Public SourceMage Discussion List

[dave AT sourcemage.org]

On Fri, Jan 12, 2007 at 12:09:12AM +0100, Stephan Erb wrote:
> Hello,
> 
> You asked for more user feedback and here you go. I don't want to be
> offensive but just let you know what I think and what experiences I make
>  using SGML.
> 
> 1) stable, stable-rc, testing and whatever
> Why should I use your stable-tree? It's outdated and I cannot be sure
> whether all security fixes make it into the grimoire. (You don't fix old
>  software like the debian-sec-team does). Therefore it would be a real
> risk to run it an a productive machine and stupidity to run it on a
> desktop system. And whoever needs it for a PC with no connection to the
> Internet would profit much more if you can offer him working
> "testing-snapshots" regularly.

Hi, I'm a sourcemage 'user' in that 100% of my companies internet facing
linux systems run SMGL. I also run SMGL on my desk at work, at home, and
on my laptop. 

You use stable because... well it's stable. backporting security fixes
is an important thing, but what SMGL buys me in minimal package
installation and build options does more for the security of my systems
than a binary distro with a backporting team ever could.  For example my
production systems on average have about 150 packages installed on them
vs. the 1000+ I would get on RHEL minimal install.  It is possible for a
human being to track security problems on 150 base packages and promote
a fix from test if they're doing their job and paying attention. SMGL's
package manager makes this easy.
 
> Just looking at my MailBox I can see that even you, the developers,
> don't care about stable. (408 commits to master grimoire vs 93 to
> stable(-rc)).  I propose you to drop it! OpenSource works much better
> if you do it for you, not for a possible but almost non-existing user.
> If you want you can switch back to this development model if you have
> more resources, but currently it doesn't work well.
> 
> 2) Not sure if it is possible but incremental grimoire update would be
> perfect. The download takes up to 5-6 minutes because of the slow
> server -connection. (using 2mbit connection, yes i have netselect
> installed and enabled)

have you tried to 'emerge sync' lately? Talk about download time...
 
> 3) prompt-delay There are questions that should never be skipped due
> to this delay. Lets assume I cast several spells. I would not have a
> look at the install/compile log, if everything works fine. Therefore I
> reduce the delay not to waste time.  But very often I miss the
> important configure questions due to the slow update (see above) or
> because I don't like to sit here for three hours to wait for a
> possible need to interact running cleanse.

That's funny I've been wanting a more ganular prompt delay for a while
now but haven't said so out loud.  certain prompts could be prioritized
for example 'do you want to see the build summary' could be a low
priority vs 'hey, the gpg sig failed here' being very high. 
 
> 4) creating own packages
> It is so easy to create own spells but so frustrating to get them into
> the grimoire. I stopped offering my own spells because I once did and
> there was so little reaction. Why should I bother you.

I have to say if anything every spell I've ever submitted came under a
LOT of very immediate and usually embarrasing scrutiny, so my experience
here has been a bit different. Perhaps if you use incorrect spacing
you'd get more attention. I'm kidding of course. It sounds like the
correct answer for you there is to get git commit access to test, which
isn't all that difficult to do. 
 
> 5) reporting bugs Bugs can occur everywhere. Nobody should be blamed.
> But it would be nice if you could offer a better bug-reporting-system.
> Bugzilla looks so old and doesn't invite to work with. In addition all
> these different options are confusing and cannot be answered
> intuitively (I prefer the trac-ticketsystem, it is also easier to
> review how it is fixed)

I'm not sure choice of bugtracking system is a fair metric for
determining suck factors. If that were a valid yardstick quite a few
projects would qualify for suckage. 

> 6) website and doc I think you know...
> 
> 7) ledger "Source Mage Ledger is a client/server based system that
> collects and processes stats about Source Mage GNU/Linux (users,
> spells, ...).  Don't hesitate to cast smgl-ledger and upload your
> stats"
>
> Sounds much like a privacy issue. I do not want anybody to know what
> software I use and whatever this tool does or might do.

this is a bit like saying wu-ftpd is inherently insecure and since smgl
has a completely optional wu-ftpd spell, it, as a project, sucks.
 
> greetings
> 
> a user

likewise.

Attachment: pgpB2QaE3c35R.pgp
Description: PGP signature