Re: F37 Change: Curl-minimal as default (System-Wide Change proposal)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Mar 03, 2022 at 08:14:20PM +0100, Kamil Dudka wrote:
> On Thursday, March 3, 2022 3:24:38 PM CET Richard W.M. Jones wrote:
> > On Thu, Mar 03, 2022 at 09:04:10AM +0100, Kamil Dudka wrote:
> > > The FTP protocol is still included in libcurl-minimal, so the protocol is
> > > not going to disappear with the proposed F37 change.  On the other
> > > hand, it may happen that FTP will be unavailable by default in a year or
> > > two.
> > 
> > 
> > I'm still wondering what you're trying to achieve with this change.
> > 
> > The stated benefits[1] are that the "minimal variants are smaller",
> > which is a non-goal for almost everyone.  And something to do with
> > security which will be immediately negated once everyone unbreaks
> > their Fedora by installing curl-full.  And the security angle would be
> > better fixed by reviewing Fedora packages for correct use of
> > CURLOPT_PROTOCOLS (see my other email[2]).
> > 
> > Rich.
> > 
> > [1] https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default#Benefit_to_Fedora
> > [2] ttps://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx/message/7PQUPLCEQ5NMXFXZTP75XYDNF5KAJHMI/
> 
> I answered both your questions back in October 2021:
> 
>     https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx/message/ZZMU36DFRSDJOIJJ75CLF45R6GDVSEYI/

FTR you didn't actually answer the points there.

(1) I don't deny that curl-minimal will reduce the size of some niche
containers, my point is this is not a worthwhile goal to pursue given
the costs.

(2) Once people have unbroken their Fedora by installing curl-full,
the security claims you make about compiled code paths are not
applicable.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux