On Thu, Mar 03, 2022 at 08:14:20PM +0100, Kamil Dudka wrote: > On Thursday, March 3, 2022 3:24:38 PM CET Richard W.M. Jones wrote: > > On Thu, Mar 03, 2022 at 09:04:10AM +0100, Kamil Dudka wrote: > > > The FTP protocol is still included in libcurl-minimal, so the protocol is > > > not going to disappear with the proposed F37 change. On the other > > > hand, it may happen that FTP will be unavailable by default in a year or > > > two. > > > > > > I'm still wondering what you're trying to achieve with this change. > > > > The stated benefits[1] are that the "minimal variants are smaller", > > which is a non-goal for almost everyone. And something to do with > > security which will be immediately negated once everyone unbreaks > > their Fedora by installing curl-full. And the security angle would be > > better fixed by reviewing Fedora packages for correct use of > > CURLOPT_PROTOCOLS (see my other email[2]). > > > > Rich. > > > > [1] https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default#Benefit_to_Fedora > > [2] ttps://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx/message/7PQUPLCEQ5NMXFXZTP75XYDNF5KAJHMI/ > > I answered both your questions back in October 2021: > > https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx/message/ZZMU36DFRSDJOIJJ75CLF45R6GDVSEYI/ FTR you didn't actually answer the points there. (1) I don't deny that curl-minimal will reduce the size of some niche containers, my point is this is not a worthwhile goal to pursue given the costs. (2) Once people have unbroken their Fedora by installing curl-full, the security claims you make about compiled code paths are not applicable. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-p2v converts physical machines to virtual machines. Boot with a live CD or over the network (PXE) and turn machines into KVM guests. http://libguestfs.org/virt-v2v _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
