12:30 p.m.
Hi!
I created the page http://rpmfusion.org/News in the wiki;
The RPM Fusion contributors on (plan to) mention some of the
important changes on this page that might be of interest to RPM
Fusion users and contributors. So to keep track of what's happening
in RPM Fusion visit this page regularly; you can also create and
account in this wiki and subscribe to this page to get a E-Mail
notification every time a new news entry gets added!
I thought we could spread some news there to keep users up2date what
happening in RPM Fusion land; e.g. major new packages (say broadcom-wl),
updates for important packages (amd/nvidia) and things like that.
Do you guys like the idea (we can quickly delete the page if nobody
likes it)? Will you help getting some news added there now and then?
Note: Maybe we should add more points where users can retrieve
information of what's happening in RPM Fusion. We likely need an
announce mailing list sooner or later. A planet.rpmfusion.org might be
nice, but that only works if we have enough contributors that post a
blog entry now and then.
CU
knurd
1:39 p.m.
2008/11/9 Thorsten Leemhuis <fedora(a)leemhuis.info>:
I thought we could spread some news there to keep users up2date what
happening in RPM Fusion land; e.g. major new packages (say broadcom-wl),
updates for important packages (amd/nvidia) and things like that.
Do you guys like the idea (we can quickly delete the page if nobody likes
it)? Will you help getting some news added there now and then?
I like the idea but I don't think that a wiki is the best way for
spreading news. I think that even a simple blog like wordpress can do
a better service (better artwork, RSS feeds, etc). Anyway a wiki page
is still better than nothing :)
If you are interested on setting up wordpress I can help.
Bye,
Andrea.
1:55 p.m.
On 09.11.2008 14:39, Andrea Musuruane wrote:
2008/11/9 Thorsten Leemhuis <fedora(a)leemhuis.info>:
> I thought we could spread some news there to keep users up2date what
> happening in RPM Fusion land; e.g. major new packages (say broadcom-wl),
> updates for important packages (amd/nvidia) and things like that.
>
> Do you guys like the idea (we can quickly delete the page if nobody likes
> it)? Will you help getting some news added there now and then?
I like the idea but I don't think that a wiki is the best way for
spreading news. I think that even a simple blog like wordpress can do
a better service (better artwork, RSS feeds, etc).
I mostly agree. But the Wiki has one (IMHO big) advantage over a
(wordpress) blog: You can subscribe to a page and the information comes
to you by mail; you don't have to go and check yourself (or let the RSS
reader check) if there is something new ;-)
Anyway a wiki page is still better than nothing :)
Fully agreed.
And it has another benefit (which also can be a disadvantage): Everybody
has automatically access to it immediately.
If you are interested on setting up wordpress I can help.
I for one have enough on my todo list already. But I'd be really glad if
somebody else could work on something like that.
Cu
knurd
4:27 p.m.
Thorsten Leemhuis wrote:
I mostly agree. But the Wiki has one (IMHO big) advantage over a
(wordpress) blog: You can subscribe to a page and the information
comes to you by mail; you don't have to go and check yourself (or let
the RSS reader check) if there is something new ;-)
There are plugins for wordpress that allow a user to signup and be
notified by email when a new post is made. If that kind of thing floats
your boat ;)
And it has another benefit (which also can be a disadvantage):
Everybody has automatically access to it immediately.
It would be interesting to see whether we could integrate wordpress with
FAS so that people within a certain group in FAS have automatic access
to post on wordpress - this may be better than yet another
username/password, but equally its no show-stopper if it can't be
achieved. (I've no idea how easy/difficult it is to integrate external
systems with FAS?)
> If you are interested on setting up wordpress I can help.
I for one have enough on my todo list already. But I'd be really glad
if somebody else could work on something like that.
I'd also be happy to help host/setup a blog for rpmfusion. I have good
experience with wordpress - PHP is more my realm than packaging!
If FAS allows some kind of API for login/group verification then I'm
fairly confident I can hack together a wordpress plugin that uses this
to authenticate users.
Anyone else have thoughts on this?
4:38 p.m.
On 09.11.2008 17:27, Chris Nolan wrote:
Thorsten Leemhuis wrote:
> I mostly agree. But the Wiki has one (IMHO big) advantage over a
> (wordpress) blog: You can subscribe to a page and the information
> comes to you by mail; you don't have to go and check yourself (or let
> the RSS reader check) if there is something new ;-)
There are plugins for wordpress that allow a user to signup and be
notified by email when a new post is made. If that kind of thing floats
your boat ;)
Well, yes, it would, but it doesn't solve the issue for lots of other
pages. Hence I started to use rss2email a lot, as the informations
automatically comes to my inbox again -- that's where at least I want it ;-)
>> If you are interested on setting up wordpress I can help.
> I for one have enough on my todo list already. But I'd be really glad
> if somebody else could work on something like that.
I'd also be happy to help host/setup a blog for rpmfusion. [...]
Sounds good.
If FAS allows some kind of API for login/group verification then
I'm
fairly confident I can hack together a wordpress plugin that uses this
to authenticate users.
There is a API afaics, as bugzilla, bodhi, pkdb and other services in
Fedora all can interact with FAS. So it likely shouldn't be to hard what
you want to do; maybe you can some of the infos you need on
https://fedorahosted.org/fas/ ; otherwise ask ToshioKuratomi (
abadger1999 in #fedora-devel; see also
/http://fedoraproject.org/wiki/ToshioKuratomi)
HTH
Cu
knurd
6:25 p.m.
Thorsten Leemhuis wrote:
There is a API afaics, as bugzilla, bodhi, pkdb and other services in
Fedora all can interact with FAS. So it likely shouldn't be to hard
what you want to do; maybe you can some of the infos you need on
https://fedorahosted.org/fas/ ; otherwise ask ToshioKuratomi (
abadger1999 in #fedora-devel; see also
/http://fedoraproject.org/wiki/ToshioKuratomi)
Thanks, I spoke with Toshio and he was most helpful. From the info he
gave me it should be relatively straightforward to make Wordpress
authenticate against FAS. That is the first step, and then (optionally)
we could only allow people within a certain FAS group to make posts.
Potentially we could even map various groups within FAS to different
roles within WP.
If others agree that a blog would be useful for rpmfusion (I personally
think its a great idea and would be an excellent tool for communicating
with end users) then I'll get busy putting together a WP plugin for
authenticating against FAS.
C
6:33 p.m.
2008/11/9 Chris Nolan <chris(a)cenolan.com>:
If others agree that a blog would be useful for rpmfusion (I
personally
think its a great idea and would be an excellent tool for communicating with
end users) then I'll get busy putting together a WP plugin for
authenticating against FAS.
+1
Andrea.
6:57 p.m.
On 09.11.2008 19:25, Chris Nolan wrote:
Thorsten Leemhuis wrote:
> There is a API afaics, as bugzilla, bodhi, pkdb and other services in
> Fedora all can interact with FAS. So it likely shouldn't be to hard
> what you want to do; maybe you can some of the infos you need on
> https://fedorahosted.org/fas/ ; otherwise ask ToshioKuratomi (
> abadger1999 in #fedora-devel; see also
> /http://fedoraproject.org/wiki/ToshioKuratomi)
Thanks, I spoke with Toshio and he was most helpful. From the info he
gave me it should be relatively straightforward to make Wordpress
authenticate against FAS. That is the first step, and then (optionally)
we could only allow people within a certain FAS group to make posts.
Potentially we could even map various groups within FAS to different
roles within WP.
If others agree that a blog would be useful for rpmfusion (I personally
think its a great idea and would be an excellent tool for communicating
with end users) then I'll get busy putting together a WP plugin for
authenticating against FAS.
I like the idea, nevertheless the big question that springs to my mind
is: Do people really want to make posts (aka. blog about stuff that
happens)? And do they not only want to, but actually do it later?
I mean, everyone of us that is a Fedora contributor already could have
simply done it: Set up a blog somewhere, add its rss feed to Fedora
planet and post about interesting things that happen in RPM Fusion (or
dribble/frehsrpms/livna beforehand). Nearly none of the current
contributors did that afaics.
CU
knurd
7:22 p.m.
2008/11/9 Thorsten Leemhuis <fedora(a)leemhuis.info>:
I like the idea, nevertheless the big question that springs to my
mind is:
Do people really want to make posts (aka. blog about stuff that happens)?
And do they not only want to, but actually do it later?
I think so :)
I mean, everyone of us that is a Fedora contributor already could
have
simply done it: Set up a blog somewhere, add its rss feed to Fedora planet
and post about interesting things that happen in RPM Fusion (or
dribble/frehsrpms/livna beforehand). Nearly none of the current contributors
did that afaics.
I think we need an *official* blog where the all type of user can be
informed. Possibily with an RPM Fusion theme. Something that is not
related to planet Fedora but that can be easily aggregated by feed
readers or planets.
Just my 2c.
Bye,
Andrea.
7:35 p.m.
On 09.11.2008 20:22, Andrea Musuruane wrote:
2008/11/9 Thorsten Leemhuis <fedora(a)leemhuis.info>:
> I like the idea, nevertheless the big question that springs to my mind is:
> Do people really want to make posts (aka. blog about stuff that happens)?
> And do they not only want to, but actually do it later?
I think so :)
I'm not that optimistic ;-)
> I mean, everyone of us that is a Fedora contributor already could
have
> simply done it: Set up a blog somewhere, add its rss feed to Fedora planet
> and post about interesting things that happen in RPM Fusion (or
> dribble/frehsrpms/livna beforehand). Nearly none of the current contributors
> did that afaics.
I think we need an *official* blog where the all type of user can be
informed. Possibily with an RPM Fusion theme. Something that is not
related to planet Fedora but that can be easily aggregated by feed
readers or planets.
Sure, I got that and I tend to agree. But let me say what I meant in
different words again: Afaics most RPM Fusion (or
dribble/frehsrpms/livna beforehand) contributors up to now didn't blog
much about their 3rd party work -- at least I didn't see much blog posts
about it on planet fedora. There is also not that much contribution to
our wiki from packagers. So maybe most packagers are not that interested
in "writing about their work and their packages" and that's why I'm not
100% sure that this will be different with a official RPM Fusion blog (¹).
But we'll see; maybe I'd wrong (hopefully I am). I just thought it's
worth mentioning. What my mind maybe wanted to say: Maybe start small
and don't put to much work in FAS authentications before we know for
sure that people will use that blog.
/me shuts up now
Just my 2 cent of course.
CU
knurd
(¹) Further: I often think "hey, I should blog about this" and later
don't find time for it; I fear that will be the same with a official RPM
Fusion blog...
7:55 p.m.
Thorsten Leemhuis wrote:
Sure, I got that and I tend to agree. But let me say what I meant in
different words again: Afaics most RPM Fusion (or
dribble/frehsrpms/livna beforehand) contributors up to now didn't blog
much about their 3rd party work -- at least I didn't see much blog
posts about it on planet fedora. There is also not that much
contribution to our wiki from packagers. So maybe most packagers are
not that interested in "writing about their work and their packages"
and that's why I'm not 100% sure that this will be different with a
official RPM Fusion blog (¹).
I share your concerns so while I think it is a great idea I am also
unsure whether it would work in practice. I would certainly blog on my
own blog about say wl-kmod being available but IMO the better place for
such a post would be an official rpmfusion blog that is aggregated to
planet and others giving it maximum exposure to the target audience.
We could encourage other contributors to blog when they release a new
package or an update - it only takes a few lines to say "foo version x.x
is now available in rpmfusion - it has these fixes and these new
features, all users should upgrade, you can upgrade like this.." - if
they want to go mad they could even include a screenshot or two. It
would hopefully also encourage some more feedback from end-users -
especially those that aren't comfortable raising bugzilla bugs - we may
also get tons of "i can't get it to work" comments, which would be
annoying.
A good example of someone who does blog about RPM updates is Remi Collet
and I have often found out about new builds of his packages through
reading planet fedora (I dont have his repo enabled by default).
But we'll see; maybe I'd wrong (hopefully I am). I just
thought it's
worth mentioning. What my mind maybe wanted to say: Maybe start small
and don't put to much work in FAS authentications before we know for
sure that people will use that blog.
I think the wordpress FAS plugin will be fairly trivial to make - at
least for basic functionality. Also Toshio was saying that the fedora
folk may want to use it too since they have been toying with the idea of
using wordpress-mu. Therefore I don't mind expending a little time on it
and we can see if it takes off.
(¹) Further: I often think "hey, I should blog about this"
and later
don't find time for it; I fear that will be the same with a official
RPM Fusion blog...
True, me too.
8:03 p.m.
On Sun November 9 2008, Chris Nolan wrote:
I'd also be happy to help host/setup a blog for rpmfusion. I have
good
experience with wordpress - PHP is more my realm than packaging!
If FAS allows some kind of API for login/group verification then I'm
fairly confident I can hack together a wordpress plugin that uses this
to authenticate users.
Anyone else have thoughts on this?
With using the FAS credentials, that allow to produce major damage in the
wrong hands, within an application that is considered not very secure make my
security concerns grow a lot more. I know that they are already used for
OpenID and Mediawiki in Fedora, so there are a lot of attack vectors there,
but maybe RPMFusion could be more secure.
Regards,
Till
9:30 p.m.
Till Maas wrote:
With using the FAS credentials, that allow to produce major damage in the
wrong hands, within an application that is considered not very secure make my
security concerns grow a lot more. I know that they are already used for
OpenID and Mediawiki in Fedora, so there are a lot of attack vectors there,
but maybe RPMFusion could be more secure.
This is a fair concern - wordpress has a poor history. However, the
potential for an exploit being harmful would be minimal because WP would
never store the FAS password and a validated WP session has no control
over FAS. All authentication with FAS would be done over SSL: at no
point is the password sent over a non-encrypted connection and it is
never stored anywhere within wordpress or logged anywhere on the client
machine/within the session/on the wordpress server.
Additionally, even if an attacker can hijack a validated wordpress
session there would be no way they could use that hijacked session to
attack FAS since there is no two-way link between WP and FAS. So the
potential for any harmful exploit should be no greater (and potentially
less since the pw is never stored) than for the other third-party apps
that have already been integrated with FAS.
Of course, I will check all this out with the FAS developers and ensure
that they agree that it is as safe as possible.
10:41 p.m.
On Sun November 9 2008, Chris Nolan wrote:
Till Maas wrote:
> With using the FAS credentials, that allow to produce major damage in the
> wrong hands, within an application that is considered not very secure
> make my security concerns grow a lot more. I know that they are already
> used for OpenID and Mediawiki in Fedora, so there are a lot of attack
> vectors there, but maybe RPMFusion could be more secure.
This is a fair concern - wordpress has a poor history. However, the
potential for an exploit being harmful would be minimal because WP would
never store the FAS password and a validated WP session has no control
over FAS. All authentication with FAS would be done over SSL: at no
point is the password sent over a non-encrypted connection and it is
never stored anywhere within wordpress or logged anywhere on the client
machine/within the session/on the wordpress server.
One pretty common vulnerability would be a cross site scripting, especiall a
persistent one, where all the described security measures would not help. An
attacker would simply modify the login prompt that is shown if someone opens
the wordpress homepage and instead of sending the credentials directly to
FAS, they are also sent to the attacker. Here SSL or not storing the
credentials on the worpress server would not help.
Regards,
Till
11:37 p.m.
Till Maas wrote:
One pretty common vulnerability would be a cross site scripting, especiall a
persistent one, where all the described security measures would not help. An
attacker would simply modify the login prompt that is shown if someone opens
the wordpress homepage and instead of sending the credentials directly to
FAS, they are also sent to the attacker. Here SSL or not storing the
credentials on the worpress server would not help.
Very true. Keeping up with the WP updates and not using dangerous
third-party plugins would help reduce this possibility - but still, it
would cause a massive admin problem for rpmfusion if the site was
compromised in such a way and FAS details were released.
C
2:12 p.m.
Andrea Musuruane wrote:
2008/11/9 Thorsten Leemhuis <fedora(a)leemhuis.info>:
> I thought we could spread some news there to keep users up2date what
> happening in RPM Fusion land; e.g. major new packages (say broadcom-wl),
> updates for important packages (amd/nvidia) and things like that.
>
> Do you guys like the idea (we can quickly delete the page if nobody likes
> it)? Will you help getting some news added there now and then?
>
I like the idea but I don't think that a wiki is the best way for
spreading news. I think that even a simple blog like wordpress can do
a better service (better artwork, RSS feeds, etc). Anyway a wiki page
is still better than nothing :)
+1 for a blog for posting news
Much easier for people to see what is "new" and we can publish to planet
fedora etc to spread the word.
I can offer hosting and setup of a wordpress blog if it helps (CentOS on
a Linode).
C
5861
days inactive
5861
days old
rpmfusion-developers@lists.rpmfusion.org
15 comments
4 participants
participants (4)
-
Andrea Musuruane -
Chris Nolan -
Thorsten Leemhuis -
Till Maas