Fedora firestorm and thoughts

[Ryan Rix]

Dazed_75 wrote:
> There seems to be a firestorm going on with regard to a change in the
> newly released Fedora 12.
> 
> http://linux.slashdot.org/story/09/11/18/2039229/Fedora-12-Lets-Users-
Install-Signed-Packages-Sans-Root-Privileges?art_pos=1
> https://bugzilla.redhat.com/show_bug.cgi?id=534047
> 
> How much this has blown up from being "slashdotted" is not an issue IMHO.
> And I agree that it was a horrible decision to make that change be the
> default.  I do hope they revert it.  My belief is that if they wanted such
> a change it is important enough they should have retained the old behavior
> and made an option to implement the new only by someone having root
> privileges and proving it.
> 
> But the real reason for this post is that I have noticed what might be a
> trend in recent releases.  It feels like a trend to me and I find that
> bothersome.  The trend I am talking about is for new releases to change
> defaults and content in ways that so many reviews and tips are focussed on
> how to revert the "improvements" to the prior art.
> 
> For example, there are many positive reviews for Karmic Koala (ubuntu
> 9.10)
> along with the usual problem reports.  But it seems that many of the
> problem solutions and tips being published are how to "fix" Karmic back to
> the way
> ubuntu used to work.  Now this thing with Fedora 12.  I get concerned when
> it seems like we risk our advantages of better security and stability. 
> I'm all for ease of use and innovation but I wonder if some changes are
> going too far and too fast.
> 
> I have also noted that many changes are made to make things easier for new
> users (a good thing) but along the Microsoft model of assuming users must
> be
> stupid ... errr .... don't need/want to know.  Is that bothering anyone
> else?
> 

This was never a decision discussed by the Fedora project as a whole. It was 
never a decision that anyone besides Richard Hughes chose to implement[1], 
and refused to revert when all this exploded.

This is not a security issue, or an issue of Fedora dumbing itself down for 
its users. It's a matter of communication, or lack thereof:

1) This should have been discussed beforehand, either in a Fedora Release 
Engineering meeting, or in the fedora-devel mailing list.
2) if it was chosen to be implemented by default it should have been in the 
release notes along with explicit details on how to disable this.

Neither of these things happened, and we (Fedora's developers and 
contributors) are already working to revert this and make sure things like 
this don't happen in the future.

[1] Hughes felt that PackageKit was something to be used by Desktop systems 
only not server/multiuser systems, and 99% of desktop systems run only one 
or two users, all trusted with root access already. It was a convenience 
addition for Desktop users. 
Also, this policy was only enabled for LOCAL users running on a LOCAL 
terminal installing packages from the trusted Fedora repos. If you look at 
it this way, you have physical access to the box, you basically own it 
already.

-- 
Ryan Rix
Fedora KDE SIG Member, Phoenix AZ Ambassador, News KDE Beat Writer

Please refrain from mailing me directly in replies, I am subsribing 
via GMane NNTP. Thank you.

http://hackersramblings.wordpress.com | http://identi.ca/phrkonaleash
XMPP: phrkonaleash at gmail.com          | MSN: phrkonaleash at yahoo.com
AIM:  phrkonaleash                    | Yahoo: phrkonaleash
IRC:  PhrkOnLsh at irc.freenode.net/#srcedit,#plugaz,#fedora-kde and
      countless other FOSS channels.