Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Mirrors removed from SORCERY (only smgl central site)

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Andrew <afrayedknot AT thefrayedknot.armory.com>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] Mirrors removed from SORCERY (only smgl central site)
  • Date: Fri, 8 Oct 2004 09:53:30 -0700

On Fri, Oct 08, 2004 at 12:59:53PM +0200, Eric Schabell wrote:
> On Fri, Oct 08, 2004 at 03:10:45AM -0700, Andrew wrote:
> > On Fri, Oct 08, 2004 at 10:45:59AM +0200, Eric Schabell wrote:
> > > On Fri, Oct 08, 2004 at 01:09:42AM -0700, Andrew wrote:
> > > > On Fri, Oct 08, 2004 at 09:56:55AM +0200, Eric Schabell wrote:
> > > > > Howdy all,
> > > > >
> > > > > Was just wondering when and why we no longer have extra mirrors for
> > > > > SORCERY (/etc/sorcery/mirrors/SORCERY)? Having only one is not a
> > > > > good
> > > > > idea if you ask me...
> > > > >
> > > > > erics
> > > >
> > > > seems like a bad idea to me having multiple mirrors and hoping they
> > > > all
> > > > are actually synced up with the right bits all the time...especially
> > > > when i dont have access to them.
> > > >
> > > We do it with grimoires, what makes sorcery so special that we have to
> > > rely on one point of failure?
> >
> > Well if you really want to have this discussion...the main reasons would
> > be security, and control. You have made the assumption that a single point
> > of failure is a bad thing, whereas on the flip side there could be a
> > number of sorcery mirrors and if just one of the gets the wrong bits
> > for some reason we're going to run into some potentially disastrous
>
> <big snip>
>
> Outside the longwinded reply... the tarball on download is pulled from
> a location provided by autogenerating scripts on perforce server, same
> as grimoire tarballs.

Thats how it works with devel, but as i said, test/stable are NOT
autogenerated, they land on the server when I scp them there, then verify
the md5sum.

>
> The only sites that should be supported as mirrors are ones that pull
> from these locations. That is what we do with grimoires, why not keep
> the mirroring of sorcery alive for those that provide it from the same
> location as download.

As I said, grimoires are actually only pulled for the majority of users from
ONE place. And once again, ftp is an insecure protocol, I will not rely on
it for stable and test sorcery as I clearly stated. And as I also
pointed out having more mirrors only opens up more targets for potential
attacks. Not that I dont trust you know how to keep your box secure, but
I trust ibiblio a whole lot more, and would rather have to worry about one
(rather stable) site's security than theirs plus all the other mirrors.

>
> Simple service, simple solution, non-detrimental to "your sorcery" and
> quite handy as fallback. At the very least you can trust SMGL guru's and
> team leads, can't you?

Whats this "my sorcery" nonsense? Feel free to mirror it. I never said
you couldn't. However as I clearly stated I have my reasons for not doing
it your way. If you are still unclear about my reasons I urge to read my
previous email.

As for trust in team leads and gurus, yes I trust most people on the
team, i also think that as a small project we're willing to let anyone
on board who wants to. Of course that all boils down to the case of joe,
the friendly smgl user, who hacked us with social engineering, not that
we've /ever/ seen a guru antagonize us...

Furthermore what do we gain from having multiple mirrors. We have a
"handy fallback" in the rare event that ibiblio goes down. Given the
probability of that occuring, and the fact that most of the time sorcery
does not change (last stable releasse was many moons ago) its probably
not /that/ big a deal. And again, it takes seth probably a minute or two
to adjust his dns records to point downloads.sourcemage.org somewhere else.

What do we risk in having multiple mirrors? We increase our security
risk because we have now two or three boxes that can get attacked,
rather than just ibiblio. I lose control over the release process,
sorry but as i pointed out, when i say sorcery 1.11.0 is available
i dont want to deal with the mirrors not actually having it, and
waiting for people to sync it themselves.


-Andrew


--
__________________________________________________________________________
|Andrew D. Stitt | astitt at sourcemage.org |
|irc: afrayedknot | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus | |
|Sorcery Team Lead, Porting Team Lead | |
|Grimoire Guru ham/smgl | ftp://t.armory.com |
|Author and Maintainer of Prometheus | |
--------------------------------------------------------------------------

Attachment: pgpLiiKGoi5nn.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page