equate this with sufficient maintenance to ensure adequate code quality to include this in our distribution.
At least I am sure the code's quality did not decrease since the last KDE 3 release, don't you think so?
It may not have decreased relative to the state of the universe in 2008, but it is 2011 now and many external things have changed. For a concrete example consider changes to proprietary instant messaging protocols since then - I am quite sure that the kopete codebase is no longer as functional as it was in 2008. In addition, consider packaging quality. You now maintain, alone, 456 packages in KDE:KDE3, many more than were were maintained in 2008 by a team of 5 full timers in the KDE team at SUSE. And you now suggest maintaining GNOME 2. Unless you're Superman, packager effort per package has decreased since 2008, and with it packaging quality.
The KDE 3 and Qt 3 codebases are massive, include code in all the worst places to have a vulnerability, have been essentially unmaintained for over 2 years now, and *include many known bugs and vulnerabilities that have only been fixed in the 4 releases*.
Good. Can you provide some links to the vulnerabilities bugreports or something related?
http://www.kde.org/info/security/ is a start. Nobody cares to systematically correlate bugs found and fixed in KDE 4 with KDE 3 any more though. Some maintainers have mass-closed their KDE 3 bugs. The Trinity bugtracker is mainly concerned with integration issues with recent Kubuntu releaeses. I occasionally get a CVE vs KDE 3 code which I fix, but there must be a lot of stuff getting by, simply due to the high degree of commonality of non-Plasma KDE3 and KDE4 code.
Assurances that the project is now maintained upstream by the Trinity project are hollow; the Trinity group is only a handful of people, none of whom are the original maintainers or developers of the code,
This is also the case of KDE4. Who of the KDE4 team are the original developers of KDE 1 or KDE 2 ?
coolo, dirk, dfaure, ossi, rich, aseigo just off the top of my head (I contributed odd patches to KDE 2 but nothing major). Even Kurt Granroth is maintaining a KDE 4 version of kbiff. And the current KDE 4 maintainers who are new since 3 or 4 have continuity with the previous maintainers, which the Trinity people do not.
and most of their effort is spent on writing a Qt4 compatibility layer and in porting the build system to cmake, not maintenance.
I think it would be impossible to port the code to cmake without maintenance? Am I wrong?
Yes, you are. The code is largely independent of the build system. Occasionally a change of build system throws up things it the code that need fixing; broken inclusion guards, symbol visibility things, but fixing these does not mandate bug fixing. In addition, It would be insanity++ to conflate general bugfixing work and porting to 'TQt' - neither would be done correctly.
In any case, the packages in KDE:KDE3 are based on 3.5.10 and only include some changes from the Trinity project's fork, which is now 3.5.12.
This is true. But we also include changes from other sources. There are many KDE 3 maintenance projects, associated with various distributions.
openSUSE Factory maintainers made an error of judgement to resume including KDE 3 packages while they demonstrably fulfil the latter 3 of our drop criteria [2], and marketing should not join them in this.
2) The message sent by a retrograde step. Being unique in a bad way is not good for the project.
I fail to see how having more users satisfied is bad. Can you elaborate this?
In answer to the rest of your points, what you suggest is placating a tiny minority of vocal 'Laggards' (http://en.wikipedia.org/wiki/Diffusion_of_innovations). This does not represent anything that will improve the image of openSUSE elsewhere. The harm caused to the project's image and the risks brought by shipping lots of crufty old code outweigh the benefit of indulging this group, who will neither promote openSUSE in gratitude nor will other groups come to openSUSE because the laggards are happy. I have no objection to you continuing to offer KDE:KDE3 as an additional repository for this group. Finally, if I may suggest a more useful way to please the diehards while making openSUSE unique: just port KDE 3 kdesktop and kicker to KDE 4, provide it as an alternate KDE 4 desktop shell in KDE:Extra. Will -- Will Stephenson, KDE Developer, openSUSE Boosters Team SUSE LINUX GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 21284 (AG Nürnberg) Maxfeldstraße 5 90409 Nürnberg Germany -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org