From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id y6rSHuhxWmDUbAAA0tVLHw (envelope-from ) for ; Tue, 23 Mar 2021 22:55:36 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id YKjsGehxWmAyOgAAbx9fmQ (envelope-from ) for ; Tue, 23 Mar 2021 22:55:36 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id D43FFF1DB for ; Tue, 23 Mar 2021 23:55:35 +0100 (CET) Received: from localhost ([::1]:38054 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lOpvz-0004sX-24 for larch@yhetil.org; Tue, 23 Mar 2021 18:55:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:33396) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lOpvV-0004q8-48 for guix-devel@gnu.org; Tue, 23 Mar 2021 18:55:05 -0400 Received: from sender4-of-o51.zoho.com ([136.143.188.51]:21159) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lOpvT-0004GR-4e for guix-devel@gnu.org; Tue, 23 Mar 2021 18:55:04 -0400 ARC-Seal: i=1; a=rsa-sha256; t=1616540098; cv=none; d=zohomail.com; s=zohoarc; b=VD/MH1y7P4wrEjKBvYfsFk4BkIJw90aC6zRkBNVfY6omYqkOxWJhLbuU1/aSiNVVroniTKFoE1HblHcyGbaiNfZSFTbFK0g+p1p2nVzpuwRqeXfXWgPIvAhLNPdf5qtXx1UNNYttrrkQugfsdHvEObPwh1DvpFqLUCelDz0i5xw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1616540098; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:To; bh=JJvOd1nmrYzYQ0gD+h3LwAMwNRxDgQyj6/HwJwsXAYs=; b=SF4wzbtmA4c0DR4SqLm5YNy1IqCYoscKy0FczKouybgIOqCFqdXQXFSBZ9WNHRsrVoIK0ETKp0ZmmXYhHq0CChzzp4WY70F4lhcMiYzBSxxYU3ZdYY3IRYbu22VHT4P8TeLqHtXMYBCy4Hvj6XyQwdUM4peQ0TVE4LDYETO1c3c= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=elephly.net; spf=pass smtp.mailfrom=rekado@elephly.net; dmarc=pass header.from= header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1616540098; s=zoho; d=elephly.net; i=rekado@elephly.net; h=References:From:To:Cc:Subject:In-reply-to:Date:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding; bh=JJvOd1nmrYzYQ0gD+h3LwAMwNRxDgQyj6/HwJwsXAYs=; b=We/9QPXe8ifHOo66CnuhecrxWsFLypOSZwf6baWOVNkWcrouASZHHXCWNPaXnR14 GongDoG2FL9Gjs2tgRSnbhkNSbFIDO4x0ZRO2pRvvMWieyAqVSqAKXQuwOJg2uxPcM6 Uot+ck+a+UJo2+ysbrwmVYoHUpboEDT58Faerfic= Received: from localhost (p54ad4f2a.dip0.t-ipconnect.de [84.173.79.42]) by mx.zohomail.com with SMTPS id 1616540097156965.2500573163196; Tue, 23 Mar 2021 15:54:57 -0700 (PDT) References: <9b9a43a584e2dc70488482fce5931b46abd0e006.camel@zaclys.net> <87v99qit39.fsf@netris.org> <877dm29iog.fsf@gnu.org> <20210322144404.1636b9cf@riseup.net> User-agent: mu4e 1.4.14; emacs 27.1 From: Ricardo Wurmus To: raingloom Subject: Re: [opinion] CVE-patching is not sufficient for package security patching In-reply-to: <20210322144404.1636b9cf@riseup.net> X-URL: https://elephly.net X-PGP-Key: https://elephly.net/rekado.pubkey X-PGP-Fingerprint: BCA6 89B6 3655 3801 C3C6 2150 197A 5888 235F ACAC Date: Tue, 23 Mar 2021 23:54:54 +0100 Message-ID: <875z1hv5tt.fsf@elephly.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Received-SPF: pass client-ip=136.143.188.51; envelope-from=rekado@elephly.net; helo=sender4-of-o51.zoho.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: guix-devel@gnu.org Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1616540135; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post:dkim-signature; bh=JJvOd1nmrYzYQ0gD+h3LwAMwNRxDgQyj6/HwJwsXAYs=; b=bmewIISwVSSBEBWvSkGmv4S2yIFFaG3O59Gxl3ZkK/+yjPkHEEMad7QSJxMLnY9az+8GVM fmYcez0DtthqJgIi7k7LximuSSTTQHhqQXogDrinFlTgLn5DoDlTy7mKEI5XdW9NNqNkDC Qn4OnaOeRfkcn+tNioWPVbZi3t7jyxWFziVdclhRIhz792y20az21EpOTx/x8mLAhQPLOl 7+Z2hzE3J90xQFRDhRIZ/YDeuXEwPImkyNBRoZgk3Q0lcRLhN5SKJU6KuuErXKpXJRjIW3 e29FFynh2blRyEo4zATMerC9nosTgHk9PU34/NmKsrsPs5mPXpMSxEZQB5pg3Q== ARC-Seal: i=2; s=key1; d=yhetil.org; t=1616540135; a=rsa-sha256; cv=pass; b=CybvtKtDaZLdIsIcJSMyhpYFHhH/JZ6/k23LKMP0KtoZ2a2v306kjH/TWz1771JjvXD1Sk 6UrAdz/zRJVrGAERF3hOSymv8U0hO+D1sVjwXpuvseE0uuApwjq6EeziaPEnIoEYzQcrfQ qpQYhY+qZaUc3T5FTEFWqnXHd/kSlhyYoKgGCvE/JQNssRGsBejbtfh1Iyr864fhHPez8u 0xtksknOqFy4ca9PaDSXhtY+6OStfNPdtFqpQwGGMRD+ruoDotww4z64oqrsnBIZ1LqjlL U0RI6clNPFlI7k/J3bpZ+kdLODlO3ukdCdG8bVsU/5qW8qnXAm8yt2nltp29Ag== ARC-Authentication-Results: i=2; aspmx1.migadu.com; dkim=pass header.d=elephly.net header.s=zoho header.b="We/9QPXe"; arc=pass ("zohomail.com:s=zohoarc:i=1"); dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Spam-Score: -3.62 Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=elephly.net header.s=zoho header.b="We/9QPXe"; arc=pass ("zohomail.com:s=zohoarc:i=1"); dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Queue-Id: D43FFF1DB X-Spam-Score: -3.62 X-Migadu-Scanner: scn0.migadu.com X-TUID: vCdBAgeyJBQg raingloom writes: > On Sat, 20 Mar 2021 12:19:11 +0100 > Ludovic Court=C3=A8s wrote: > >> Hi, >>=20 >> Mark H Weaver skribis: >>=20 >> > Ultimately, I gave up. In my opinion, Guix has never achieved >> > usability as a desktop system on non-Intel systems. Therefore, the >> > Guix community is unable to attract many developers who want a >> > distro that supports non-Intel systems well. Our community has >> > thus become dominated by Intel users, and there's unsufficient >> > political will to adopt policies that would enable us to provide a >> > usable system for non-Intel users.=20=20 >>=20 >> A practical problem that=E2=80=99s been mentioned repeatedly is lack of >> ci.guix hardware for non-Intel architectures: please everyone, >> consider helping the project find either sponsors or companies that >> sell fitting hardware, along with a plan to host it and maintain it >> over time! >>=20 >> Ludo=E2=80=99. >>=20 > > What about a Liberapay for Guix? Could also be used to pay developers. This seems to be a misunderstanding. The first step is to use the money we already have but cannot exchange for hardware, because - finding appropriate hardware that you can actually buy is not easy - hosting needs to be considered because we can=E2=80=99t just dump them in= the MDC data centre where most of the Intel servers are hosted. We bought a handful of Overdrive 1000 in the past (they are no longer sold), and hosting was always an obstacle. While looking for ways to get the project some more money is certainly worthwhile, it=E2=80=99s really not the pressing issue here. --=20 Ricardo