CentOS docs - Jan 2015 - Pull Request wiki.c.o/AdditionalResources/Repositories

On Wed, Jan 14, 2015 at 3:26 PM, John R. Dennison <jrd at gerdesas.com>
wrote:
> On Wed, Jan 14, 2015 at 03:09:01PM -0800, PatrickD Garvey wrote:
>>
>> Proposal:
>> The Third Party Repositories section should not list any other
repositories,
>> but should only note there are difficulties in making several
independent
>> repositories safely usable and give a thorough explaination of what has
happened
>> in the past without naming names.
>
> You are looking for problems to fix where there are none.  The overall
state of
> that page is and has been fine for many years.  EL requires external third-
> party repos.  It has always been this way and it will always continue to
> be the case.  Your proposal to remove the listings that are there now
> serves no one and will only create more of a support burden on the
> people that are volunteering their time.
>
>                                                         John
I view your comments as an opportunity to understand an experience I
have yet to have. Please share which repository you use and how it
depends upon CentOS and how the CentOS community depends upon it.

I view the entire FLOSS community as interdependent. I hope to make
this page an asset for that interdependence. That's why I worked on
the link rot.

Karanbir seems to feel that certain phrases in the page unduly favor
some of the repositories and that requires an objective evaluation.

Please help us (me, especially) understand what we may be doing to the
detriment of your use of CentOS and thereby avoid that negative
result.

On 14/01/15 23:38, PatrickD Garvey wrote:
> On Wed, Jan 14, 2015 at 3:26 PM, John R. Dennison <jrd at
gerdesas.com> wrote:
>> On Wed, Jan 14, 2015 at 03:09:01PM -0800, PatrickD Garvey wrote:
>>> Proposal:
>>> The Third Party Repositories section should not list any other
repositories,
>>> but should only note there are difficulties in making several
independent
>>> repositories safely usable and give a thorough explaination of what
has happened
>>> in the past without naming names.
>> You are looking for problems to fix where there are none.  The overall
state of
>> that page is and has been fine for many years.  EL requires external
third-
>> party repos.  It has always been this way and it will always continue
to
>> be the case.  Your proposal to remove the listings that are there now
>> serves no one and will only create more of a support burden on the
>> people that are volunteering their time.
>>
>>                                                         John
> I view your comments as an opportunity to understand an experience I
> have yet to have. Please share which repository you use and how it
> depends upon CentOS and how the CentOS community depends upon it.
>
> I view the entire FLOSS community as interdependent. I hope to make
> this page an asset for that interdependence. That's why I worked on
> the link rot.
>
> Karanbir seems to feel that certain phrases in the page unduly favor
> some of the repositories and that requires an objective evaluation.
>
> Please help us (me, especially) understand what we may be doing to the
> detriment of your use of CentOS and thereby avoid that negative
> result.
That page is balance between coming right out and saying "This, that and
the other repo eat babies and destroy systems, do not use them" without
actually coming right out and saying that. There are repos that Do the
Right Thing (tm) and do not blindly overwrite core packages from the
CentOS repos. There are others that do. Some of the repos that overwrite
core packages do so with little packages like sqlite (yum uses sqlite so
changing the version of it is not a Good Thing for system stabilty).
Other repos in that list have been effectively unmaintained for a number
of years so they contain packages that may have severe unfixed security
vulnerabilities.

Now as far as the term "Community Approved" goes: I think it's
fairly
accurate and I'm not sure what the objection to it was. We have to have
a way to say "These repos are ok" and "these suck" and
"these suck worse
than that". The way the page reads at the moment seems to me to strike a
good balance between providing useful information and avoiding libel!

Trevor

On Wed, Jan 14, 2015 at 3:51 PM, Trevor Hemsley
<trevor.hemsley at ntlworld.com> wrote:
> On 14/01/15 23:38, PatrickD Garvey wrote:
>> On Wed, Jan 14, 2015 at 3:26 PM, John R. Dennison <jrd at
gerdesas.com> wrote:
>>> On Wed, Jan 14, 2015 at 03:09:01PM -0800, PatrickD Garvey wrote:
>>>> Proposal:
>>>> The Third Party Repositories section should not list any other
repositories,
>>>> but should only note there are difficulties in making several
independent
>>>> repositories safely usable and give a thorough explaination of
what has happened
>>>> in the past without naming names.
>>> You are looking for problems to fix where there are none.  The
overall state of
>>> that page is and has been fine for many years.  EL requires
external third-
>>> party repos.  It has always been this way and it will always
continue to
>>> be the case.  Your proposal to remove the listings that are there
now
>>> serves no one and will only create more of a support burden on the
>>> people that are volunteering their time.
>>>
>>>                                                         John
>> I view your comments as an opportunity to understand an experience I
>> have yet to have. Please share which repository you use and how it
>> depends upon CentOS and how the CentOS community depends upon it.
>>
>> I view the entire FLOSS community as interdependent. I hope to make
>> this page an asset for that interdependence. That's why I worked on
>> the link rot.
>>
>> Karanbir seems to feel that certain phrases in the page unduly favor
>> some of the repositories and that requires an objective evaluation.
>>
>> Please help us (me, especially) understand what we may be doing to the
>> detriment of your use of CentOS and thereby avoid that negative
>> result.
>
> That page is balance between coming right out and saying "This, that
and
> the other repo eat babies and destroy systems, do not use them"
without
> actually coming right out and saying that. There are repos that Do the
> Right Thing (tm) and do not blindly overwrite core packages from the
> CentOS repos. There are others that do. Some of the repos that overwrite
> core packages do so with little packages like sqlite (yum uses sqlite so
> changing the version of it is not a Good Thing for system stabilty).
> Other repos in that list have been effectively unmaintained for a number
> of years so they contain packages that may have severe unfixed security
> vulnerabilities.
>
> Now as far as the term "Community Approved" goes: I think
it's fairly
> accurate and I'm not sure what the objection to it was. We have to have
> a way to say "These repos are ok" and "these suck" and
"these suck worse
> than that". The way the page reads at the moment seems to me to strike
a
> good balance between providing useful information and avoiding libel!
>
> Trevor
Thank you.

My understanding is the term "Community Approved" was a summation of
opinions,
not an objectively measurable attribute and Karanbir wanted something
more objective.

I was trying to get us out of continually evaluating other repositories. How do
you choose which to add to the lists on the page? How do you even know
what exists
that may need to be added to the page? As it stands the list is a result of
experiences with several repositories. OK. Do we wait for an adverse experience
before we add another? Or do we give a good understanding how one evaluates a
repository and leave it up to the individual to make that evaluation and live
with the consequence?

In my experience with large corporations trying to work this out, it
was considered
best practice to support the positive and ignore the negative.
Customers are responsible
for their own choices. Positive guidance on how to select a good
solution can leverage
the qualities of your own product and not incur liabilities for
contestable, even if
legitimate, criticisms of particular alternatives. Saying "these suck"
and "these suck
worse" makes one liable for that opinion, even if one has an objective
technique for
that evaluation.

CentOS has some ways to bless the work of others, SIGs and spins. Join
us and we won't
just praise your work, we'll help it evolve.

Again, I'm looking for an understanding of your experience. This is
what I have learned to
this point. Let's move forward, even if that means leaving the article
as it is now.

On 14/01/15 23:38, PatrickD Garvey wrote:
> Please help us (me, especially) understand what we may be doing to the
> detriment of your use of CentOS and thereby avoid that negative
> result.
Lets flip this around - just going by your comments in the last few
days, it seems to me that you dont actually use CentOS Linux at all and
are largely unaware of how this ecosystem works.

so, from your point of view, as a user - what is it that you use CentOS
and what sort of roles do you deploy it in ?

-- 
Karanbir Singh
+44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh
GnuPG Key : http://www.karan.org/publickey.asc

On 14/01/15 23:51, Trevor Hemsley wrote:
> Now as far as the term "Community Approved" goes: I think
it's fairly
> accurate and I'm not sure what the objection to it was. We have to have
> a way to say "These repos are ok" and "these suck" and
"these suck worse
> than that". The way the page reads at the moment seems to me to strike
a
> good balance between providing useful information and avoiding libel!
> 
Being able to quantify what good-behaviour might be ( eg. multilib lines
up etc ) not only allows us to measure how good / bad a repo is, it also
gives the other repos a yardstick to work through in order to become good.

I realise that a good repo will do things that are hard to measure  eg.
delta between upstream release of a patch and when it shows up in repo;
but a large bulk of things we should be able to automate I feel.

-- 
Karanbir Singh
+44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh
GnuPG Key : http://www.karan.org/publickey.asc

On Wed, Jan 14, 2015 at 4:31 PM, Karanbir Singh <mail-lists at karan.org>
wrote:
> On 14/01/15 23:38, PatrickD Garvey wrote:
>
>> Please help us (me, especially) understand what we may be doing to the
>> detriment of your use of CentOS and thereby avoid that negative
>> result.
>
> Lets flip this around - just going by your comments in the last few
> days, it seems to me that you dont actually use CentOS Linux at all and
> are largely unaware of how this ecosystem works.
>
> so, from your point of view, as a user - what is it that you use CentOS
> and what sort of roles do you deploy it in ?
I am a retired programmer/system administrator. The last systems I
maintained were IBM System/6000 running AIX and CATIA, a 3D
computer-aided design package.

I want to use CentOS to explore the aspects of operating systems that
I was not allowed to explore with a proprietary system. I had a couple
of 32-bit machines I intended to make into my lab, but the Linux
community seems to have moved on to 64-bit images.

So, while I acquire a new set of machines, I'm reading and trying to
improve the documentation surrounding a particular distribution of
Linux, CentOS.

Any opinions I express are based on my 27 years in large corporations
that used computers developed and sold by other companies, which
includes 20 years ordering, receiving, installing, configuring, and running
IBM equipment for large corporations.

> CentOS repos. There are others that do. Some of the repos that overwrite
> core packages do so with little packages like sqlite (yum uses sqlite so
> changing the version of it is not a Good Thing for system stabilty).
> Other repos in that list have been effectively unmaintained for a number
> of years so they contain packages that may have severe unfixed security
> vulnerabilities.
I suggest that we shouldn't use euphemisms when it's far more valuable
to come out and say it.  I would certainly appreciate if the centos docs
explicitly tagged the other repos with these comments.  Factual commentary
about risks does not come anywhere close to libel...

regards, mark hahn.