/srv/irclogs.ubuntu.com/2007/11/15/#ubuntu-meeting.txt

=== vorian_ is now known as vorian
=== asac_ is now known as asac
=== asac_ is now known as asac
=== _czessi is now known as Czessi
|Giskard|hi :)05:04
|Giskard|somebody here?05:05
|Giskard|hallo?05:05
=== RichEd-1 is now known as RichEd
=== ubotu changed the topic of #ubuntu-meeting to: Calendar: http://fridge.ubuntu.com/event | Logs: https://wiki.ubuntu.com/MeetingLogs/ | 15 Nov 14:00 UTC: Desktop Team Development | 22 Nov 14:00 UTC: Desktop Team Development | 23 Nov 12:00 UTC: MOTU meeting | 29 Nov 14:00 UTC: Desktop Team Development
krautmoin07:47
=== soren_ is now known as soren
=== dholbach_ is now known as dholbach
=== zul_ is now known as zul
=== ubotu changed the topic of #ubuntu-meeting to: Current meeting: Desktop Team Development Calendar: http://fridge.ubuntu.com/event | Logs: https://wiki.ubuntu.com/MeetingLogs/ | 22 Nov 14:00 UTC: Desktop Team Development | 23 Nov 12:00 UTC: MOTU meeting | 29 Nov 14:00 UTC: Desktop Team Development
kwwiihi all13:55
pittihi13:57
seb128hey pitti13:57
Hobbseeargh, it's a scary people meeting!13:58
Keybukscary people?13:58
* Hobbsee points at Keybuk. yes.13:58
Hobbseedon't you count as scary?13:58
kwwiiHobbsee: stop being sKary13:58
* mvo waves13:58
* Hobbsee trouts kwwii13:59
kwwii*ouch*13:59
* Mithrandir gives Hobbsee some fresh salmon13:59
Hobbseekwwii: would now be an appropriate tiem to mention that i'm not running kubuntu?14:00
* Hobbsee smacks Keybuk with the salmon, then14:00
kwwiiHobbsee: don't tell me, tell Riddell14:00
* seb128 hugs Hobbsee14:00
Hobbsee(thanks. that's useful)14:00
* Hobbsee hugs seb12814:00
seb128;-)14:00
MithrandirHobbsee: welcome to the dark^Wbrown side.14:00
HobbseeMithrandir: it's not brown anymore :)14:00
kwwiilol, black and orange!14:00
HobbseeMithrandir: bar the panels, looks remarkably like kubuntu.14:00
Hobbseenah.  bluey-purple.  :)14:01
Mithrandirorangish, then14:01
KeybukRiddell: ping14:01
Mithrandirkwwii: incidentially, the default openbox theme is quite a good match for our default look.14:01
kwwiiMithrandir: cool, i will check it out14:02
MacSlowGreetings everybody14:03
KeybukWelcome back everybody14:03
KeybukHow's everyone settling back into their own timezones?14:03
pitti~ sweet ~14:03
* kwwii actually slept through the whole night14:03
{ted}Pretty good.14:04
pittisurprisingly easy, due to not being able to sleep on planes I could actually sleep Sunda ynight14:04
{ted}I had the easy one though.14:04
MacSlowKeybuk, sunday and monday felt a bit odd14:04
* mvo is mostly good as well14:04
KeybukBetter than me then!  I slept most of Sunday daytime and thus am still vaguely unsure what day it is14:04
MacSlowbut since tuesday everything feels solid again14:04
pitti{ted}: how have your first 'remote' days been? grinded through all the NewStaffTasks?14:05
seb128I was sleepy on sunday afternoon and I'm back on local time since monday ;-)14:05
KeybukFirst thing on the agenda, Welcome Aboard to {ted}!14:05
MacSlow{ted}, official greetings!14:06
{ted}pitti: I've done a bunch of them, I need to ensure that I've done them all.14:06
pitti{ted}: can you consider using [ted] instead, for no-shift-love? :)14:06
{ted}I'm pretty thrilled that my simple package finally built.14:06
mvo{ted}: welcome!14:06
{ted}Hmm, yeah, I thought for some reason the nickserv wouldnt' let me have that one.14:06
MacSlow{ted}, took me a few days to make sure I did all needed pieces14:06
seb128{ted}: could you use a nickname without special chat at the start? it hurts my hand to use the modifier14:06
* ogra would guess "ted" is taken14:06
seb128[ also needs a modifier on french layout :(14:07
MacSlowindeed... AltGr-7 is ugly14:07
{ted}Hmm, I might have to come up with something clever ;)14:07
MacSlowseb128, we should switch to US-layout14:07
kwwiihe is just making sure you really want to chat with him ;-)14:07
seb128MacSlow: I like to give non-english testing to Ubuntu because we have non-english users apparently14:07
MacSlow{ted}, what about TheTed?14:07
pittiMacSlow: US layout is *so* much better for programming, vim, etc.14:07
pittitgould?14:07
MacSlowpitti, hell yeah14:08
pittianyway, OT for meeting14:08
KeybukAnd since {ted} has joined, and is in the balmy US/Pacific timezone, this brings us onto the second agenda item ... the meeting time14:08
Keybukthanks for all not shouting at the sudden move of an hour14:08
MacSlowKeybuk, afternoon for me so... no issues there14:08
Keybuk{ted}: are you happy with this time?  or would you prefer a little later in the day?14:08
Keybuk(obviously we now have to balance the fact the team spans nine timezones)14:08
MacSlow{ted}, must be just after getting up for you over there, right?14:09
{ted}This is good for me, it's when I normally wake up.14:09
MacSlowoh... I though all except for Ted are located in Europe14:09
{ted}It just means that i don't get to shower first.14:09
{ted}But, you guys can't smell me through IRC.14:09
pittiMacSlow: right, nothing in between the TZ span edges :)14:09
pitti{ted}: apt-get install irc-smell-plugin is not until 8.1014:10
{ted}pitti: Heh, the way things are going, I wouldn't be surprised.14:10
MacSlowpitti, some specs just should not be considered at all14:10
{ted}But, in IRC, it'll all be encoded into your nick...  just like state.14:11
pittiso, 1400 UTC then?14:11
Keybukany objections to 1400 UTC? :p14:11
MacSlownope14:11
Hobbseei object!  :P14:11
* Hobbsee shuts up again14:11
pittiHobbsee: you are awake 24 hours a day, what do you care? :)14:12
MacSlowHobbsee, can you be bribed with a cookie?14:12
{ted}nope14:12
Hobbseepitti: not quite :)14:12
HobbseeMacSlow: depends how much chocolate it contains.14:12
Keybukmvo, kwwii, Riddell?14:12
MacSlowhm... 34%14:12
pitti(OT: these American cookies were sooooo yummy)14:12
mvothat is fine with me14:12
* MacSlow misses the muffins14:12
ogras/yummy/heavy/14:12
Keybukok, next agenda item14:13
KeybukSpec Approval14:13
* MacSlow is still working on them14:13
pittiwhen can a spec go from review to pendingreview?14:13
pittierm, pendingapproval?14:13
pittiwhen we got one or two positive feedbacks from our fellows?14:13
Keybukpitti: in theory, when a "reviewer" reads it14:13
Keybukin practice, I'll read anything >= review14:14
Keybukspec approval basically involves nagging me all of next week to read your specs14:14
pittiafter Sevilla we used peer review for that14:14
Keybukplease feel free to message me on IRC with a list of those you want me to read14:14
Keybukand keep on doing it until I do it :)14:14
pittiwhich worked very well IME14:14
MacSlowKeybuk, I thought we still have time  until 22nd to bring them into shape before review/approval14:14
Keybukthat's another good option14:14
KeybukMacSlow: indeed, which is Thursday next week14:14
pittiespecially feedback from upstream is helpful14:15
MacSlowKeybuk, I should have done them before the weekend14:15
Keybukin practice, if you're mostly at review by Thursday, I'll be more than happy14:15
pittiMacSlow: NB, bring to state review != get them approved14:15
MacSlowKeybuk, the gdm dude, Jon, is pretty fast with replies... David Reveman is certainly slower with replies14:15
MacSlowpitti, indeed... I was oversimplifiying14:16
MacSlowthe process14:16
Keybukplease don't let me block you - nag and shout at me if you need me to review something14:16
{ted}MacSlow: Did you ask the GDM guy about some of the power management stuff we were talking about with the logout?  Not sure that it's going to be Hardy, but I was curious what he's thinking there.14:17
MacSlow{ted}, not yet14:17
MacSlowbut on my list14:17
Keybukdoes anyone have any questions about the spec process?14:17
pittiI would like to defer filling out the release notes part until a beta is available14:18
MacSlowI am a bit unsure about the difference between "Design" and "Implementation"14:18
KeybukMacSlow: sometimes it's often the same bit14:18
MacSlowok14:18
pitti^ I usually describe the high-level "what?" bits in design, and the actual implementation details ("how?") in implementation14:19
pittibut often, the implementation is clear from reading the design, so I think it can sometimes be skipped14:19
MacSlowpitti, changing that a bit as things go on is possible I would guess... as long as only one part "Release Notes" changes, or?14:19
Keybukspecs can change as much as you like ;)14:20
Keybukcjwatson is a great fan of rewriting a spec after implementation so that it actually matches14:20
MacSlowwell :)14:20
Keybuksince it can then serve as documentation14:20
MacSlowah... ok... I'll remember that one14:20
Keybukok14:21
Keybukpitti: PolicyKit adoption strategy?14:21
pittiright; I'm a bit nervous about this14:21
RiddellMacSlow: often my specs don't have a design at all (since if it's a port from ubuntu it has already been designed)14:21
pittisince it's basically an on/off thing (main or not at all)14:21
pittiso my current gut feeling is to do enable it in hal and put it into main, but not necessarily use it for all the things in the admin menu14:22
MacSlowRiddell, you're lucky then14:22
pittibut only for some small applications and new usage cases like g-p-m and network-manager access control for the current console, etc.14:22
pittifor hardy I'd like to keep using gksu for gnome-system-tools, for example14:23
Keybukthat sounds very reasonable14:23
pittiat least until we disable ptrace() by default in the kernel14:23
seb128I discussed that with pitti during allhand and I'm happy with doing it this way14:23
pittiit's not so much my inconfidence in the PK implementation itself14:23
pittibut more the fact that then all the admin UI will run with just user privileges14:24
mvowhat about the package tools (synaptic and friends)?14:24
pittiand thus there is no security boundary any more to other user processes14:24
pittimvo: same argument14:24
mvogksu then14:24
Keybukwhat's the ptrace issue?14:24
pittiI wouldn't like firefox plugins to install packages without notice14:24
mvowe have no tools that install without a question14:24
pittiKeybuk: e. g. if a firefox plugin ptraces users-admin or the synaptic frontend, it can use the PK privileges granted to users-admin14:25
pittiif those programs run as root, user processes can't ptrace them14:25
pittiI'm aware that you can still use Xevent injection, etc., but it's much harder14:25
Keybukbecause it can steal the PK auth token?14:25
pittiwhereas attaching gdb and calling system() is a trivial exploit14:25
pittiKeybuk: no, not steal14:25
pittiKeybuk: just execute arbitrary code in the process context of the target app14:26
Keybukahh14:26
Keybukwhat did davidz have to say about that?14:26
pittithat's why I prefer having admin GUIs run as root14:26
pitti(a common misconception is that this is a bad thing per se)14:26
pittiKeybuk: it just came to my mind after we met, unfortunately14:26
pittiI'll ask him via email, but I had to catch up with too much so far14:26
Keybukit'd be worth getting some thoughts on that14:26
Riddellpitti: doesn't policykit have a way to restrict which apps can run something?14:27
pittiso I think that using PK for things that already run as user, like g-p-m or the netapplet tool, PK is great14:27
pittiRiddell: sure it has, it assigns privileges based on process ID and executable path14:27
pittiRiddell: the point is, with ptrace() that does not help you *at all*14:27
pittiKees and I talked about this, and he also would like to disable ptrace() by default14:27
pittithat's a slight inconvenience for developers, since they have to enable it to use gdb, strace, etc.14:28
Keybuksadly I'm not helping that battle14:28
pittibut it's well worth it, IMHO14:28
Keybuksince Upstart *uses* ptrace14:28
pittiKeybuk: upstart == root, isn't it?14:28
Keybukright14:28
pitti(it should only be disabled for normal users)14:28
Keybukcertainly user ptrace should be off by default14:28
pittino reason to disable it for root14:28
Keybukthere should be a "I'm a developer" switch that enables ptrace and disables apport :)14:28
pittisomething like that, yeah14:29
seb128and change the yelp icon to a gnome-terminal one14:29
Keybukseb128: ?14:29
mvodevel mode14:29
seb128Keybuk: the icons you have on the default panel, I expect developer to want a command line rather than yelp there14:29
pittionce we have that, I'm fine with using PK for everything, since then it is equivalent protection like our current gksu (which is also susceptible to X event injection)14:30
pittiseb128: heh :)14:30
pittiso, any objection to this approach? we'll get PK for things that make good use of it, but continue to use gksudo for the main set of admin GUIs14:30
Keybukseb128: if only yelp did devhelp stuff ;)14:30
Keybuk(one of my private annoyances)14:30
* seb128 hugs pitti, looks a good approc14:31
Keybukpitti: what kind of timeline can we disable ptrace for users?14:31
pittithen we can at least drop libpam-foreground and the nasty hacks in g-v-m, g-p-m, nm-applet, etc. to only work on the currently active session14:31
Keybukpitti: absolutely no objection; it's better than pam-foreground so should immediately replace that14:31
pittiKeybuk: I don't know14:31
* pitti makes a note to mail kernel team and Kees14:31
pittithe more interesting question is probably how to enable it again14:31
pittidisabling it is probably trivial14:31
pittiit would become a sysctl, but that might not be the most obvious interface14:32
pittiso we need to build something on top of it14:32
pitti(maybe patch strace and gdb to give an explanation?)14:32
Keybukecho 1 > /proc/sys/kernel/root-me-root-me-root-me14:32
Keybukptrace has a CAP now, doesn't it?14:33
pitti"please uncomment kernel.user_ptrace in /etc/sysctl.conf" or so14:33
pittiKeybuk: I think it always had it14:33
pittiCAP_SYS_PTRACE14:33
pittioh, sorry14:33
pittithat's only to trace processes which do not belong to you14:33
pittia sysctl and useful explanation errors in strace and gdb seems like a reasonable start?14:35
Keybukyup, very14:35
Keybuk        if (((current->uid != task->euid) ||14:35
Keybuk             (current->uid != task->suid) ||14:35
Keybuk             (current->uid != task->uid) ||14:35
Keybuk             (current->gid != task->egid) ||14:35
Keybuk             (current->gid != task->sgid) ||14:35
Keybuk             (current->gid != task->gid)) && !capable(CAP_SYS_PTRACE))14:35
Keybuk                return -EPERM;14:35
pittiACTION: pitti to mail kees and kernel team about disabling ptrace and re-enabling interface14:35
pitti(argh, I can't do that, can I)14:35
Keybukcan't do which?14:35
Keybukoh, I gave up with mootbot after about the second meeting14:36
* pitti adds it to his personal TODO list14:36
seb128pitti: is there any bot set for the meeting?14:36
pittiKeybuk: ACTION:14:36
pittinevermind14:36
Keybukthe fact only the chair can do actions means I have to see, copy and paste them anyway14:36
Keybukso s/mootbot/tomboy/ :)14:36
siretartsounds easy to fix, though14:36
pittiso, I'm done with the topic, unless someone else has questions?14:36
Keybukok, next topic then14:37
KeybukPatches14:37
Keybuksend your patches upstream and to Debian whenever you can14:37
Keybuk:-)14:37
pitti++14:37
Keybukjcastro can help you find your upstream, and find out from them how they want patches delivered and at what threshold14:37
Keybuk(this is going to be the topic of the next six months)14:38
Keybuk{ted}: well done for stepping up to deal with g-p-m so quickly!14:38
pittinow, at merge time, this is an excellent time to do so, when we clean up our patches and adopt them to the current version14:38
Keybukexactly14:38
seb128we will start using tags for desktop packages soon, I just need to mail the list to settle the tags list etc14:38
Keybukthis is something we're not terrible at anyway; but we can always be brilliant14:38
seb128like adding bugzilla and launchpad bug numbers and a description in the patches14:38
MacSlowKeybuk, I will see to get as much as possible from my gutsy-work to Vincent14:39
{ted}tags?14:39
seb128and we will not accepted easily patches which are not sent upstream first14:39
pittiseb128: ah, I thought you meant https://wiki.ubuntu.com/Bugs/Debian/Usertagging14:39
seb128{ted}: comments on the top of the patch14:39
MacSlowKeybuk, I talked with Vincent already at UDS and know how he expects the stuff14:39
seb128pitti: what we discussed in Sevilla14:39
pittiFedora's policy is that they do not apply and upload a patch before it is reported upstream14:39
pittiquite rigid, but effective apparently14:40
seb128they don't respect it apparently14:40
Keybukpitti: Fedora are upstream for almost everything in their distirbution14:40
Keybukand the things that they aren't, they certainly bloody well don't do that14:40
seb128because I browse their viewcvs quite often and they do have some patches which are not upstream there14:40
Keybuklook at the number of patches to things like sysvinit which they have14:40
Keybuk(Debian is upstream for sysvinit)14:40
pittiwell, that's what Lennart told me anyway14:40
pitti(and he does)14:40
seb128we will try to do the same for desktop packages14:41
pittianyway, I just think it's an idea to be considered14:41
seb128would probably be nice to not limit to desktop but I can't speak for other teams ;-)14:41
Keybukamusingly14:41
KeybukFedora has patches in their RPMs for packages that they are upstream for14:41
jcastroseb128: do you have it written down someplace what the desktop patch policy for gnome will be?14:41
pittiheh14:41
pitti"Bow to seb128, buy him a beer, give him a hug"14:42
seb128jcastro: no, as said I need to mail the list, it's on my TODO for this week to discuss it, then I'll write it on the wiki and let you know14:42
Keybukbut our goal here isn't to pick fault in other distributions ability to send patches back14:42
Keybukbut to make sure nobody can pick fault with us :)14:42
KeybukI already think we do a better job than anybody else14:42
* mvo is very happy about this policy!14:42
Keybukbut we can always do better14:42
seb128Keybuk: depending of the "we"14:42
seb128I think it's less than optimal in MOTU land14:43
pitti*nod*14:43
Keybukthat's possibly true14:43
pittithis should probably be incorporated into the MOTU training process14:43
seb128anyway that's OT for this meeting probably14:43
Keybukthat's the end of my list of topics14:43
Keybukany other business?14:43
Hobbseepitti: it already is, community side.14:44
pittiHobbsee: it hasn't always been that way, though14:44
pittibut good to know that it is like that now14:44
Hobbseepitti: has been emphasised in the las tcouple of releases, but perhaps not enough, making it mandatory, etc.14:45
Riddellhave we considered asking QA for help with New queue and archive admin?14:45
* MacSlow forgot lunch today14:46
Riddellsince New queue is essentially QA14:46
seb128it should not be14:46
seb128what is uploaded should have been QA reviewed first14:46
dholbachwe have a lot of MOTUs feeding back patches and in sponsoring bugs it is requested a lot, though the degree of feeding of course back varies14:46
Riddellseb128: what should it be then?14:47
pittiisn't that a classic archive-admin task?14:47
Hobbsee Riddell motu's, etc, should be doing the job of qa14:47
Hobbseeas in, checking it.14:47
Riddellthe emphasis is different from revu et al, but it's essentially just another check14:47
Hobbseethere shouldnt *be* anything in that queue that isnt fine to upload.  although i'm aware that it's not the case.14:48
pittiHobbsee: it's not that bad, though14:48
seb128well, I would not trust all the QA people to accept packages in the archive14:48
pittimost rejections are due to licensing issues, not due to bad packaging14:48
pitti(IME anyway)14:48
Keybuk(no other business? => end of meeting, to let you continue the discussion)14:48
seb128Keybuk: thanks14:48
pittithanks everyone14:48
Keybukif you haven't already done so, make sure you get your performance review feedback in by tomorrow (for canonical staff except MacSlow and {ted})14:48
mvothanks14:49
Hobbseepitti: true, but motu's should be doing licencing too, no?14:49
Riddellseb128: indeed, I'd be unsure if there's enough packaging experience14:49
pittiHobbsee: they should, yes14:49
* Hobbsee should be in bed. night all.14:49
seb128Riddell: not only packaging, I'm not sure QA people know or care about licenses14:49
seb128Hobbsee: 'night14:50
RiddellI include caring about licence in packaging expertese :)14:50
pittiRiddell: btw, seb128 and I thought a "do three source NEWs a day" approach for the three of us would work; WDYT?14:50
seb128pitti: works for me14:50
pitti(until the current backlog is finished)14:50
seb128should we claim the packages we review somewhere?14:50
pittithen, with so many archive days we shouldn't get a big backlog anytime soon14:50
Riddellthat would take about 6 weeks to clear the backlog14:51
pittiRiddell: no, it's only 30ish Ubuntu source NEWs14:51
seb128Riddell: there is not so many source NEW, that should rather be a week14:51
Riddellright, does seem like a good idea14:51
MacSlowhe's taking the shower now I bet14:51
pittiok, seems we are done; thanks again everyone14:52
seb128thanks pitti14:52
* MacSlow goes for late lunch now14:53
=== avatar__ is now known as avatar_
=== ogra1 is now known as ogra
=== ubotu changed the topic of #ubuntu-meeting to: Calendar: http://fridge.ubuntu.com/event | Logs: https://wiki.ubuntu.com/MeetingLogs/ | 22 Nov 14:00 UTC: Desktop Team Development | 23 Nov 12:00 UTC: MOTU meeting | 29 Nov 14:00 UTC: Desktop Team Development
=== j_ack_ is now known as j_ack
=== doko_ is now known as doko
=== bdmurray_ is now known as bdmurray
=== illovae_ is now known as illovae
=== Mithrand1r is now known as Mithrandir

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!