- Dillo-dev - lists.mailman3.com

dillo-2.1.tar.bz2

by jcid＠dillo.org

On Thu, Jun 18, 2009 at 10:29:06PM -0400, Jorge Arellano Cid wrote: > [...] > WARNING: Please don't make the packages yet, I've got a last minute > security vulnerability email, so maybe the tarball will change > once more (the last). I'll try to have this solved tomorrow in the > morning. OK, the last tarball was just uploaded (rc3) and it will be announced tomorrow in the morning. It has a patch for malformed PNG images. Please make the respective packages and let me know when ready to link them from the downloads page. Here we go! -- Cheers Jorge.-

June 19, 2009

dillo-2.1.tar.bz2

by newman.x＠gmail.com

On Fri, Jun 19, 2009 at 4:29 AM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: > On Thu, Jun 18, 2009 at 11:20:51PM +0200, Michal Nowak wrote: >> On Thu, Jun 18, 2009 at 9:56 PM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: >> > Hi, >> > >> > ?Working on >> > >> > ? ?2.- To enable-ssl or not enable-ssl (define what to do). >> > >> > >> > On Thu, Jun 18, 2009 at 10:36:39AM +0200, Michal Nowak wrote: >> >> [...] >> >> Generally speaking for Fedora, we won't turn on options which are not >> >> turned on by default in upstream - it usually brings divergence from >> >> upstream and comments in upstream mailing lists (not this one :) ) >> >> like: "That poor distroX turned on --enable-coolness so we are not >> >> supporting users of this distro at all." >> >> >> >> Turning on SSL in upstream means more pressure for fixing it, usually >> >> :). But I am reading dillo-dev long enough to know it's not that easy. >> >> [snip] >> >> > >> > ?Obviously the safe option is not to offer ssl-enabled packages, >> > but that will mainly have the effect of no https-dpi at all. >> > >> > ?I'm not quite sure which one would be best. >> > ?Comments? >> >> http://mnowak.fedorapeople.org/dillo2/static/ > > ?Good! > >> Looks like Kelson's having some problems with building, so I >> patched-rebuilt-installed Kelson's static FLTK2 SRPM and rebuilt >> Dillo2. Now there are present i586 pkgs for F-11, both SSL on/off, > > ?BTW, is there a special instruction to install them on RPM > systems? I mean something like adding a line to /etc/apt/sources.list > in Debian. > > >> tomorrow I can build x86-64 pkgs for F-11 at work. And i386 >> packs for F-10 (hopefully there's still the F-10 beast in KVM). > > > ?WARNING: Please don't make the packages yet, I've got a last minute > security vulnerability email, so maybe the tarball will change > once more (the last). I'll try to have this solved tomorrow in the > morning. > > >> (But treat them as third party ones, don't trust them :). ) > > ?What do you mean? The point was that the packages are not signed, nor verified by independent authority [1]: just wanna to ask you *not* have the packages in the dillo.org web page directly but only as a separate link to third party directory/repository. -- [1] Just created by me with the best effort. > > -- > ?Cheers > ?Jorge.- > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)dillo.org > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev >

June 19, 2009

dillo-2.1.tar.bz2

by newman.x＠gmail.com

On Fri, Jun 19, 2009 at 4:43 AM, Kelson Vibber<kelson(a)pobox.com> wrote: > On Jun 18, 2009, at 7:23 PM, Jorge Arellano Cid wrote: >> >> I'd prefer to have both and to offer as an option from the >> download page (as with Fedora). > > So just to confirm, two dillo packages per OS version / architecture > combination, one compiled with SSL, one compiled without? > >> ?WARNING: Please don't make the packages yet, I've got a last minute >> security vulnerability email, so maybe the tarball will change >> once more (the last). I'll try to have this solved tomorrow in the >> morning. > > Okay, I'll wait until tomorrow before building anything else. > > The good news is I finally got Fedora 10 i686 running from a USB key, and > was able to build the current package! > > So tomorrow I'll be able to build: > Fedora 10 i686 and x86_64 > RHEL 3 i386 > RHEL 4 x86_64 > RHEL 5 i686 and x86_64 Just a comment: I'll be out for the whole weekend, if there's demand for Fedora 11 packages I'll create them Sunday evening or Monday morning. > > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)dillo.org > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev >

June 19, 2009

dillo-2.1.tar.bz2

by newman.x＠gmail.com

On Fri, Jun 19, 2009 at 4:55 AM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: > On Thu, Jun 18, 2009 at 07:43:15PM -0700, Kelson Vibber wrote: >> On Jun 18, 2009, at 7:23 PM, Jorge Arellano Cid wrote: >>> I'd prefer to have both and to offer as an option from the >>> download page (as with Fedora). >> >> So just to confirm, two dillo packages per OS version / architecture >> combination, one compiled with SSL, one compiled without? > > ?That's the idea. Starting with the most used ones. > > >>> ?WARNING: Please don't make the packages yet, I've got a last minute >>> security vulnerability email, so maybe the tarball will change >>> once more (the last). I'll try to have this solved tomorrow in the >>> morning. >> >> Okay, I'll wait until tomorrow before building anything else. >> >> The good news is I finally got Fedora 10 i686 running from a USB key, >> and was able to build the current package! >> >> So tomorrow I'll be able to build: >> Fedora 10 i686 and x86_64 >> RHEL 3 i386 >> RHEL 4 x86_64 >> RHEL 5 i686 and x86_64 > > ?BTW, which is the easier way to install an rpm? > Just download and "rpm -ivh <PKG>" or is there a ppa-like thing? > It's not that hard to create a repository with RPM packages but as I said it's generally bad thing to encourage users to use this as "repository", they would expect the same service like from general distribution distro (e.g. security fixes), which we don't wanna provide - because we believe Dillo2 in official distribution is The way. The `rpm -ivh <pkg>` is easy enough, I believe. > -- > ?Cheers > ?Jorge.- > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)dillo.org > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev >

June 19, 2009

dillo-2.1.tar.bz2

by jcid＠dillo.org

On Thu, Jun 18, 2009 at 07:43:15PM -0700, Kelson Vibber wrote: > On Jun 18, 2009, at 7:23 PM, Jorge Arellano Cid wrote: >> I'd prefer to have both and to offer as an option from the >> download page (as with Fedora). > > So just to confirm, two dillo packages per OS version / architecture > combination, one compiled with SSL, one compiled without? That's the idea. Starting with the most used ones. >> WARNING: Please don't make the packages yet, I've got a last minute >> security vulnerability email, so maybe the tarball will change >> once more (the last). I'll try to have this solved tomorrow in the >> morning. > > Okay, I'll wait until tomorrow before building anything else. > > The good news is I finally got Fedora 10 i686 running from a USB key, > and was able to build the current package! > > So tomorrow I'll be able to build: > Fedora 10 i686 and x86_64 > RHEL 3 i386 > RHEL 4 x86_64 > RHEL 5 i686 and x86_64 BTW, which is the easier way to install an rpm? Just download and "rpm -ivh <PKG>" or is there a ppa-like thing? -- Cheers Jorge.-

June 19, 2009

dillo-2.1.tar.bz2

by kelson＠pobox.com

On Jun 18, 2009, at 7:23 PM, Jorge Arellano Cid wrote: > I'd prefer to have both and to offer as an option from the > download page (as with Fedora). So just to confirm, two dillo packages per OS version / architecture combination, one compiled with SSL, one compiled without? > WARNING: Please don't make the packages yet, I've got a last minute > security vulnerability email, so maybe the tarball will change > once more (the last). I'll try to have this solved tomorrow in the > morning. Okay, I'll wait until tomorrow before building anything else. The good news is I finally got Fedora 10 i686 running from a USB key, and was able to build the current package! So tomorrow I'll be able to build: Fedora 10 i686 and x86_64 RHEL 3 i386 RHEL 4 x86_64 RHEL 5 i686 and x86_64

June 19, 2009

dillo-2.1.tar.bz2

by jcid＠dillo.org

On Thu, Jun 18, 2009 at 11:20:51PM +0200, Michal Nowak wrote: > On Thu, Jun 18, 2009 at 9:56 PM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: > > Hi, > > > > ?Working on > > > > ? ?2.- To enable-ssl or not enable-ssl (define what to do). > > > > > > On Thu, Jun 18, 2009 at 10:36:39AM +0200, Michal Nowak wrote: > >> [...] > >> Generally speaking for Fedora, we won't turn on options which are not > >> turned on by default in upstream - it usually brings divergence from > >> upstream and comments in upstream mailing lists (not this one :) ) > >> like: "That poor distroX turned on --enable-coolness so we are not > >> supporting users of this distro at all." > >> > >> Turning on SSL in upstream means more pressure for fixing it, usually > >> :). But I am reading dillo-dev long enough to know it's not that easy. > > [snip] > > > > > ?Obviously the safe option is not to offer ssl-enabled packages, > > but that will mainly have the effect of no https-dpi at all. > > > > ?I'm not quite sure which one would be best. > > ?Comments? > > http://mnowak.fedorapeople.org/dillo2/static/ Good! > Looks like Kelson's having some problems with building, so I > patched-rebuilt-installed Kelson's static FLTK2 SRPM and rebuilt > Dillo2. Now there are present i586 pkgs for F-11, both SSL on/off, BTW, is there a special instruction to install them on RPM systems? I mean something like adding a line to /etc/apt/sources.list in Debian. > tomorrow I can build x86-64 pkgs for F-11 at work. And i386 > packs for F-10 (hopefully there's still the F-10 beast in KVM). WARNING: Please don't make the packages yet, I've got a last minute security vulnerability email, so maybe the tarball will change once more (the last). I'll try to have this solved tomorrow in the morning. > (But treat them as third party ones, don't trust them :). ) What do you mean? -- Cheers Jorge.-

June 19, 2009

dillo-2.1.tar.bz2

by jcid＠dillo.org

On Thu, Jun 18, 2009 at 11:12:12PM +0200, Devid Antonio Filoni wrote: > In Debian, the package in the repo is built with ssl enabled, I prefer > to have the new package with ssl too. Is possible to just show a > warning opening dillo? Yes it is. You can add a warning in the splash page with HTML. Just try making some changes in IO/about.c See the attached page as an example. I'd prefer to have both and to offer as an option from the download page (as with Fedora). WARNING: Please don't make the packages yet, I've got a last minute security vulnerability email, so maybe the tarball will change once more (the last). I'll try to have this solved tomorrow in the morning. -- Cheers Jorge.-

June 19, 2009

dillo-2.1.tar.bz2

by newman.x＠gmail.com

On Thu, Jun 18, 2009 at 9:56 PM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: > Hi, > > ?Working on > > ? ?2.- To enable-ssl or not enable-ssl (define what to do). > > > On Thu, Jun 18, 2009 at 10:36:39AM +0200, Michal Nowak wrote: >> [...] >> Generally speaking for Fedora, we won't turn on options which are not >> turned on by default in upstream - it usually brings divergence from >> upstream and comments in upstream mailing lists (not this one :) ) >> like: "That poor distroX turned on --enable-coolness so we are not >> supporting users of this distro at all." >> >> Turning on SSL in upstream means more pressure for fixing it, usually >> :). But I am reading dillo-dev long enough to know it's not that easy. [snip] > > ?Obviously the safe option is not to offer ssl-enabled packages, > but that will mainly have the effect of no https-dpi at all. > > ?I'm not quite sure which one would be best. > ?Comments? http://mnowak.fedorapeople.org/dillo2/static/ Looks like Kelson's having some problems with building, so I patched-rebuilt-installed Kelson's static FLTK2 SRPM and rebuilt Dillo2. Now there are present i586 pkgs for F-11, both SSL on/off, tomorrow I can build x86-64 pkgs for F-11 at work. And i386 packs for F-10 (hopefully there's still the F-10 beast in KVM). (But treat them as third party ones, don't trust them :). ) > > > -- > ?Cheers > ?Jorge.- > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)dillo.org > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev >

June 18, 2009

dillo-2.1.tar.bz2

by devidfil＠gmail.com

In Debian, the package in the repo is built with ssl enabled, I prefer to have the new package with ssl too. Is possible to just show a warning opening dillo? Devid On 6/18/09, Jorge Arellano Cid <jcid(a)dillo.org> wrote: > Hi, > > Working on > > 2.- To enable-ssl or not enable-ssl (define what to do). > > > On Thu, Jun 18, 2009 at 10:36:39AM +0200, Michal Nowak wrote: >> [...] >> Generally speaking for Fedora, we won't turn on options which are not >> turned on by default in upstream - it usually brings divergence from >> upstream and comments in upstream mailing lists (not this one :) ) >> like: "That poor distroX turned on --enable-coolness so we are not >> supporting users of this distro at all." >> >> Turning on SSL in upstream means more pressure for fixing it, usually >> :). But I am reading dillo-dev long enough to know it's not that easy. > > Reading forums served on https is handy, so I understand if a > user wants to have it enabled. > > Considering that making a user compile dillo is currently a > complex operation (the apparently simple --enable-ssl switch is > complex because of FLTK2 installation issues), I'd try to provide > the packaged option as an alternative to the main package (not > SSL-enabled). > > Something like: > > --------------------------------------------------------------- > Debian: > > Jaunty, Karmic (click here) > > Fedora: > > F11, F12 (click here) > > --------------------------------------------------------------- > With alpha HTTPS support: > * Note that this is NOT checking certificates, may get stuck > in asking dialogs, but will let you read https forums. > > USE AT YOUR OWN RISK > > Debian: > > Jaunty, Karmic (click here) > > Fedora: > > F11, F12 (click here) > --------------------------------------------------------------- > > > > Obviously the safe option is not to offer ssl-enabled packages, > but that will mainly have the effect of no https-dpi at all. > > I'm not quite sure which one would be best. > Comments? > > > -- > Cheers > Jorge.- > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)dillo.org > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev >

June 18, 2009