15:06:54 #startmeeting kde-sig 15:06:54 Meeting started Tue Apr 28 15:06:54 2015 UTC. The chair is rdieter. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:06:54 Useful Commands: #action #agreed #halp #info #idea #link #topic. 15:06:58 #meetingname kde-sig 15:06:58 The meeting name has been set to 'kde-sig' 15:07:02 #topic roll call 15:07:04 * jgrulich is present 15:07:04 present 15:07:09 present 15:07:10 hi all, who's present for a friendly kde-sig meeting? 15:07:31 me 15:08:29 Present. 15:09:18 #info rdieter jgrulich than dvratil pino|work Kevin_Kofler present 15:09:25 #chair jgrulich than dvratil pino|work Kevin_Kofler 15:09:25 Current chairs: Kevin_Kofler dvratil jgrulich pino|work rdieter than 15:09:29 #topic agenda 15:09:36 okie dokie, what to discuss today? 15:09:38 hi 15:09:45 #info Caterpillar present 15:10:03 * dvratil has KF5, Plasma 5, KTp 5 and F22 updates 15:10:09 I have one topic, kwalletmanager5, which is something we don't have and would be nice to have it 15:11:17 I think we should discuss the NM-connectivity-fedora package and the autolocking. 15:11:54 I think we should also organize the stuff for the alternate desktop DVD image 15:12:09 * satellit late listening 15:12:20 ok, let's get started 15:12:33 #topic kf5, Plasma5, ktp5 awesomeness 15:12:37 dvratil: go ahead 15:12:53 so: KF5 5.9.0 has been pushed to stable in all releases 15:13:07 yay 15:13:27 Plasma 5.3.0 update for F22 submitted (it's pending now as I had to do some updates) 15:13:45 and Plasma 5.3.0 for F20 and F21 is running in Copr 15:14:04 I installed it in VM locally and looks pretty good, but we should really test it properly 15:14:30 * randomuser notes F22 Beta Release Notes are published, please review to make sure your work is adequately touted 15:14:49 KTp 15.04.0 update for F22 also sumitted - I really want to have that in F22, even if the rest of 15.04 should be delayed 15:15:05 woo 15:15:15 regarding KTp, there is something wrong about it, see https://bugs.kde.org/show_bug.cgi?id=344812 15:15:20 dvratil: Great. 15:15:21 I have the same problem 15:15:53 there's a problem with ktp-call-ui and kte-collaborative, which did not get released and they are missing deps now 15:16:02 that bug implies it's a libproxy issue 15:16:02 so theoretically they could block dnf update 15:16:16 dvratil: lovely 15:16:47 dvratil: are those 2 deprecated/Obsolete now? 15:17:14 no, I did not handle them in any way in the packaging, but I'd propose to have ktp-common-internals obsolete them for now 15:17:22 ktp-call-ui will definitely see an upstream release at some point 15:17:50 not sure about kte-collaborative 15:18:24 we might also need to update comps to exclude ktp-call-ui from kde-telepathy group (?) 15:18:40 s/might/will/ :) 15:18:55 if we don't want/need it anymore, then yeah, remove it from comps asap 15:18:55 rdieter: will you take care of that ^^? 15:18:58 ok 15:19:15 (I don't think I have write access) 15:19:16 dvratil: and kte-collaborative ? 15:19:27 same, remove 15:19:31 I guess that's not in comps 15:20:24 I also started working on live ISO but got held back by some bug so I don't know if I'll have a working ISO today 15:20:56 for some reason the images produced by livecd-creator are not bootable 15:21:00 * dvratil is looking into it 15:21:40 ....and that's it, I guess 15:22:04 oh, one more question 15:22:12 related, in kde-apps-15.04.0 update, for now gwenview is omitted due to some missing features/regressions 15:22:25 what to do about the ktp-call-ui and kte-collaborative packages? Koji keeps reporting broken deps 15:22:53 should we retire them for now and unretire once upstream makes release? 15:22:59 Obsolete them and have them blocked/retired. They can be unretired when upstream ships them again. 15:23:04 if the broken deps cannot be fixed, then yeah, retiring is the only option 15:23:14 (though they'll have to go through a rereview then, but that makes sense anyway for the KF5 port) 15:23:57 ok, I can retire kte-collaborative, but rdieter or jreznik has to do ktp-call-ui 15:24:22 and I'll add Obsoletes to ktp-common-internals, since that's always installed 15:24:49 agreed 15:25:37 moving on... 15:25:53 #topic kwalletmanager5 15:25:55 jgrulich: ^^ 15:26:48 ok, currently there is no way how to enable/disable KWallet or manage your kwallet entries or enable access when you accidently deny it for some app, becaus ethere is no kwalletmanager5 15:27:05 I think we should at least package a git snapshot and provide it in some way 15:27:13 because there is no official release yet 15:27:26 * rdieter is ok with that 15:27:32 +1 15:28:03 jgrulich: does that mean you're volunteering to work on it? :) 15:28:12 rdieter: sure, I can package it :) 15:28:28 #action jgrulich to work on packaging kwalletmanager5 snapshot 15:29:25 anything else? 15:29:44 rdieter: regarding kwalletmanager5? not from me :) 15:29:50 k, moving on 15:29:53 #topic NM-connectivity-fedora 15:29:57 Kevin_Kofler: ^^ 15:30:34 So it doesn't look like we reached a consensus there yet. 15:30:53 This was recently added to the @kde-desktop group in comps. 15:31:01 I think it really doesn't belong there. 15:31:13 Neither is it a KDE feature to begin with, nor do I think it should be installed by default on our spin. 15:31:51 The connectivity detection it provides is not reliable at all, it's just a package that secretly phones home. 15:32:08 * rdieter notes that consensus isn't the same thing as unanimous 15:32:36 I don't think we agreed to add it to begin with, did we? 15:32:58 * rdieter doesn't recall, just making it clear though :) 15:33:01 There have been complaints about that package on the mailing lists too. 15:33:15 since I'm pretty sure this topic will not reach unanimous agreement 15:33:16 Also the Fedora-wide devel mailing list, where there are enough users who got it through the GNOME spin. 15:34:00 For example, it was pointed out there that recent infrastructure downtimes made it think the Internet was not reachable, when it was just Fedora that was down. 15:35:00 * rdieter thinks that while this isn't the greatest implementation currently, it is imo generally a good idea useful feature in general 15:35:55 * Kevin_Kofler thinks it's just unnecessary spyware. 15:36:14 but it doesn't have GUI interface to switch it ON/OFF, it can be nice to have it, also when you make new connection to ask you, do you want captive portal/connectivity detection/checking ...? 15:36:21 so worthwhile to include by default. of note, it's not invasive and easily removed or disabled for those who don't want it 15:36:23 If the Internet is not reachable, you notice it when you try to reach it. 15:36:53 It's also easily installed for those who do want it. 15:37:09 it's not discoverable 15:37:18 That also applies to uninstalling it. 15:37:20 (so, that's a less-good option) 15:37:36 People don't even know they have the package installed. 15:37:45 They won't even notice something is phoning home without asking. 15:37:46 fair enough, but I'd argue the class of users who don't want it would be more savy that the class of users who are unaware or don't mind 15:38:20 any other opinions? 15:38:44 There's one piece of software that legitimately connects to Fedora servers, it's the updater (and there, it makes it clear what's going on). 15:38:58 I'm more incline to adding it by default 15:38:59 I have not got what this software does 15:39:12 (I also think start.fp.o as the browser front page sucks, it should default to something local.) 15:40:07 Caterpillar: Each time you connect to a WiFi network, and I think also periodically, it connects to a Fedora infrastructure server to check whether it can reach the server. 15:40:30 If there's an error, it assumes the Internet is not available. If it gets some HTML file instead of the text file it expects, it assumes there is a captive portal. 15:40:33 Caterpillar: if verifies connectivity 15:40:38 it was 300seconds for checking (5min) 15:40:56 bitlord: So it's also a waste of bandwidth. 15:41:08 I don't like that 15:41:15 Caterpillar: Me neither. 15:41:16 it is a very small "text file" with "OK" in it, but not needed 15:41:20 for n various privacy reasons 15:41:27 We used to not install that thing by default, but it was added without agreement. 15:41:41 So now I want to kick it back out of our comps group. 15:41:45 arguments about defaults that start with "I (don't) like" aren't compelling, imho 15:41:58 It also has absolutely nothing to do with KDE, so having it in @kde-desktop violates the principle of least surprise. 15:42:07 this isn't about what *you* like or dislike 15:42:11 (If at all, it should be in the live kickstart. But I think just not installing it by default is the best option.) 15:42:31 Kevin_Kofler: well, it extends funcionality of plasma-nm 15:42:39 so it has something to do with KDE 15:42:58 Kevin_Kofler's comment smells of NIH 15:43:02 is a feature active by default? 15:43:08 * Kevin_Kofler is also unhappy about the live image contents being increasingly controlled by comps. It adds a layer of indirection hiding the actual live image contents, and we have been burned more than once by comps changing under us. 15:43:14 Caterpillar: yes, if it is installed, it is active 15:43:56 Caterpillar: it is part of NetworkManager it is just config file which tells NM how often to check, which URL, and what to expect as a result, when file is there and configured it works when NM is active 15:43:57 I think that the system should not do anything on the net that is not triggered by the user. Exception for package updates 15:44:00 rdieter: What you call "NIH" is my point that @kde-desktop should be only, well, the KDE desktop, not random stuff that you want to have on the live image by default. 15:44:08 (The latter is what the live kickstart is for.) 15:44:20 kde-desktop is core functionality (not *just* kde stuff) 15:44:23 imho 15:44:33 and networking counts as core in my book 15:44:56 plasma-nm is there, and this enhances it, per jgrulich's comment 15:45:11 I don't know why NM doesn't have simple interface to enable/disable it for every connection :S 15:45:45 that tickles an idea that someday we could/should soft dependencies for this 15:45:45 bitlord: this would make it complicated for implementation 15:46:01 But the implementation discussion aside, I object to NM-connectivity-fedora being on the spin at all, no matter how it's pulled in. 15:46:13 Kevin_Kofler: your objection is noted 15:47:13 Proposal: Remove NetworkManager-connectivity-fedora from comps again. Rationale: It was added with insufficient discussion, and there are several reasons we don't want it (unreliability, privacy concerns, …). 15:47:18 +1 from me, obviously. 15:47:26 s/we/I/ :) 15:47:34 (sorry, snarky) 15:47:41 -1 15:47:43 -1 from me 15:47:59 Caterpillar said he doesn't want it either, that means we are ≥2 people and so "we" is the correct pronoun. :-p 15:48:19 hmm, I don't really have any strong opinion on this, but I see some benefit in the feature, so -1 from me 15:48:34 * rdieter forgets who are formal WG members to count for votes 15:48:53 -1 from me too 15:49:02 rdieter: All the ones who have given ±1 so far are. 15:49:16 -1 too 15:49:41 Do you really want to see the headlines "Fedora KDE Ships Spyware"? 15:49:46 Kevin_Kofler: they are not present here and some of them not even elligible for the vote 15:49:50 ok, I was just wondering who to ping to vote 15:50:06 than: ? 15:50:14 -1 from too 15:50:20 Kevin_Kofler: it won't happen, no one will notice it, same is with gnome spin (aka workstation) f21 gnome has it by default, hardcoded as gnome-shell dependency, no one cares :( 15:50:28 s/from/from me 15:50:34 Do we really have to ship every broken crap GNOME ships? 15:50:37 bitlord: fyi, the hard-coded dep was removed (in f22) 15:50:46 (just because GNOME ships it too?) 15:50:56 (part of my small part of being in workstation WG too) 15:51:14 rdieter: don't know, it was also dependecy on workstation-product package I think (but that is unrelated to this) 15:51:25 bitlord: yes, it was a mess, it should be fixed now 15:51:54 rdieter: So you agree that users don't want that package? Then why are you forcing it on them? 15:52:14 first time when I saw it, it was strange, NetworkManager process connecting to outside network :( 15:52:16 Kevin_Kofler: I think you're putting words in my mouth, things I never said :) 15:52:42 bitlord: my point is, it should be removable now 15:52:42 You are making sure they can remove that package, which means that you think people want to remove it. 15:53:01 I respect users who choose to remove it 15:53:06 that is all 15:53:13 And it's subject to the usual problem with opt-out spyware: By the time you get to remove the package, it already phoned home dozens of times! 15:53:19 So IMHO it's a major privacy risk. 15:53:35 Also on the live image, where the phone-home updater is not even enabled, so this thing is the ONLY thing that phones home on the live image. 15:53:43 So it leaks your usage of the live image to Fedora. 15:54:06 And by the time you remove it, it's likely too late. 15:54:27 Phone-home software MUST be opt in, not opt out. 15:54:43 you've made your point a couple times already, no need to repeat yourself 15:54:58 I had forgotten to make that particular point. 15:55:11 (That it is too late to remove the software after it already phoned home.) 15:55:21 So "just remove it" does NOT solve the problem. 15:55:51 Kevin_Kofler: your objection is noted 15:55:56 (thanks rdieter) 15:56:00 :) 15:56:24 So if you care about your privacy, your only option is to switch distribution. 15:56:26 Caterpillar: do you want to vote formally? 15:56:30 * rdieter didn't see one 15:56:41 rdieter: He's not in the list of voters, is he? 15:56:42 Kevin_Kofler: stop doing strawmans, really 15:56:49 pino|work: How's it a strawman? 15:56:55 This software violates your privacy. 15:57:00 That's exactly why I don't want it. 15:57:02 Kevin_Kofler: oh, I thought you implied he was. if not, nevermind 15:57:05 Kevin_Kofler: for this kind of objections you'd have to turn to FESCO I fear 15:57:07 dnf repoquery --whatrequires NetworkManager-config-connectivity-fedora returns fedora-release-workstation-0:22-0.14.noarch so it is not solved for worstation yet 15:57:16 rdieter: can I? 15:57:31 Caterpillar: sorry, nevermind 15:57:59 bitlord: ok, maybe it was only the hard-coded dep in gnome-shell 15:58:05 Caterpillar: We're in the minority anyway. :-( 15:58:19 fesco did nothing https://fedorahosted.org/fesco/ticket/1337 before about it 15:58:24 Sad day when a Free Software project does not care about users' privacy. 15:58:35 bitlord: FESCo… 15:58:46 They always do the wrong thing. 15:59:10 #info Proposal: Remove NetworkManager-connectivity-fedora from comps, rejected. votes: +1/-5 15:59:10 it was not KDE related but same issue as you discuss now (and me possibly) 15:59:21 moving on... 15:59:44 #topic alternate desktop DVD 15:59:47 ^^ 15:59:50 I think we should also organize the stuff for the alternate desktop DVD image 15:59:53 what did you have in mind? 16:00:21 Uh, I have another proposal, that is to move the package from @kde-desktop to the spin kickstart. 16:00:31 It has nothing to do with KDE, so @kde-desktop is the WRONG place to put it. 16:00:52 rdieter: I meant that on the famsco ticket, a person (don't remember who) wrote that somebody have to prepare the ISO 16:01:23 Caterpillar: are you volunterring? :) 16:01:38 (otherwise, it's hard to volunteer someone elses time) 16:01:39 I have never done that :-) 16:01:51 is it easy to learn? 16:02:10 I suppose it just needs minor adaptation of the F20 multi-desktop DVD scripts. 16:02:41 Now where are those scripts? 16:03:23 I just wanted to make it clear to famsco that we wanted an image, and that lack of a multi-desktop DVD is not a valid excuse to do nothing 16:03:36 rdieter: +1 16:05:43 :) 16:07:13 so, is there anything else to discuss there? 16:07:26 * rdieter sounds like no 16:07:26 https://fedoraproject.org/wiki/User:Cwickert/MultiDesktopDVD_HowTo 16:07:59 who will do the artwork? 16:08:01 That's what I see, but there should be some script automating that. 16:09:23 Caterpillar: I think you're asking the wrong people 16:09:44 I don't know how "Fedora-20-Multi-Desktop.iso" was produced, there's no source in the directory. :-( 16:09:55 I'd venture fedora-design folks could help... if asked 16:10:13 nicely, with cookies 16:11:17 According to https://ke4qqq.wordpress.com/2011/06/11/fedora-bi-arch-multi-desktop-livedvd/ , spot did the script. 16:11:41 spot: Is the script used to make the Multi-Desktop DVDs up to F20 available anywhere? 16:12:06 Ambassadors want something like that (but only for the "Spins", without Workstation that they're doing separately) for F22. 16:13:15 Ah, I found it: https://fedorahosted.org/multiboot-media-creator/ 16:13:28 we're a bit over our hour, we should wrap up soon 16:13:30 https://fedoraproject.org/wiki/Multi_Boot_Media_SOP 16:14:30 * Kevin_Kofler hopes to get around to do a Vienna Linux Week special edition DVD with F21 KDE and F22 Beta KDE in dual boot. :-) But time is running short for that. :-( 16:15:10 #topic open discussion 16:15:14 * randomuser had the uninformed impression that releng had opted out of the multi-dvd 16:15:31 Kevin_Kofler: ah I am looking forward to do an install fest with some Fedora KDE discs :> 16:15:34 randomuser: true, it's not a deliverable produced by them 16:15:42 ack 16:15:42 rdieter: There's also the autolocking discussion. 16:16:01 The consensus among users on the kde mailing list is that autolocking should be off by default. 16:16:09 I only see 3 developers for it. 16:16:16 And at least 1 against it, me. 16:16:32 oh, sorry, I missed the "...and autolocking" 16:16:56 I'm going to take the opportunity again to ask for help with https://bugzilla.redhat.com/show_bug.cgi?id=1111433 - the submitter is really enthusiastic about the [KDE-based] jam spin but is having trouble getting traction as a packager 16:17:17 Kevin_Kofler: we do another vote if you want, but I suspect it will go similarly as the NM one 16:17:55 If you're all set on ignoring your users, sure, it'll end up that way, grrr… 16:18:03 or we can continue discussions onlinst/#fedora-kde in hopes of finding more compromise/consensus 16:18:10 There is no compromise. 16:18:19 ANY autolocking timeout is 1. an annoyance and 2. a major security issue. 16:18:21 ok, then we're done talking it seems 16:18:47 Contrary to what was claimed, the misfeature does NOT provide any security, but remove some. 16:19:14 Because what happens then is that users will just leave their computer without locking because "hey, it locks automatically anyway" and then the intruder gets plenty of time to take over the machine. 16:19:14 * rdieter is willing to hold another vote, but repeating same arguments over and over is just wasting meeting time imo 16:19:29 Really, security requires to lock manually, there is NO alternative to that. 16:19:38 Autolocking is only an annoyance, nothing more. 16:20:04 Why do people keep claiming it's a security improvement when I already debunked that myth? 16:20:41 * rdieter *personally* finds the default timeout of 5 minutes too short, but my attempts at compromising didn't go anywhere either 16:21:18 A longer timeout makes the misfeature even more useless and insecure. 16:21:25 So I understand why people don't want that. 16:21:37 But even 5 minutes is already PLENTY of time to attack your unlocked machine. 16:22:10 To be secure, it'd need to be less than the time you take to leave the room, i.e. 5 to 10 seconds. Needless to say, that is NOT workable. 16:22:28 So autolocking is just inherently flawed and unworkable. 16:24:38 * Kevin_Kofler doesn't understand why his objections are always dismissed without taking them into account at all. 16:25:27 Do I really have to come to your office and break into your not-yet-autolocked account? 16:26:24 Kevin_Kofler: I don't think anyone feels like discussing because you already made it clear you're not willing to listen either 16:26:48 I'll return to regularly scheduled meetings next week, folks - I've not been getting to work until after the meeting has started this school term, so I've missed most of them. 16:27:07 danofsatx: yay :) 16:28:11 Kevin_Kofler: thanks for outlining your thoughts on the matter, but we really need to end the meeting now... unless there's something actionable you want to propose first? 16:28:33 Well, you know what I propose. 16:28:39 But it looks like you're not willing to support it. 16:29:02 * rdieter doesn't see a formal proposal or request to vote yet :) 16:29:46 Proposal: Disable timeout-based automatic locking in kde-settings, matching the setting we have been shipping until Fedora 21. 16:29:48 +1 16:30:26 jgrulich, than, dvratil, pino|work: ping ^^ 16:30:30 looks like we lost ltinkl 16:30:37 -1 16:30:38 -1 16:30:42 -1 16:30:48 Rationale: It is a controversial change compared to Fedora 22, the security it provides is doubtful (it actually introduces a new security risk). 16:30:54 I would just maybe increas it to 10 minutes 16:31:00 So shipping what worked for 21 releases is the safe way out. 16:31:08 Plus, all the users commenting on the ML agreed on it. 16:31:31 * rdieter diplomatic with +0, I personally prefer other options, and think there are better compromise solutions 16:31:36 which means you have the feedback only of the vocal users against it 16:31:37 Why is everyone so set against shipping what has worked for 21 releases? 16:31:55 pino|work: The usual GNOME excuse. 16:32:10 * rdieter agrees with pino|work here 16:32:22 Kevin_Kofler: don't even *dare* to say that to me 16:32:52 Kevin_Kofler: if you have no arguments, just... well, don't say anything than start personal insults, thanks 16:32:55 Sorry, but that argument is word for word what Havoc et al. have said when rightfully accused of ignoring their users. 16:33:08 i don't care what Havoc says 16:33:23 There is no proof that your purported silent majority exists. 16:33:24 #info Proposal: Disable timeout-based automatic locking in kde-settings, matching the setting we have been shipping until Fedora 21, rejected, +1,-3 (one +0) 16:33:29 i haven't even read his blog since years 16:33:32 thanks everyone, sorry for going so long 16:33:35 #endmeeting