Mailing List Archive

"W.Kenworthy" <billk@iinet.net.au> skribis:
> Re the xorg-x11 GLSA 200509-07. Is bug #96053 fixed in -r3? The -r2
> version is unusable for me because of this.

Apparently not -- I tried OpenOffice and it still has black icons.

--
Barry.SCHWARTZ@chemoelectric.org http://www.chemoelectric.org
Esperantistoj rajtas skribi al Barijo.SXVARCO@chemoelectric.org
'And now we're going to go try to comfort people in that
part of the world.' -- Bush, referring to the southeastern U.S.

W.Kenworthy wrote:

> Re the xorg-x11 GLSA 200509-07. Is bug #96053 fixed in -r3? The -r2
> version is unusable for me because of this.
>
> According to the bug its resolved, fixed upstream, but there is no
> detail which versions of xorg it applies to.

The -r3 is just -r2 + the security fix. I guess you'll have to wait for
the next version...

--
Koon
--
gentoo-security@gentoo.org mailing list

On Tue, Sep 13, 2005 at 06:59:21AM +0800, W.Kenworthy wrote:
> Re the xorg-x11 GLSA 200509-07. Is bug #96053 fixed in -r3? The -r2
> version is unusable for me because of this.
>
> According to the bug its resolved, fixed upstream, but there is no
> detail which versions of xorg it applies to.
>
> BillK

Hi Bill,

-r3 is just a simple security bump from -r2, so it should have all the
characteristics of -r2 except for that buffer overflow issue with pixmap
memory requests. So yeah, you'll still see black icons, but please do
track the upstream bug:
https://bugs.freedesktop.org/show_bug.cgi?id=3781

Thanks,

Seemant
--
gentoo-security@gentoo.org mailing list

I'm using the workaround of manually deleting the problem patch during
the build.

The problem for gentoo that I see is that with the removal of -r1 (and
xfree being the only viable alternative is not available either), gentoo
does not have a usable desktop for those actually using it in
production, so this should be viewed as a serious issue that requires
active resolution - just leaving this issue in place until we catch up
with upstream means this is going to become a running sore for gentoo.

We (the users) need a stable, secure, and working X.

BillK



On Tue, 2005-09-13 at 11:03 -0400, Seemant Kulleen wrote:
> On Tue, Sep 13, 2005 at 06:59:21AM +0800, W.Kenworthy wrote:
> > Re the xorg-x11 GLSA 200509-07. Is bug #96053 fixed in -r3? The -r2
> > version is unusable for me because of this.
> >
> > According to the bug its resolved, fixed upstream, but there is no
> > detail which versions of xorg it applies to.
> >
> > BillK
>
> Hi Bill,
>
> -r3 is just a simple security bump from -r2, so it should have all the
> characteristics of -r2 except for that buffer overflow issue with pixmap
> memory requests. So yeah, you'll still see black icons, but please do
> track the upstream bug:
> https://bugs.freedesktop.org/show_bug.cgi?id=3781
>
> Thanks,
>
> Seemant
--
William Kenworthy <billk@iinet.net.au>
Home!
--
gentoo-security@gentoo.org mailing list

Placing demands on the devs who donate their time for this community is
not exactly the way of going about it. Finding a way to help those devs
is a better path to a solution. ;)

On Wed, 2005-09-14 at 07:28 +0800, William Kenworthy wrote:
> I'm using the workaround of manually deleting the problem patch during
> the build.
>
> The problem for gentoo that I see is that with the removal of -r1 (and
> xfree being the only viable alternative is not available either), gentoo
> does not have a usable desktop for those actually using it in
> production, so this should be viewed as a serious issue that requires
> active resolution - just leaving this issue in place until we catch up
> with upstream means this is going to become a running sore for gentoo.
>
> We (the users) need a stable, secure, and working X.
>
> BillK
>
>
>
> On Tue, 2005-09-13 at 11:03 -0400, Seemant Kulleen wrote:
> > On Tue, Sep 13, 2005 at 06:59:21AM +0800, W.Kenworthy wrote:
> > > Re the xorg-x11 GLSA 200509-07. Is bug #96053 fixed in -r3? The -r2
> > > version is unusable for me because of this.
> > >
> > > According to the bug its resolved, fixed upstream, but there is no
> > > detail which versions of xorg it applies to.
> > >
> > > BillK
> >
> > Hi Bill,
> >
> > -r3 is just a simple security bump from -r2, so it should have all the
> > characteristics of -r2 except for that buffer overflow issue with pixmap
> > memory requests. So yeah, you'll still see black icons, but please do
> > track the upstream bug:
> > https://bugs.freedesktop.org/show_bug.cgi?id=3781
> >
> > Thanks,
> >
> > Seemant
> --
> William Kenworthy <billk@iinet.net.au>
> Home!

--
gentoo-security@gentoo.org mailing list

On Wednesday 14 September 2005 01:28, William Kenworthy wrote:
> I'm using the workaround of manually deleting the problem patch during
> the build.
>
> The problem for gentoo that I see is that with the removal of -r1 (and
> xfree being the only viable alternative is not available either), gentoo
> does not have a usable desktop for those actually using it in
> production, so this should be viewed as a serious issue that requires
> active resolution - just leaving this issue in place until we catch up
> with upstream means this is going to become a running sore for gentoo.
>
> We (the users) need a stable, secure, and working X.

where did you get the idea, that a moving target like gentoo is apropriate for
a production box?

If you put gentoo onto such a box, it is your very own problem. If you want
total stability and a lot of testing prior a patch goes out, maybe you should
spent the bucks and buy SLES or RHEL
If something breaks with them, you have a right to whine.

Oh, and by the way: for me X is stable, secure and working - everybody has
different needs.
--
gentoo-security@gentoo.org mailing list

Your missreading what I am saying.

1. I am not placing "demands"
2. I have pointed out the solution
3. I have pointed out the problem for gentoo as a distro
4. Everybodies requirements are different: unless devs get feedback on
whats important to users, how would they know. I acknowledge that whats
important to devs is not neccessarily going to gel for the users, but
the fact that gentoo now does not have a usable desktop for a large part
of its user community should be a concern for all.

BillK



On Tue, 2005-09-13 at 20:30 -0400, xyon wrote:
> Placing demands on the devs who donate their time for this community is
> not exactly the way of going about it. Finding a way to help those devs
> is a better path to a solution. ;)
>
> On Wed, 2005-09-14 at 07:28 +0800, William Kenworthy wrote:
> > I'm using the workaround of manually deleting the problem patch during
> > the build.
> >
> > The problem for gentoo that I see is that with the removal of -r1 (and
> > xfree being the only viable alternative is not available either), gentoo
> > does not have a usable desktop for those actually using it in
> > production, so this should be viewed as a serious issue that requires
> > active resolution - just leaving this issue in place until we catch up
> > with upstream means this is going to become a running sore for gentoo.
> >
> > We (the users) need a stable, secure, and working X.
> >
> > BillK
> >
> >
> >
> > On Tue, 2005-09-13 at 11:03 -0400, Seemant Kulleen wrote:
> > > On Tue, Sep 13, 2005 at 06:59:21AM +0800, W.Kenworthy wrote:
> > > > Re the xorg-x11 GLSA 200509-07. Is bug #96053 fixed in -r3? The -r2
> > > > version is unusable for me because of this.
> > > >
> > > > According to the bug its resolved, fixed upstream, but there is no
> > > > detail which versions of xorg it applies to.
> > > >
> > > > BillK
> > >
> > > Hi Bill,
> > >
> > > -r3 is just a simple security bump from -r2, so it should have all the
> > > characteristics of -r2 except for that buffer overflow issue with pixmap
> > > memory requests. So yeah, you'll still see black icons, but please do
> > > track the upstream bug:
> > > https://bugs.freedesktop.org/show_bug.cgi?id=3781
> > >
> > > Thanks,
> > >
> > > Seemant
> > --
> > William Kenworthy <billk@iinet.net.au>
> > Home!
>
--
gentoo-security@gentoo.org mailing list

William Kenworthy wrote:
> I'm using the workaround of manually deleting the problem patch during
> the build.
>
> The problem for gentoo that I see is that with the removal of -r1 (and
> xfree being the only viable alternative is not available either), gentoo
> does not have a usable desktop for those actually using it in
> production, so this should be viewed as a serious issue that requires
> active resolution - just leaving this issue in place until we catch up
> with upstream means this is going to become a running sore for gentoo.
>
> We (the users) need a stable, secure, and working X.
>
> BillK
The whole point of Gentoo is that you have the Ultimate say on what
goes. If you don't like the current version of X you can write your own
ebuild and do it however you like. No one forces you to use the ebuilds
put out by the developers. If you want the -r1 version feel free to go
into ViewCVS and get it; it should still be there.

If you want your solution to be merged, you are better off trying to
convince xorg's maintainer and you are better off having the work laid
out to be done so that it's not a PITA for them to integrate it into
Gentoo's tree. This mailing list is not the place for discussion of how
the bug should be patched in the source, or whining because the ebuild
the developer provided doesn't suit your particular needs. Make an
overlay, modify the ebuild, and hazzah your needs are met. Gentoo has
never promised a stable solution and unless the relevant GLEP is taken
up by someone and implemented probably never will.
--
gentoo-security@gentoo.org mailing list

"W.Kenworthy" <billk@iinet.net.au> skribis:
> 4. Everybodies requirements are different: unless devs get feedback on
> whats important to users, how would they know. I acknowledge that whats
> important to devs is not neccessarily going to gel for the users, but
> the fact that gentoo now does not have a usable desktop for a large part
> of its user community should be a concern for all.

You could likely use the upstream version rather than the Gentoo
percolated product. That's what I do with my kernel patches, partly
for similar reasons as what you are dealing with.


--
Barry.SCHWARTZ@chemoelectric.org http://www.chemoelectric.org
Esperantistoj rajtas skribi al Barijo.SXVARCO@chemoelectric.org
'And now we're going to go try to comfort people in that
part of the world.' -- Bush, referring to the southeastern U.S.

I do do that at times, but in this case the quickest was to start the
emerge (glsa-check -f package) then CTRL-Z it after the unpack, but
before the patch stage (easy because there are so many patches), delete
patch 9914*, foreground (fg) the job and it works.

My reason for starting this thread was not to flame, but try and add
weight to others who have added to the original, long standing bug about
this to get this patch formally deleted from the stable branch as its
manifestly not needed for the majority of users. The very small group
who do need this patch are using gcc4 which is hardly mainstream. Even
though the comment was this patch was applied upstream, its actually
physically applied by the ebuild, so why cant the ebuild just not apply
it?

BillK

On Tue, 2005-09-13 at 21:56 -0500, Barry.SCHWARTZ@chemoelectric.org
wrote:
> "W.Kenworthy" <billk@iinet.net.au> skribis:
> > 4. Everybodies requirements are different: unless devs get feedback on
> > whats important to users, how would they know. I acknowledge that whats
> > important to devs is not neccessarily going to gel for the users, but
> > the fact that gentoo now does not have a usable desktop for a large part
> > of its user community should be a concern for all.
>
> You could likely use the upstream version rather than the Gentoo
> percolated product. That's what I do with my kernel patches, partly
> for similar reasons as what you are dealing with.
>
>
--
gentoo-security@gentoo.org mailing list

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

W.Kenworthy wrote:
> I do do that at times, but in this case the quickest was to start the
> emerge (glsa-check -f package) then CTRL-Z it after the unpack, but
> before the patch stage (easy because there are so many patches), delete
> patch 9914*, foreground (fg) the job and it works.
>
> My reason for starting this thread was not to flame, but try and add
> weight to others who have added to the original, long standing bug about
> this to get this patch formally deleted from the stable branch as its
> manifestly not needed for the majority of users. The very small group
> who do need this patch are using gcc4 which is hardly mainstream. Even
> though the comment was this patch was applied upstream, its actually
> physically applied by the ebuild, so why cant the ebuild just not apply
> it?

Like I said previously, this is not the correct place to discuss the
semantics of the ebuild. Talk to the xorg maintainer.

<antarus> !meta xorg-x11
<jeeves> antarus: Package: x11-base/xorg-x11 Herd: x11 Maintainer: x11
Description: X11 implementation by X.Org Foundation
<antarus> !herd x11
<jeeves> antarus: (x11) azarah, battousai, eradicator, hhg, lu_zero,
seemant, sekretarz, spyderous

You probably want to get a hold of spyderous, or seemant as I see he
commented earlier on this issue on-list. Regardless, this list is not
the correct place to have this discussion.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iQIVAwUBQyecAmzglR5RwbyYAQIDOA/8Doa0uepGBk5zv6lxf2IfwLwxy++8XKAZ
N3JxPhVogiXD3cYSC7tnURc21fr7H16BdJ/ftuclfgLVjlJFbk1ZWpUIxtquMTRC
MBA9R7C79uk4er9XZOHZ72AhrZENsPozBwOfgdIFE+EDMUBtUS/5OQ75zdf/sFSg
wIB333dArZ+7x72UTpLr9WjQ++xMlXTKgjyI/sX+cTDVvehCrGPNE3EbEiQrM1dd
QpvBtWI9xjHnbPKi6Jx19dQb/SFCJkpYCMS2j2i4gf/Hu8HzQJm/O7isfjg97zO8
IaTOl+vaZHYIhcrm6XXftx3MzB2fkvs4WZ2f/C3hdDjMKcyzCOK2kNdPNoo5nBpx
nicLJ5mnzz/rEY6nMGvoA+WMzFuFWvLx3MZxXfYeswCWEnbvpxJR/5Vs/E0lKfVa
+Ra7bWi4s3krywu+Jttd/PCmRXP3cZv8KgveoigtU4WOz3fvTXHZAIpxSaa3Gig3
npApj9idza64q3QUsLzEGaNhiFm9w6grSWvNmDg05ZUVXhtHOMkc+g4Ba/4NKf95
A3Cak24rjYv7nqHBE3CW3B16Vqp19faDJYAcnqrjK48SBnLy9V6N/kq410zYW5dw
fknOoxXxYOXWVQPnlw7P/8XsYXummsjs2WSxVAKqFGNAG//71ZHXa8n9z2l2IoZk
8FTWPe/CoBU=
=RfaP
-----END PGP SIGNATURE-----
--
gentoo-security@gentoo.org mailing list

On Tue, 13 Sep 2005 21:56:04 -0500
Barry.SCHWARTZ@chemoelectric.org wrote:

> "W.Kenworthy" <billk@iinet.net.au> skribis:
> > 4. Everybodies requirements are different: unless devs get feedback on
> > whats important to users, how would they know. I acknowledge that whats
> > important to devs is not neccessarily going to gel for the users, but
> > the fact that gentoo now does not have a usable desktop for a large part
> > of its user community should be a concern for all.
>
> You could likely use the upstream version rather than the Gentoo
> percolated product. That's what I do with my kernel patches, partly
> for similar reasons as what you are dealing with.

Not everyone has the time to play with source tarballs and development
utilities. That's why people use Linux distributions, instead of LFS-like
approach.

--
Andrej "Ticho" Kacian <ticho at gentoo dot org>
Gentoo Linux Developer - net-mail, antivirus, amd64

On Wed, 14 Sep 2005 03:22:43 +0200
Volker Armin Hemmann <volker.armin.hemmann@tu-clausthal.de> wrote:

> If you put gentoo onto such a box, it is your very own problem. If you want
> total stability and a lot of testing prior a patch goes out, maybe you
> should spent the bucks and buy SLES or RHEL
> If something breaks with them, you have a right to whine.

That doesn't mean you should sit quietly and smile when you get hit by a bug
in a free distro.

--
Andrej "Ticho" Kacian <ticho at gentoo dot org>
Gentoo Linux Developer - net-mail, antivirus, amd64

Then perhaps Gentoo isn't the distro for you.. I chose Gentoo because it
is sort of LFS-like, but with a fraction of the time to setup. Maybe a
binary-based distribution like RedHat or Debian would fit you better. ;)

On Wed, 2005-09-14 at 11:37 +0200, Andrej Kacian wrote:
> Not everyone has the time to play with source tarballs and development
> utilities. That's why people use Linux distributions, instead of LFS-like
> approach.


--
gentoo-security@gentoo.org mailing list

On Wed, 14 Sep 2005 08:05:39 -0400
xyon <xyon@indigorobot.com> wrote:

> Then perhaps Gentoo isn't the distro for you.. I chose Gentoo because it
> is sort of LFS-like, but with a fraction of the time to setup. Maybe a
> binary-based distribution like RedHat or Debian would fit you better. ;)

The fraction-of-time-to-setup feature comes from the fact that portage
(package manager) does most of the work for you - and that was exactly my
point - emerging xorg-x11 is much less time-consuming than downloading,
patching and compiling it manually, which is not something everyone can afford
to invest time into.

Note that I politely ignore your binary-distro argument.

--
Andrej "Ticho" Kacian <ticho at gentoo dot org>
Gentoo Linux Developer - net-mail, antivirus, amd64

Andrej Kacian wrote:

>On Wed, 14 Sep 2005 08:05:39 -0400
>xyon <xyon@indigorobot.com> wrote:
>
>
>
>>Then perhaps Gentoo isn't the distro for you.. I chose Gentoo because it
>>is sort of LFS-like, but with a fraction of the time to setup. Maybe a
>>binary-based distribution like RedHat or Debian would fit you better. ;)
>>
>>
>
>The fraction-of-time-to-setup feature comes from the fact that portage
>(package manager) does most of the work for you - and that was exactly my
>point - emerging xorg-x11 is much less time-consuming than downloading,
>patching and compiling it manually, which is not something everyone can afford
>to invest time into.
>
>Note that I politely ignore your binary-distro argument.
>
>
>
I have to agree with the portage point. In fact, I think the three
reasons Gentoo is where it's at is because of the following:

1. They have the best documentation out of any distribution. Just
think about the first time you installed it. How easy was it because of
the documentation, and how much did you learn?

2. It's ports based. I remember the days of rpmfind when I used
RedHat. That was a nightmare. Portage is pretty much up-to-date, bug
free (the programs being installed, that is), and easy to use if you
take the small amount of time to learn the commands. Again, this ties
into the great documentation.

3. The user forums. The forums are what I like most about Gentoo. It's
has the best community of users and developers of any distro. It's easy
find an answer, ask a question, and get a reasonable response! Without
it, I think that most people would have thrown up their hands in
frustration.





--
gentoo-security@gentoo.org mailing list

On Wednesday 14 September 2005 11:39, Andrej Kacian wrote:
> On Wed, 14 Sep 2005 03:22:43 +0200
>
> Volker Armin Hemmann <volker.armin.hemmann@tu-clausthal.de> wrote:
> > If you put gentoo onto such a box, it is your very own problem. If you
> > want total stability and a lot of testing prior a patch goes out, maybe
> > you should spent the bucks and buy SLES or RHEL
> > If something breaks with them, you have a right to whine.
>
> That doesn't mean you should sit quietly and smile when you get hit by a
> bug in a free distro.

no, but you should also not start demanding things and blame others.

If you put gentoo onto a production box, you should be very sure that you are
able to solve your problems.
--
gentoo-security@gentoo.org mailing list

On Wed, Sep 14, 2005 at 06:24:25PM +0200, Volker Armin Hemmann wrote:
> On Wednesday 14 September 2005 11:39, Andrej Kacian wrote:
> > On Wed, 14 Sep 2005 03:22:43 +0200
> >
> > Volker Armin Hemmann <volker.armin.hemmann@tu-clausthal.de> wrote:
> > > If you put gentoo onto such a box, it is your very own problem. If you
> > > want total stability and a lot of testing prior a patch goes out, maybe
> > > you should spent the bucks and buy SLES or RHEL
> > > If something breaks with them, you have a right to whine.
> >
> > That doesn't mean you should sit quietly and smile when you get hit by a
> > bug in a free distro.
>
> no, but you should also not start demanding things and blame others.
>
> If you put gentoo onto a production box, you should be very sure that you are
> able to solve your problems.

How is this related to security?
~harring

On Wednesday 14 September 2005 18:30, Brian Harring wrote:
> On Wed, Sep 14, 2005 at 06:24:25PM +0200, Volker Armin Hemmann wrote:
> > On Wednesday 14 September 2005 11:39, Andrej Kacian wrote:
> > > On Wed, 14 Sep 2005 03:22:43 +0200
> > >
> > > Volker Armin Hemmann <volker.armin.hemmann@tu-clausthal.de> wrote:
> > > > If you put gentoo onto such a box, it is your very own problem. If
> > > > you want total stability and a lot of testing prior a patch goes out,
> > > > maybe you should spent the bucks and buy SLES or RHEL
> > > > If something breaks with them, you have a right to whine.
> > >
> > > That doesn't mean you should sit quietly and smile when you get hit by
> > > a bug in a free distro.
> >
> > no, but you should also not start demanding things and blame others.
> >
> > If you put gentoo onto a production box, you should be very sure that you
> > are able to solve your problems.
>
> How is this related to security?
> ~harring

how is this whole thread related to security?
--
gentoo-security@gentoo.org mailing list

Security caused the only working version of xorg to be removed from
portage. Hence a large part of the user base has not got a usable X.
It has gotten off topic from my original question tough, and it seems
some egos here are a - touch - sensitive about it :)

BillK


On Wed, 2005-09-14 at 21:04 +0200, Volker Armin Hemmann wrote:
...
> > How is this related to security?
> > ~harring
>
> how is this whole thread related to security?
--
William Kenworthy <billk@iinet.net.au>
Home!
--
gentoo-security@gentoo.org mailing list

On 9/14/05, William Kenworthy <billk@iinet.net.au> wrote:
> Security caused the only working version of xorg to be removed from
> portage.

My xorg-x11 install is working just fine. Using -r3 here, and I'm not
having any problems with it. xorg-x11 may be broken for some users,
but for many of us, it works perfectly.

Mike

--
gentoo-security@gentoo.org mailing list

Its broken for those who use openoffice and numerous other applications
that use the transparency option. In OO, most of the icons have a black
background, and some slides in the presentation client are also affected
for me. As I use my gentoo laptop to give presentations its a show
stopper. (When I first loaded it up, it looked OK, but then when I
loaded the presentation in public it became "what OS is that - god its
ugly ..., why dont you use ..." - nothing like a public fiasco to drive
home gentoo's shortcomings :( )

Ive fixed it for my self (as Ive previously described), but what about
the new or average user which is why I originally brought it up? My
needs are covered, its "gentoo" itself that I think is being
shortchanged.

In any case, this is getting even further off-topic for the security
list. Check the bug.

BillK

On Thu, 2005-09-15 at 14:21 -0700, Mike Owen wrote:
> On 9/14/05, William Kenworthy <billk@iinet.net.au> wrote:
> > Security caused the only working version of xorg to be removed from
> > portage.
>
> My xorg-x11 install is working just fine. Using -r3 here, and I'm not
> having any problems with it. xorg-x11 may be broken for some users,
> but for many of us, it works perfectly.
>
> Mike
>
--
gentoo-security@gentoo.org mailing list