[00:25] something not negative if possible :P [00:26] or a nickname without bot in it but suiting the avatar [00:27] no rush, i won't do it tonight === asac_ is now known as asac [02:59] fta: ppacron? [02:59] debcron-bot? === micahg1 is now known as micahg === micahg1 is now known as micahg [05:54] [reed]: what do I do if I have a stacktrace for TB2 that matches one for FF2 that was resolved WFM [06:01] <[reed]> what is it? and what bug? [06:02] <[reed]> do you have STR? [06:08] STR? [06:08] [reed]: ? [06:09] [reed]: ? [06:09] bug 488640 and mozilla 361835 [06:09] Bug 488640 on http://launchpad.net/bugs/488640 is private [06:09] Mozilla bug 361835 in General "crash SEGV [@ nsCxPusher::Pop() ] during startup" [Critical,Resolved: worksforme] http://bugzilla.mozilla.org/show_bug.cgi?id=361835 [06:09] ugh, let me make that TB bug public [06:11] ok, it's public now [06:12] gavin: here's the Q I asked [reed]: what do I do if I have a stacktrace for TB2 that matches one for FF2 that was resolved WFM [06:13] assume it was fixed? :) [06:13] upgrade to tb3? [06:13] * gavin is kidding [06:13] not sure what context you're asking in [06:14] well, can I move to TB and reopen? [06:14] or should I file another bug in TB? [06:14] I started searching crash-stats.mozilla.com for crash reports [06:14] that's how I found it [06:15] well, it's unlikely that the problem would be fixed in tb2 unless it's very serious [06:15] given that 1.8 has been almost entirely abandoned [06:15] (especially now that tb3 is out) [06:15] gavin: ok, I'll ask the user if it's persistent or a one time thing [06:16] you 'd probably want to file a new TB bug, mark it 1.8 only, and reference 361835 [06:16] but like I said, odds of it being fixed are near-zero [06:16] gavin: ok, if the you confirms it's recurring, I'll do that [06:17] oops [06:17] if the user * [06:17] ok [06:17] gavin: thanks [06:19] np [06:22] gavin: do you know about other TB stuff? [06:22] or should I go ask TB-devs [06:24] I have another crash that's a private bugzilla bug [06:25] I know about TB stuff generally [06:25] (or even mozilla stuff generally) [06:25] ok, so there's an Ubuntu crash (2.0.0.23) that matches a windows BT on 3.0b4 [06:25] not an expert on tb specific front-end code, though [06:25] but the bugzilla bug is private and I can't see anything [06:25] what's the mozilla bug? [06:26] (I'm in the mozilla security group) [06:26] mozilla 505221 [06:26] Error: Error getting Mozilla bug #505221: NotPermitted [06:26] that bug is fixed in tb3, waiting for approval for tb2.0.0.x [06:27] gavin: would it be appropriate for me to add it as upstream in LP even though the status can't be seen? [06:27] or will it ever be public? [06:27] I can't comment on LP-appropriateness, I have no idea :) [06:28] gavin: can I assume it'll be made public if/when appropriate [06:28] it will be public once the fix is released to 1.8.1 users or that branch is EOLd, presumably [06:28] yes [06:28] or not at all [06:28] ok, I'll put it in, but in LP it won't be public so I guess it won't matter :) [06:30] gavin: how much of the stacktrace should match for crash matches? [06:31] The top 6 function calls match in this case [06:31] there's no hard-and-fast rule [06:31] that's what asac told me :) [06:31] it's possible for bugs to have different causes with the exact same stack trace [06:32] (though uncommon) [06:32] how about in this casE? [06:33] where's the LP stack trace? [06:33] can I subscribe you to the bug? [06:33] what's your LP nick? [06:34] umm, gavin-sharp I think [06:34] or gavin_sharp? [06:34] https://launchpad.net/~gavin-sharp [06:34] bug 487541 [06:34] Bug 487541 on http://launchpad.net/bugs/487541 is private [06:36] that looks consistent with the bug being fixed in mozilla 505221 [06:36] Error: Error getting Mozilla bug #505221: NotPermitted [06:36] ok gavin, thanks [06:37] gavin: can I ping you if I run into something like this again?> [06:37] sure [06:37] ok, rgeat [06:38] I'm trying to clean up TB bugs in LP before I finish TB3 for Lucid so I can close all the bugs [06:38] gavin: BTW, that bug is fixed in TB3 release or 3.0.1? [06:40] tb3 [06:41] ok, great, that's what I marked [06:44] gavin, regarding mozilla 534663, are the keywords stored in the search engine files? [06:44] Mozilla bug 534663 in Search "[ubuntu] updates overwrite/erases defined keywords for default search engines" [Minor,New] http://bugzilla.mozilla.org/show_bug.cgi?id=534663 [06:44] no [06:44] they're stored in search.sqlite in the profile [06:45] and associated with the plugin using its filename [06:45] gavin: filename or full path? [06:45] filename if in the profile or appdir, full path otherwise [06:46] (in particular, full path for extension-shipped plugins) [06:46] (which AIUI is what ubuntu releases use) [06:47] it's pretty unusual for extension on-disk locations to change [06:47] so the search service doesn't handle that case [06:51] gavin: we actually don't store them directly in the install dir probably for that reason [06:53] for what reason? [06:54] because of the path issues [06:54] we symlink the searchplugins dir in the ff dir [06:54] but they are stored else where [06:55] we store them here: https://bugzilla.mozilla.org/show_bug.cgi?id=534663 [06:55] oops [06:55] Mozilla bug 534663 in Search "[ubuntu] updates overwrite/erases defined keywords for default search engines" [Minor,New] [06:55] we store them here: /usr/lib/firefox-addons/searchplugins/en-US/ [06:56] I'm not sure what "path issues" you're referring to [06:56] the only issues I'm aware of are a result of _not_ storing them in the appdir [06:57] gavin: the moving paths for ff dir in ubuntu [06:58] oh, I see [06:58] you mean that you've tried to work around 534663 by not storing them in the appdir? [06:58] so, is there anything we can do to make the path show where the plugins actually are which doesn't change [06:58] so it seems [07:01] I guess it depends on the location of the extension more than it does the location of the actual plugin files [07:01] though if you're saying that you just symlink them into the app dir, then that theory isn't valid anymore [07:02] gavin: well, I guess the app looks in the app dir...can we have the path resolve the symlink before storing in the sqlite db? [07:03] so that it stores the actual path? [07:03] the problem is the opposite [07:03] we don't want it to store the actual path (since that changes), but it is being saved [07:04] gavin: in Ubuntu, the actual path doesn't change, but the symlink location does [07:04] oh [07:04] where the symlink resolves is constant [07:04] ok I misunderstood - get it now [07:04] that actually makes more sense [07:04] but it's storing the app dir [07:04] (I couldn't figure out why we'd be resolving the symlink) [07:05] but if it's in the appdir, we should only be storing appdir-relative paths [07:05] brb [07:05] which means that this should get fixed after restarts [07:06] which is consistent with the reports in the original bug [07:06] I just assumed the prolem in the ne w bug persisted after restarts [07:06] * gavin 's connection to his irc client is quite laggy for some reason [07:09] gavin: it does [07:09] the problem is after restart the keywords are wiped [07:09] yeah I just saw your comment on the mozilla bug [07:09] clearly I'm not reading these reports closely enough and jumping to conclusions :) [07:10] * micahg is good at that too :) [07:12] gavin: so, is there anything I can do to help with that bug? [07:13] not sure offhand [07:13] only scenario I can think of where that would happen is if the search plugin file name changes [07:14] well, the symlink is APP_DIR/distribution/searchplugins -> /usr/lib/firefox-addons/searchplugins [07:16] should I add these comments to the bugzilla bug [07:21] sure [07:21] I'll have to give this some thought and do some testing [07:21] ok, great, I'll watch for any comments and try to give prompt feedback [07:29] ok gavin, thanks for your help tonight, I must go to sleep now === jtv1 is now known as jtv [11:26] morning [11:45] it's everywhere.. http://www.sofaraway.org/ubuntu/tmp/chrome-ad.png [11:49] lol [11:50] and was that got while using Chrome? [11:50] aahah [12:02] there're two chrome ads in there, one around the page, and one in the banner to give it as a gift to someone else [12:04] gavin: i think this "searchplugin config reset on upgrade bug" is related to the "distribution/..." directory for shipping them (or because we ship them in a lang specific dir) [12:04] (if this is what was talked about above) [12:08] asac, BUGabundo_work: if you want to contribute: http://identi.ca/conversation/17175657#notice-17190196 [12:10] fta: i was positive about moving it to 4am ;) [12:10] ah ;) [12:10] dayfood ;) [12:11] date [12:11] !time [12:11] Information about using and setting your computer's clock on Ubuntu can be found at https://help.ubuntu.com/community/UbuntuTime - See https://help.ubuntu.com/9.04/serverguide/C/NTP.html for information on usage of the Network Time Protocol (NTP) [12:11] !now [12:13] asac, does dayfood match http://www.sofaraway.org/ubuntu/tmp/ppabot-192-192.png ? [12:13] hehe [12:13] most likely not [12:13] spinman ;) [12:14] pushman [12:14] lol [12:14] looks nice ;) [12:14] powerbot [12:14] pushbot [12:14] no idea ;) [12:15] stempify ;) [12:16] what is 12:40 pm? [12:16] is that midnight or lunchtime? [12:16] hmm [12:16] guess lunch [12:19] so far, i like dabot, debot, botronik, drobotik [12:20] asac, http://en.wikipedia.org/wiki/12-hour_clock#Confusion_at_noon_and_midnight [12:20] 12pm is noon [12:21] crazy americans [12:21] great. so its ambiguous [12:21] like 12 a.m. for US government [12:21] otherwise 12 pm ;) [12:26] asac, so, how's chromium on arm now? [12:27] didnt work the last fays [12:27] days [12:27] last build still got snaps/sigills in the browser window with the same probs [12:27] like an infinite backtrace in abort [12:28] seems its badly trashed [12:28] hm [12:29] how come it works fine in chromeos then? [12:29] does chromeos work on arm? [12:29] 'armv7': 1, # Optional, for targeting ARMv7. [12:29] 'arm_thumb': 1, # Optional, for targetting thumb. Combine with armv7 to target thumb2. [12:29] i think we could try just arm_thumb [12:29] and not armv7 [12:30] but thats just another attempt [12:30] unfortunately there is no valgrind etc. [12:30] on arm [12:30] i wanted to try a cross compiled build like on the arm page [12:38] chromeos supports x86 and arm [12:45] fta: are all the testbinaries runnable locally if we build with testsuite? [12:45] fta: maybe we should do that for once again [12:45] and then debug [12:45] yes [12:45] but please add 'arm_thumb': 1, [12:45] 'arm_thumb': 1, # Optional, for targetting thumb. Combine with armv7 to target thumb2. [12:45] if you havent [12:46] hmm already in there [12:47] fta: do we have debug symbols for the testsuite stuff? [12:47] everything is built with -g, so the unstripped binaries (in out/) should be fine [12:48] but it's no longer packaged [12:52] the last arm build was with GYP_DEFINES="target_arch=arm disable_nacl=1 v8_use_snapshot=false linux_use_tcmalloc=0 armv7=1 arm_thumb=1 no_strict_aliasing=1 gcc_version=44 ..." [12:53] fta: no strict aliasing? [12:54] why is gcc_version needed? [12:54] it's set by gcc_version=44 [12:54] well. i see that. but why? [12:54] http://code.google.com/p/chromium/wiki/LinuxChromiumArm [12:54] its not there [12:54] well, i can drop no_strict_aliasing=1 now [12:54] ah [12:54] it was needed for v8 [12:54] thats what you referred to [12:54] but it shouldn't matter for you [12:55] and the gcc_version is still needed? [12:55] shouldnt gyp detect such things? [12:55] yeah [12:55] i need to have a fresh look at the gyp rules [12:55] just checking what is different [12:55] from the arm instructions [12:55] personally i think that a) the chromeos arm thing is built from some branch/tag [12:56] or b) its a toolchain bug for a native build vs. a cross compiler build [12:56] i think a) is more likely as the toolchain is basically the same i guess [13:05] ok, so it seems gcc_version is autodetected now, and that it adds -fno-strict-aliasing & -fno-tree-vrp in v8 when set [13:05] meaning it's not set globally [13:05] i will update the branch accordingly [13:08] done [13:25] fta: chomobot [13:26] it's not dedicated to chrome [13:26] -ium [13:28] fbot ? [13:28] fabbot ? [13:28] fabot? [13:28] bienbot? [13:28] EiffelBuilder? [13:46] hm [13:46] asac, FIREFOX_3_0_17_BUILD1 & FIREFOX_3_5_7_RELEASE [13:47] asac, they too should do continuous releases [13:47] fta: yeah. i think its first jan week [13:47] and yes. thats more or less what they are already doing [13:47] and will move further that way. [13:47] however, their branch procedure is more transparent [13:48] but moving _RELEASE tags are very confusing [13:49] a tag should never move [14:09] fta: yeah. thats a prob. but its a "potential" release tag [14:09] fta: we use system cairo for chrom? [14:11] nope, there's no cairo in there, but skia [14:12] kk [15:35] http://mashable.com/2009/12/20/firefox-popular-browser/ [15:35] FF wininng in Europe [16:43] fta: is there a reason why ff search plugins are in APP_DIR/distribution/searchplugins? [17:09] micahg: yes. thats where distributors are supposed to ship search plugins (main reason). also iirc its the only place where we can ship localized searchplugins [17:09] ah asac, you're back :) [17:10] no ;) [17:10] just checking [17:10] ok, asac, well, when will you be back? [17:11] BOY [17:11] but most likely more active between chris and new y [17:11] i am just gone for like 3 days now? ;) [17:12] yeah, ok, I'm going to try to have TB3 up on review before EOY [17:12] REVU I mean [17:13] asac: ok, so I'll check back with you next Monday [17:13] micahg: no REVU needed [17:13] just let me know when its ready and i upload. we dont even change package names afaik [17:14] asac: ok, I just thought you'd want to look at the changes [17:14] but I guess you can do that in the bzr repo [17:14] micahg: can do that on branch [17:14] its much easier [17:14] yeah [17:14] ok [17:14] micahg: maybe not push to the release branch, but to a topic branch [17:14] so i can look [17:14] try to commit step by step rather than one big chunk [17:14] ok [17:15] i think starting with current thunderbird.dev is fine... the ncopy the current tbird 3.0.head there .... and then change step by step back to the non-versioned approach [17:15] ok, I was going to try some of the documentation on merging bzr branches that was created recently [17:15] I'm also trying to clean up TB bugs so we can close a whole lot with this upload [17:23] micahg: that would be heroic [17:24] I have 23 bugs targeted aleady [17:24] *already [17:25] wow [17:28] they're all fixed upstream :) [17:30] yeah. everything else would be odd ;) (like fixed downstream) [17:31] fta: wheres chromium? http://www.w3schools.com/browsers/browsers_stats.asp [17:56] BUGabundo_work, in Chrome, upstream rejected my patch to expose Chromium (and ubuntu) in the UA [17:56] BUGabundo_work, but those stats are weird, no way IE is at 38% and FF at 47% [17:56] we should patch it still ;) [17:57] we dont want to help contribute to another powerful brand ;) [17:57] at least my opinion [17:58] asac, debian/patches/chromium_useragent.patch is still in the branch [17:58] once folks start to say: "hey, this sucks because its called chromium" then we have failed :) [17:58] asac: ahaha [17:58] or not working in sites like it happens with minefield [17:58] like everyone goes made if you unbrand firefox or ship shiretoko and blame everything on the name [17:59] BUGabundo_work: yeah. but atm lots of sites dont recognize chrome [17:59] so better not help them ;) [17:59] though we are probably not really powerful. but we could ensure that webdesigners that start matching for chrome somehow find out about chromium too [17:59] asac: Hello, I was talking to you 3 weeks ago about building libmozjs from xulrunner-1.9.1, and you said that it would be provided when xulrunner goes to universe, I just checked, and I found that xulrunner *IS* in universe [17:59] so best practices start to match for both [17:59] AnAnt: xulrunner-1.9.1 isnt [18:00] the old stuff is in universe [18:00] but that doesnt help [18:01] asac: oh, you mean xulrunner-1.9.1 at that time then ? [18:01] I don't understand why does it have to be in universe [18:02] I understand that there is an API/ABI incompatability between xulrunner 1.8 & xulrunner 1.9 [18:02] i am not sure about that either (which is why i would prefer to not ship libmozjs at all) .... as this assumes we can break stuff in universe [18:02] in security updates [18:03] http://code.google.com/p/chromium/issues/detail?id=17095 [18:03] or it assumes we can just not provide security updates for universe stuf [18:03] yeah i know about that [18:04] AnAnt: do you understand the point? in short: we cannot backport security fixes for js engine. so once a branch goes EOL we have no choice to abandon it [18:04] which would mean that all folks using libmozjs would be insecur [18:04] e [18:04] http://code.google.com/p/chromium/issues/detail?id=27471 [18:04] if we dont abandon it we need to forwardport everything [18:04] if the branch goes EOL [18:05] what branch goes EOL ? [18:05] 1.8 ? [18:05] sorry, I'm lost [18:06] all branches go EOL [18:06] you have to think about the future [18:07] whatever we put in now will be EOL soon [18:07] atm only 1.9 is EOL. ... beginning next year 1.9 will be EOL and q bit later 1.9.1 [18:07] ok [18:08] so , what's the problem with that ? [18:08] read what i wrote above ;) [18:08] 19:04 < asac> AnAnt: do you understand the point? in short: we cannot backport security fixes for js engine. so once a branch goes EOL we have no choice to abandon it [18:08] 19:04 < asac> which would mean that all folks using libmozjs would be insecur [18:09] EOL End Of Life / Support [18:09] ok, if xulrunner- builds libmozjs, so when 1.9 dies, 1.9.1 will build libmozjs, so what's the problem ? [18:12] AnAnt: libmozjs for 1.9.1 is not compatible with 1.9 mozjs [18:12] so everything that depends on it will break if you just reaplce it [18:12] so it will be libmozjs1 libmozjs2,... [18:13] yes, if you take that approach you just abandon the old branch [18:13] leaving all consumers of the old libmozjs insecure [18:13] well, that won't be the only library doing so [18:14] no other library we have has loads of CVEs open [18:14] in ubuntu we keep libs maintained [18:14] with patches backported [18:14] and dont do library transitions for stable releases [18:14] thats the whole point [18:14] but we cannot do that for libmozjs [18:14] you are welcome to do some excersized [18:14] s [18:15] try to backport all missing CVEs from xul 1.9 to xul 1.8 [18:15] I see, so the problem is that libmozjs has many security issues, that's why you don't want to abandon old libraries, right ? [18:15] ubuntu policy mandates to not abadon anything that is in main [18:16] aha [18:16] for universe its just hearless to do that [18:16] ok, I get it now [18:16] thats why i said that theoretically we can just abandon stuff in universe [18:16] but in practice it would be unfair to do that ... especially if we know up-front that we will end up in this situation [18:17] (if things happen unexpectedly its a bit better ethically) [18:17] thats basically why we also considered to remove xulrunner alltogether [18:17] no xulrunner ... no libs from mozilla [18:17] nothing, but their top-notch apps [18:17] but there are apps using xulrunner [18:18] yes, all those have to die then [18:18] its not nice, but its not our decision [18:19] i fought for years to get mozilla understand that they bust a huge bunch of folks relying on them, but they clearly dont want that and hence, the only thing i can send out to programmers that use xulrunner or libmozjs [18:19] is that they choosed crappy stuff as their base [18:19] ok, I have a question, I understand that Debian give high importance to such security issues, yet they don't take that approach you mention [18:19] asac: btw, is there another option than libmozjs ? [18:19] AnAnt: history is: years ago, there was no security support in debian [18:20] AnAnt: then i stepped up, doing backports, extracing zillion of patches for years [18:20] noone else did it ever [18:20] they will just not provide security support as before [18:20] thats my bet [18:20] they had some conflicts in the past, but couldnt do it and hence didnt do it [18:21] so i think tats where they are heading [18:21] we had long discussions with security team [18:21] etc. [18:21] most likely all xul based apps (incl. libmozjs) cannot go into a stable distribution [18:21] e.g. always unstable only [18:21] i should actually start that discussion again [18:21] asac: btw, is there another option (for developers) than xulrunner & libmozjs ? [18:21] no [18:21] you can go for webkit [18:21] so developers don't have a choice [18:22] but even there our security team is strugeling hard [18:22] it might be a bit better [18:22] I mean, they didn't *choose* crappy stuff [18:22] dont argue with me [18:22] it breaks my hard more than anyones else [18:22] heart [18:23] so webkit supports javascript ? [18:23] AnAnt: atm they need to go to webkit and hope that its all fine [18:23] AnAnt: yes. [18:23] but webkit is fresh and i know its similar painful as mozilla to support ... however, they have a bit more stable API for embedding [18:23] for js i dont know [18:23] v8 (google javascript) has no stable abi/api policy either [18:24] ok, I'll talk with upstreams of software I care about about this webkit, thanks [18:24] so in short: someone needs to step up and support stuff ... most likely target is couchdb project [18:24] which is a well funded project that relies on it [18:24] but only way to convince them is to be harder i think [18:25] they have the attitude: "it will just resolve on its own" [18:25] couchdb ? isn't that a database thing ? [18:25] thats a javascript based database ... yes. [18:25] you write stored procedures in javascript or something [18:25] also it uses json [18:25] etc. [18:25] its the only app in main that we have that uses mozjs [18:25] which causes me to cry every day ;) [18:25] that it exists [18:27] its a big mess ;) [18:28] heard of Simple Ecmascript (SEE) ? [18:29] nope ... new? [18:29] i think the right approach would be to provide a stable, minimal wrapper lib around mozjs/v8 etc. that is then eagerly maintained accross mozjs/v8 branches [18:29] well, elinks supports SEE backend, but I dunno what it is [18:30] but someone needs to do that ;) [18:30] AnAnt: if you find the upstream source for that i would love to take a look [18:30] or even package if there is any [18:32] asac: http://www.adaptive-enterprises.com.au/~d/software/see/ [18:34] 3.0 development status [18:35] Only a single active developer [18:35] Decreasing year-over-year development activity [18:35] asac: "bust a huge bunch of folks" has a much different cost valuation for us than it does for you, I think [18:35] need to put "huge" is put into context - by far the largest libmozjs userbase is official firefox release users, not users of libmozjs in ubuntu === mac_v is now known as vish [18:36] gavin: yes. [18:36] that's not to say that we should be cavalier about dropping support, either, but it seems like you often seem to dismiss the cost of maintaining these old releases too easily [18:37] gavin: i am not saying i dont understand the reasoning. [18:37] just saying that the situation is sad [18:37] but i see the point "why should you do it" [18:37] its just that mozilla as a foundation/charity [18:37] might be the single only entity that would listen for the ecosystem [18:37] and invest even though it doesnt give a benefit [18:37] just "to make the web a better place" [18:37] ;M) [18:38] well, I think part of the problem there is that we disagree about what would be the most effective way to "make the web a better place" [18:38] yeah [18:38] we have limited resources, and the thinking is that innovating and moving faster is actually more effective than maintaining support [18:38] well. it might also be "what is the web" [18:39] gavin: yes. its a tradeoff. but the argument is always: "someone else should do the stable maintenance" ... which obviously doesnt work, because the only folks that could do it are employed by mozilla ;)( [18:39] gavin: but i also see its unfair to put the burden of being slow/uninnovative [18:39] on mozilla ... while others are ok to do what they want [18:39] (e.g. v8 namely) [18:39] yeah [18:40] its just that you were the only folks being good [18:40] (well never as good as it could be;)) [18:40] but you were the only ones providing that stuff [18:40] so thats why folks got pissed. [18:40] and now they move to webkit, which doesnt help at all here ;) [18:42] asac: sorry again, but what's the problem of webkit ? [18:42] people sometimes do tend to feel entitled to a free lunch :) [18:42] gavin: but also, its unfair to say that "we want to freeride when we ask for this"; yes, it sucks that there is innovative stuff we cannot support, but mostly it breaks my heart to go to free software developers and tell them : "sorry, but using mozembed or mozjs is just a no go ... and there is nothing else i can tell you to use, just enjoy your spare time rather than developing" [18:42] anyway, i hvae reached the point to accept that [18:43] now i just have to somehow get all mozilla consumers out of the archive ;) [18:43] AnAnt: webkit has no track record of security [18:43] I guess I don't understand why you have to tell them not to use mozjs [18:43] so its like saying: "its not great in europe, lets go to the unknown land" [18:44] gavin: no stable ABI/API guarantees - not even on stable branches. [18:44] i talked to jorendorff a bit in the past talking about a minimal subset [18:44] it seems to me like you make stability garantees that aren't actually useful in practice [18:45] that could be kept stable [18:45] gavin: well. if users use libmozjs ... and there is ABI/API breakage in a security update, its not usable [18:45] and evne if there is the risk of that [18:45] (or that have a high cost/benefit ratio) [18:45] also we have to move t your new approach of rolling major versions [18:46] gavin: libs need to provide a stable API ... consider gtk+ busting you every other year [18:46] thats a bigger scale of course, but for apps that heavily rely on mozjs api, its probably the same as gtk+ brekaing for you [18:47] yeah, I recognize the value of stable APIs [18:47] <[reed]> gtk+ does bust us [18:47] right. what i was trying to say is if there is not even a minimal subset of mozjs api we know is stable, i can only say to mozjs consumers that they cannot be supported in the distro [18:47] <[reed]> we've found numerous gtk+ bugs [18:47] <[reed]> it's ridiculously hard to get them fixed upstream [18:47] but it's not like old versions of libmozjs disappear - they just stop getting frequent updates [18:47] [reed]: well. bugs are != ABI/API breakage [18:48] if people are not able to move to new api versions, they always have the ability to stay on the old version, and deal with those issues instead [18:48] gavin: they dont get security updates. and with about 30% of CVEs going for js its not supportable [18:48] right, but the security issues couldv ery well be easier to deal with than the compat-switching issues [18:48] (or not worth dealing with at all) [18:49] I don't recall seeing many new vulnerabilities reported against non-mozilla-supported versions of spidermonkey [18:50] gavin: where are those "non-mozilla-supported" versions of spidermonkey? ... that was basically what we asked for [18:50] and got turned down [18:50] we wanted to build mozjs with special flags to just export a minimal API, so apps can at least have some mozjs. [18:51] but that didnt even fly for stable branches [18:51] maybe its all miscommunication [18:52] if there is a solution to that i am eager to adapt that instantly [18:53] man, even eclipse uses xulrunner ! [18:54] yeah [18:54] they are doomed [18:55] wow ! [18:55] the other plan (besides the deliberatly making universe insecure) was to remove everything that depends on it in archive [18:57] but if you tend to keep mozilla apps without the libs (and I see that those apps depend on xulrunner too), then that means that each app will have a copy of xulrunner with it [18:57] which is probably what will happen (because security team and archive admins understand the current situatioN) [18:57] AnAnt: yes. thats the only support model feasible [18:58] and that also means, that only the most important apps are allowed in [18:58] (with an exceptioN) [18:58] so basically it blocks all xulrunner apps, but firefox/thunderbird [18:58] from entering the archive [18:58] you mean the main archive or even universe ? [18:58] or just ignore it and deliberaly allow universe users to use hot/insecure stuff [18:58] AnAnt: arguably there is no difference from main and universe [18:59] users use it [18:59] why would you deliberately allow users of universe software to be exploitablke [18:59] that causes massive headaches if you know it up-front [19:00] personally, i feel really bad about all this, because it felt important for me to strengthen the mozilla ecosystem [19:00] but i cannot strengthen it without mozilla wanting it (which was discussed as a somewhat reasonalbe decision for mozilla to not do) [19:01] so if i dont vouch for it and security team and archive/release team knowing about it, thing will just die [19:02] also ubuntu tries to be a great distribution, but in the end we understand ourselves as a distribution platform [19:02] especially for universe etc. [19:02] if someone tells us repeatedly thats not appreciated then there is no point pushing in the other direction. [19:02] it only causes discussions like this one ;) [19:03] in two years, when everyone has accepted that its normal to have no mozembed in the world, then all will be better and chances are even higher that a valid replacement appears [19:04] anyway, shit happens. next year will be a better year i hope :) [19:04] thanks for the discussion [19:05] maybe lets hope that after tracemonkey is fast enough things can change ;) [19:05] tracemonkey ? [19:06] but i wouldnt wait for it ... developers at least like it more if they dont need to have a stable API [19:06] tracemonkey == mozjs with jit [19:06] oh, another mozilla product [19:06] i think its the same product [19:06] ok [19:07] its not a product btw ;) [19:07] its a secondary/assistive project currently existing to power firefox ... thats why we have these issues [19:09] ok, I need to understand something, in case xulrunner gets removed from Ubuntu. An application like eclipse (if it bundles xulrunner with it) will need an exception to get into universe ? [19:09] or the exception is for main ? [19:09] i think its more likely that eclipse needs to get the parts patched out [19:09] that use xulrunner [19:09] its really just a minor use case where they use it [19:09] ok, eclipse was just an example [19:10] but in theory yes [19:10] if an app needs xulrunner, it cannot enter the archive until it proofed to be essential [19:10] which is a bit hard if its not in the archive of course [19:10] but thats how it is ;) [19:10] like if firefox would be less popular we could drop it [19:10] and would [19:10] same for tbird ;) [19:11] but thats a bit extreme [19:11] basically, as long as we are sure that upstream including xulrunner keeps up with the security fixes, it can stay in [19:11] however, thats probably just firefox [19:11] and thunderbird maybe [19:11] ok [19:11] things like songbird etc. did never enter the archive because of that [19:12] they cannot keep up and hence users would be zero-dayed [19:13] asac: do you know wether Debian would make such a similar decision ? [19:13] if i raise this, i am quite sure that security folks will agree and make this happen, yes. [19:13] havent started discussing that with them [19:14] in the past i was the only guy preventing such a move [19:14] e.g. it owuld have happened for etch and lenny if i hadnt promissed that we can do it somehow [19:15] but now i cannot promiss that anymore, because upstream model is getting even more aggressive [19:15] i will probably also approach redhat and suse about this [19:15] asac: thanks again for this discussion [19:15] I'll need to run now [19:15] no problem. sorry that i cannot give better perspective [19:16] asac: no probs [19:16] bye [19:26] asac: so if upstream will let us put the searchplugins elsewhere, that's ok? [19:31] micahg: not sure [19:31] i dont think that will help [19:31] whats the problem? [19:31] asac: in upstream builds, they're in APP_DIR/searchplugins [19:31] yes, but that doesnt work [19:31] the problem seems to be the way it's stored in the search.slite [19:31] for locale specific stuff [19:31] *search.sqlite [19:31] yes, i guessed so [19:32] i think we need to normalize the path its stored under [19:32] I was going to do some test builds to see if that would help [19:32] asac: well, the plugins are actually stored outside the app_dir as I"m sure you know [19:32] micahg: i think it helps, but localization is not working at that place afaict [19:32] micahg: so? [19:32] its just a link [19:33] we have them in APP_DIR/distribution/searchplugins/... [19:33] asac: yeah, but one option might be to resolve the symlink before storing in sqlite [19:33] yes, thats what i mean [19:33] 20:31 < asac> i think we need to normalize the path its stored under [19:33] first run a realpath [19:33] then store it [19:33] maybe its done for the APP_DIR/searchplugins place atm [19:33] oh, I thought you meant normalize the app_dir path :) [19:33] then its a bug for the distribution/searchplugins [19:33] no ;) [19:34] ok, so I can try to work with upstream on this then [19:34] yes. [19:35] most important requirement is a) that its locale sensitive [19:35] asac: would you prefer the realpath solution to moving the search dir? [19:35] moving where? [19:35] maybe its really a bug even for APP_DIR/searchplugins [19:35] so that it is recognized as [app]/foo.xml [19:35] try that out [19:36] ok, I'll try that [19:36] you mean APP/searchplugins/foox.mk? [19:36] we need locale support [19:36] no, it would be [app]/locale/foo.xml [19:36] they dont hvae that in upstream builds; and afair i moved it to distributions/ directory because of that [19:36] upstream [app] is firefox/searchplugins [19:36] micahg: APP/searchplugins/locale/foox.mk you mean? [19:36] ah [19:36] well [19:36] in the sqlite db :) [19:37] thats more or less ok, but in the end the distribution directory should work [19:37] ok, gavin wasn't familiar with our dir structure [19:40] simple fix would be to just normalie [19:40] gavin: normalize as in realpath? [19:41] yes [19:42] gavin: ok, should I try to produce a patch? [19:43] sure [19:43] http://mxr.mozilla.org/mozilla-central/source/toolkit/components/search/nsSearchService.js#2786 [19:43] |file| is an nsIFile [19:43] you could check isSymlink() and then use .target, perhaps [19:43] or maybe just call normalize() [19:44] yeah, normalize() seems to realpath() [19:44] http://mxr.mozilla.org/mozilla-central/source/xpcom/io/nsLocalFileUnix.cpp#530 [19:44] right. should be simple enough [19:44] gavin: ok, I'll try tonight :) [19:44] thx [19:46] i am not sure if isSymlink returns true if any of the ancestors is a symlink. you could also just say "normalize" [19:46] if its right its right and if not it shouldnt hurt [19:47] micahg: what do you see in search.sqlite atm? [19:48] asac: it shows APP_DIR/distribution/searchplugins/en-US/foo.xml [19:49] es, i think the problem is not the follwo symlink, but rather the [19:49] isInAppDir test [19:49] that should make a substring match [19:50] so [19:50] well ... just normalize and since the plcae is stable it should be fine [19:51] isInAppDir really should only return true for plugins that are in SrchPlugns (i.e. appdir/searchplugins) [19:51] yeah [19:52] but wouldnt work with localization either [19:52] otherwise there could be conflicts (since two plugins could have the same file name in appdir/ and appdir/distribution) [19:52] but i think that location doesnt support locales [19:52] right, it doesn't [19:52] it could, but there isn't really any reason to given that distribution already exists [19:52] (once we fix this bug anyways) [19:53] yes [19:53] gavin: though the normalize fix is a bit of a hack ... for us we have a stable realpath for the plugins [19:53] but if we would ship it just below the real app dir it wouldnt help [19:53] yeah [19:53] so we would need to add something like isBelowDistroDir... [19:54] could do that too I guess [19:54] which does a startsWith ... match and then used proper [distrosearchdir]/locale/xxxx [19:55] the problem is that there are a bunch of places that can be in SrchPluginsDL [19:55] but then we could just do "isBelowAppDir" in the same way [19:55] for everything [19:55] and it's kind of ugly to have to hardcode checks for all of them [19:56] yeah, maybe that would be better [19:56] but then the current [app] thing would be required for legacy i guess [19:56] otherwise it wouldnt match as [app] = APP/searchplugins [19:56] indeed [19:56] hmm [19:58] it wouldn't be too hard to move to using e.g. [appdir] for all things under the appdir, but still use [app] for APP/searchplugins specifically [19:58] so not sure. maybe the normalize is the right way to move forward - but it might break other distros that ship their app with a link [19:58] yeah [19:58] thts what i ment [19:58] prefer [app] [19:58] if that works [19:58] its fine [19:58] otherwise try [appdir] on the full path [19:58] but the whole code uses leafName ;) [19:59] hmm. seems to be just id [19:59] that should be managable [19:59] yeah, it just needs to be unique [19:59] (for a given file) [20:00] should I subscribe linux@distro to the bug? [20:06] not sure it's worth spamming everyone watching that? I don't know that this is relevant to any other distros === vish is now known as mac_v [20:08] gavin: won't it be relavent if we symlink the realpath? [20:08] oops [20:09] realpath the symlink? [20:09] maybe, but I don't know that that's common either [20:09] micahg: we shouldnt do that imo. [20:09] yeah, maybe we jsut shouldn't do that [20:09] some distros ship their app in a non versioned path [20:09] but others do [20:09] and i would guess they use a symlink like us [20:10] if not distribution ... they symlink searchplugins [20:10] so normalize would break [20:10] we should go for the appdir approach [20:10] hmm [20:11] why do you symlink search plugins, btw? [20:11] i think we might get around by normalizing here: [20:11] http://mxr.mozilla.org/mozilla-central/source/toolkit/components/search/nsSearchService.js#2297 [20:11] e.g. after all the other stuff failed [20:11] gavin: because otherwise they are in a versioned directory, so we cannot ship additional plugins from outside [20:11] without breaking those on updates [20:12] also we (plan to) inject localized plugins now through translations ... which are not build in firefox, so same problem for those [20:13] ok, so should I try to add an [app_dir[ check there? [20:13] micahg: yes. add a simliar function: isBelowAppDir ... or something and then dont use leafName for those matching that, but substring [20:15] or just normalize after everything has happened in id() ... which is also correct imo [20:16] asac: gavin: does it matter that AppDir isn't being used consistently in the functions? [20:16] micahg: yes. [20:16] we hvae appsearchdir ... thats the current APP [20:16] we would have appdir ... thats the real appdir [20:16] isInAppDir is APP_DIR/searchplugins where isBelowAppDir would be APP_DIR [20:17] asac: how about isInDistroAppDir? [20:17] yes ... and for the Below you wouldnt implement a ==, but a startsWith [20:17] isInAppDir is a bit of a misuse of "app dir" [20:17] it's really "app searchplugins dir" [20:17] right, that's what I'm asking about [20:17] micahg: ther emight be more dirs etc., so adding checks for each possible location was considered a scalability problem [20:17] you can use appdir.contains(file, true) [20:17] thats why i think isBelowAppDir is best we can do to extend this for noce and for all [20:18] but I just thought of something... switching to [appdir] will mean we'll change the IDs of existing plugins [20:18] gavin: contains does a recursive search? [20:18] asac: that's the second param [20:18] gavin: thats what i said, we should keep app [20:19] asac: not just app, though [20:19] and prefer that ... and then go for appdir [20:19] if it didnt match [20:19] there are existing plugins that fall back to using the full path as their ID [20:19] if we make them now use [appdir]/path, their ID will change [20:19] gavin: hmm. ok. so we need to do appdistrosearch ;) [20:20] I guess we could limit it to that case, yeah [20:20] great. but we need recursive search too, because of the locale/common dir in between [20:20] ok, once you two figure it out, please tell me what to try :) [20:20] but we'd still have that problem for people who were using the distro dir but without the symlnik [20:20] gavin: why? [20:20] ah [20:20] well. [20:20] because we'd still be changing their IDs [20:21] not a big deal in the ubuntu case since that's already happening (due to this bug) [20:21] yeah. thats collateral damage ;) [20:21] we might want to subscribe linux.bugs to figure if anyone uses distribution dir then ;) [20:22] i can ping caillon directly to check redhat [20:22] debian doesnt use it for sure. [20:22] and wolfr i can ask i guess [20:23] asked caillon [20:23] lets see if he replies [20:24] not really limited to linux, though [20:24] could be anyone [20:25] hmm [20:25] so caillon said no. [20:25] but you are right [20:25] so lets bread a bit further on this ;) [20:30] sucky [20:30] distro patch ;)? [20:30] hehe [20:30] or migration [20:30] normalize() is sounding like a better option now [20:31] only downside is that it's kind of hacky and non-obvious, right? [20:31] less likely to cause compat issues, I think [20:31] yes. also as you said it might change id for those that have a symlink but are not affected [20:32] atm [20:32] personally, i would consider that likelyhood low [20:32] right [20:32] where are the ids compared? [20:32] is that __id thing something special? [20:35] gavin: ? [20:42] asac: they're used to retrieve/store data from the DB [20:43] http://mxr.mozilla.org/mozilla-central/source/toolkit/components/search/nsSearchService.js#3494 [20:43] hmm. ok. that doesnt give much flexibility to do smart stuff [21:10] fta: I would think throwing the files up to a bzr repo under his user in LP would be easiest [21:10] ? [21:10] fta: re the seammonkey email [21:10] oh [21:11] we already have a sm2 branch [21:11] i just orphaned it a while ago [21:11] fta: right, but we can see his changes and take what works [21:11] yep, it was not clear to me if he said he had a package or just the control file [21:12] fta: well, I don't think anyone's agreed to do it yet, I have a note for myself If I have time [21:12] fta: would you like me to reply to him? [21:13] sure, feel free, i won't [21:13] I'll copy you and asac [21:20] fta: BTW, can you update my address in your addressbook to my ubuntu dot com address? [21:21] sure, send me an email with it [21:21] nm, jsut got one [21:21] fta: thanks :), otherwise, that stuff can get lost in my bugmail :) [21:22] want the bot too? [21:23] hmm, either way on the bot, since I already set up filters for it [21:56] boas o/ [22:02] hi BUGabundo [22:02] Olá Alexander [22:02] ... the great [22:02] asac: did you ever figure out what I should try w/regard to the search plugin stuff [22:02] micahg: can you subscribe stransky at redhat.com and caillon at redhat.com to the distribution bug? [22:02] asac, today's chromium is snaping [22:02] http://paste.ubuntu.com/344968/ [22:03] asac: on bmo? [22:03] micahg: yes [22:03] fta: sigh [22:03] fta: so you dont track the green takgs? [22:03] green as in "it builds" [22:04] hmm. thought it also includes that the tests run [22:04] and dont crash etc. [22:04] asac: dine [22:04] oops [22:04] done [22:04] k [22:04] micahg: wolfgang rosenauer is the opensuse guy we should subscribe [22:04] but i dont know his email in bugzilla atm [22:04] only know his nick: wolfr [22:04] but he probably is subscribed to a bunch of other linux bugs [22:05] especially the kde integration one ;) [22:05] but we don't want to just do linux@distro? [22:05] asac: found it [22:05] micahg: definitly subscribe them individually too ... [22:06] asac: I should also add linux@distro? [22:06] micahg: not before we propose a solution imo [22:06] do I need to comment when adding them? [22:07] hmm ... maybe subscribe it ... and afdter that ask if anyone uses distribution/searchplugins [22:07] micahg: yes. [22:07] you need to just hit enter if you are in the CC field [22:07] or just say commit [22:07] asac: no, I mean do I need to say why I'm subscribing them? [22:08] no [22:09] subscribe them first [22:09] then you can ask the question i mentioned [22:10] asac: done [22:11] micahg: in case they have questions or something where i need to provide input let me know. i probably will miss all mail till jan [22:12] asac: ok [22:12] should I just ping you with notes? [22:12] yeah [22:13] asac: as long as I have you here, debian source format 3, we probably won't do that till Hardy is EOL on desktop, right? [22:14] yeah [22:15] our packages need to work everywhere [22:15] asac: also, should I try to bump TB3 to debian standards 3.8.3? [22:15] why not ;) [22:15] ok, but any debhelper stuff needs to work on hardy, right? [22:16] micahg: did you figure a sensible way to merge the tb 3.head branch onto the tbird.dev one? [22:16] micahg: right. [22:16] asac: well, there's some docs on merging branches since that'll be the new way to merge from debian, I was going to try that [22:16] i think we should try to keep the approaches for tibrd/xul/ffox simliar [22:17] micahg: you can try. but the problem here is that there is no common ancestor [22:17] if that doc helps great [22:17] asac: worse possible case, I'll do it by hand, but I don't think that'll be necessary [22:19] nah. i think you can do bzr merge -r 0.. /path/to/tbird3.0.head [22:19] hopefully [22:19] maybe remoivng the files that are not in the tb3 branch first === and`_ is now known as and` [23:13] asac, can't find a commit that could have done this. other option is the strict aliasing thing i changed in the branch [23:22] maybe a flash update ;)? [23:22] BUGabundo, you're using the chromium hardy builds right? [23:22] BUGabundo on hardy? [23:22] on debian [23:22] ah [23:22] lenny or what? [23:23] fta: yep [23:23] just want to try that, the gcc44 thing was obviously not used on hardy [23:23] on debian? hardy on unstable [23:24] BUGabundo, could you upgrade chromium to the lastest (where you're using the hardy ppa) and try a page with flash [23:24] fta: tomorrow [23:24] at work [23:24] I do daily updates [23:24] ping me then [23:24] :( [23:24] at home, I have lucid [23:25] too late then, i will revert and rebuild [23:25] okay [23:25] 4.0.279.0~svn20091222r35149-0ubuntu1~ucd1~karmic is broken with flash apparently [23:26] Installed: 4.0.277.0~svn20091219r35045-0ubuntu1~ucd1 [23:27] 4.0.277.0~svn20091221r35087-0ubuntu1~ucd1~karmic was fine [23:28] fta: I don't have Flash on that chromium :D [23:28] but nothing obvious between r35087 & r35149 [23:29] fta: wfm [23:29] 4.0.279.0~svn20091222r35149-0ubuntu1~ucd1~karmic [23:36] micahg, a page with flash? [23:37] fta: yep, after a few refreshes, hulu and youtube work [23:37] strange, i also tried with a fresh profile [23:37] 32 or 64? [23:38] 64 bit [23:38] BUGabundo, asac: you? [23:38] 32 [23:39] fta: ? [23:39] 64bits [23:39] so 32 snaps and 64 doesn't? [23:39] flash 64bits [23:39] .so [23:39] it's not flash itself, it's the renderer [23:39] * micahg is using adobe flash [23:40] me too [23:40] unfortunately [23:40] fta: just tested youtube [23:40] works ok with up to date chromium [23:40] and what ever flash I have [23:41] i can't load www.lemonde.fr for ex [23:41] Shockwave Flash 10.0 r42 [23:41] testing [23:41] WFM [23:41] even with flash block [23:41] ok so it's a 32bit issue [23:41] the revert sounds nicer [23:43] fta: I can't load that site either [23:43] wait, it just worked [23:43] it should load, then snap [23:43] just that tab [23:44] flash crashed, you want the crash report? [23:44] should not be very helpful, is it? [23:45] idk, my guess is no [23:46] fta: still opened and going [23:48] http://www.downloadsquad.com/2009/12/22/opera-10-5s-new-carakan-javascript-engine-is-fast-google-chro/