Re: Arch Linux public upload server
I sent this message yesterday but I accidentally forgot to add the mailing list as a recipient. -------- Original Message -------- Subject: Re: Arch Linux public upload server Date: 2024-09-04 14:28 From: "Rein Fernhout (Levitating)" <me@levitati.ng> To: Robin Candau <antiz@archlinux.org> On 2024-09-04 09:56, Robin Candau wrote:
On 9/4/24 1:04 AM, Polarian wrote:
Hello,
Hello,
Hello,
So to spur such a discussion, why should it be rustypaste? What makes it better than the competition?
I think you're taking Orhun's mail/proposition the wrong way.
First of all, Arch Linux and rustypaste are not corporate so there's no "corporate buddies"/shareholders in that context. I personally have not been bothered by any potential "conflict of interest" in their suggestion.
Secondly, Orhun's demand is not "Should Arch Linux host a public pastebin/upload server (and, if so, could it be rustypaste)?" but "rustypaste is looking for a public instance [2], could Arch Linux host it?"
Here again, I feel like this an important nuance to understand why the discussion is specifically about rustypaste (and not about any other similar services).
[1] https://lists.archlinux.org/archives/list/arch-general@lists.archlinux.org/m... [2] https://github.com/orhun/rustypaste/issues/326
Though I do think that if we were to have a pasting service, I would like to use a battle-proven tool with proper moderation capabilities like 0x0. But in generally I think we just shouldn't start. The amount of abuse pasting services see is absolutely staggering. The only way I think we could manage is, like mentioned before, by protecting it with our SSO account authentication. But rustypaste doesn't rely on a frontend, it works similarly to 0x0. So what does it add to our community? The IRC already recommends use of 0x0 or termbin.com. Both of which rely on open source software that can be selfhosted by users with ease. I would maybe see added value if our pastebin service was graphical, as this would make it more accessible. Authenticated users could submit pastes and anyone could view them. But rustypaste isn't graphical. So I do a agree with Polarian that we should first consider "do we want a pasting service" and then "do we want rustypaste". Even if that was not Orhun's original question.
On Thu, 2024-09-05 at 17:42 +0200, Rein Fernhout (Levitating) wrote:
[snip] So I do a agree with Polarian that we should first consider "do we want a pasting service" [snip]
Hi, how often is a pasting service really required, when reporting an issue that might or might not be a packaging issue? Recently I reported a bug against the krita package. It has undoubtedly turned out to be an upstream issue. Fortunately, no pasting service was necessary upstream in this case either. If it had been necessary and I had to use a pasting service, would I have been able to provide a link to an Arch pasting service to upstream, or would I have had to make it available again via another pasting service? Often snippets are sufficient, so that a pasting service is not necessary. But if one should become necessary, it would be unfavourable in my opinion if you had to copy one and the same thing from one pasting service to another. Regards, Ralf
On Thu, 2024-09-05 at 18:21 +0200, Ralf Mardorf wrote:
Often snippets are sufficient, so that a pasting service is not necessary. But if one should become necessary, it would be unfavourable in my opinion if you had to copy one and the same thing from one pasting service to another.
PS: On Thu, 2024-09-05 at 16:02 +0000, Lucie Scarlet wrote:
having a TTL on everything
If it turns out, for example, that an issue has nothing to do with Arch, but with Upstream, then the validity up to a 404 would be irrelevant for Arch, but if you want to send a link to it to Upstream, then it might very well be important.
Hello, Apologies for the late response, I had stuff to do during the week, and this email has taken a considerable amount of my weekend to draft.
For now, no stance has been taken. A suggestion has been made and people are debating & exposing concerns (whether they are from staff or not). Sorry if I'm wrong, but it feels to me that you are trying to contest a decision that hasn't even been made yet, out of assumptions.
The fact that we use our @archlinux.org email address or not is irrelevant. Actually some people from the staff don't use their al.org email address at all. That doesn't indicate anything regarding the veracity or the "officialness" of our stance.
If any final decision is made or a stance should be taken as "official", this will be made clear.
There has been instances in the past on the mailing list where this has not been made clear, and conversations have continued despite a final "official" stance being taken. One notable example is the thread on an autobot [1], in which Anthraxx had to clarify that their and Jelle's response was, in fact, official. [2] So, could a staff member please clarify when it should be taken as an official response, and when it should be taken as an unofficial response.
What "personal gain/benefits" do you think Orhun will get from this?
The point was that conflicts of interests should be considered, not that Orhun would benefit, but I can give a few below: - Publicity, if its good enough for Arch Linux, its good enough for others, Arch Linux has a rather large user base which continues to grow, what better way to get your product out there than have Arch Linux adopt it publicly. - Hosting is provided by Arch Linux, ran by the Arch DevOps (no money/time needed for him to host it), and the server hosting costs are covered by Arch Linux.
And what restriction do you think will be "enforced" to you as a user if Orhun's solution is hosted by Arch?
I am unsure what you mean by this, therefore I can not comment, sorry.
You are describing the situation as if it will be profitable primarily to Orhun and will become super restrictive for you as a user.
Well it is, is it not? Orhun needs a public provider for rustypaste, usually this means paying for the server hosting himself and spending his own time (time == money) setting it up and maintaining it (security patches, updates etc). If Arch Linux accepts this proposal Orhun has saved himself hosting costs, therefore it is profitable.
If this is ever implemented, Arch will be offering a paste service which happens to be developed by Orhun, that's just it.
But it doesn't seem like Arch Linux needs a paste service, in fact 0x0 seems to fit the Arch Linux requirement, and is already hosted and moderated by others. No fuss needed.
You would still be able to use whatever paste service you prefer.
What benefit is there to hosting it then? People will still use whatever paste system they want, a small group of people will adopt the Arch Linux one, its just one more pastebin added to the pool of hundreds of others. Why not dedicate the devops resources somewhere more important?
There's no need to make the situation more complicated than it actually is.
Roughly translates to "Don't appose our suggestions, just say aye", not very democratic is it?
I'm aware you said you intend no offense (and I'm not doubting that) but, frankly, implying that Orhun acted with its personal interest in mind when proposing to offer an instance of his paste service to users under the Arch infra/domain is hypothetical and disrespectful.
If we all live in fear of bursting other peoples bubbles, nothing will ever be discussed. I tried, as respectfully as possible, to bring up my opinion. This, to the best of my knowledge, does not violate the code of conduct, I have not maliciously attacked Orhun, I have pointed out a concern. And to be blunt, how is it not personal interest, reading the Github issue it screams personal interest, heres how I see it: - Rustypaste lost their public provider - Rustypaste needs a new public provider - Public provider would require Orhun to pay for hosting and find time himself to maintain a public instance, and moderate it. - Orhun comes to the list with the suggestion Arch Linux runs a public instance for rustypaste. - (Hypothetically) Arch Linux accepts, rustypaste has the public provider which Orhun needed, and Orhun doesn't need to pay a penny or manage it himself, the Arch Devops team will. Correct me if I am wrong, but this can't just be a coincidence.
As you said, the debate here should be "is rustypaste a good fit for a potential paste service offered by Arch?" rather than whoever developed it or whatever hypothetical personal gain they will get from this.
You skipped the first point of whether Arch Linux needs a pastebin/upload service, and the consensus doesn't seem to be in favour of it, due to the security and moderation concerns.
This sentence was a one line sum up of an entire mail [1]. Of course, there's more to it. The given example in Orhun's mail as a comparaison is https://paste.ubuntu.com/, which is made for ubuntu users, requiring a login on Ubuntu's SSO to be used.
No it doesn't sum it up, in fact it reinforces my point even more. My original point was that Arch Linux potentially would not pick the best pastebin/upload solution as Orhun picked his own project by default without discussing other software which could be used. This would only give him the publicity of "Arch Linux adopted my project", which isn't a big deal if its a good project and fairly was agreed on, I can't comment on the former, but the latter was never discussed, and no alternatives were discussed. My new point is that Orhun actually financially benefits from this. They do not need to pay for their own hosting, and they do not need to dedicate the time to the sysadmin work which would be required to run a public provider. This is 100x worse than I realised, you could say I assumed good faith by assuming the suggestion was about an official pastebin for Arch Linux.
The infrastructure hosts a bunch of "external" services, whether they are used by staff or users (Wiki, Forum, GitLab, HedgeDoc, Mail server + Mailing List manager,...).
Let me address these one by one: - Wiki, Arch Linux only content (derivatives aren't allowed to document their stuff here either for example) - Forums, Arch Linux only yet again. - GitLab, Arch Linux projects. - HedgeDoc, for staff... used for Arch Linux stuff afaik. - Mail server, for staff again, and used for Arch Linux stuff, it wouldn't make sense for people to use their Arch Linux email address for non-official business, I haven't sign up to the Arch Linux mailing list with my University/Work email, have I?
First of all, it was never implied to give any fund to the rustypaste project.
That is like me making someone lunch every day and them saying there was no exchange of funds. I provided them a service free of charge, but that service is WORTH money. In the same way, if you are hosting rustypaste as a public provider for rustypaste, you are providing Orhun a service for his project to host it for him, that service is worth money, and thus Orhun would be benefiting financially.
Regardless, as a quick parenthesis, a donation is not a contract. You can't dictate how Arch will use your donation. You should only be assured that it will be used with the Arch project's interest in mind (which can imply funding a third party project, if it has any benefit to Arch). Again, this is a general statement, it isn't linked to the rustypaste subject we're currently discussing.
I am fully aware of this. But there is an expectation that if you donate to Arch Linux it is to benefit Arch Linux, does Arch Linux benefit from this? No.
Do you imply we should charge every developer of the services hosted on the Arch infra? Not sure why things should work differently for `rustypaste` than any other services we host and offer to staff and users.
If it is for their own projects then sure. Otherwise what stops a developer asking Arch Linux to host their personal email address on the Arch infrastructure? If it is for a project which benefits Arch Linux, then of course it should be funded by Arch Linux.
That's a legit and fair concern, which has been raised and discussed already.
Ack.
Again, I'm not sure what you are referring to as "fund it", but it was never implied to give any fund to the rustypaste project. Hosting an instance of a service and funding it is very different.
See above.
It was discussed to link such a rustypaste instance to our Arch SSO via OIDC and/or using the same mechanism as the forum where you would need to ask a pacman related question [2]. Here again, you're just making assumptions that it will only be profitable to rustypaste users whereas we are currently discussing how to implement such a solution in the Arch context in particular (thus targeting Arch users specifically).
There seems to be a clear miscommunication between what I am seeing on the Github issue, and what is being said on this list. One moment the Arch rustypaste instance is to become a public provider for the rustypaste project (which is literally what the issue is discussing). The next moment it is for Arch Linux only and requires SSO (which rustypaste does not yet support). Which is it? Seems to currently be in superposition.
Also, I'm still struggling to understand why it bothers you so much. As said above, there's no question of funding or conflict of interest in that context. So, as long as the service is beneficial/relevant to everyone, why do you care if it was developed by so-and-so?
In all honesty I can't say why it bothers me, only that it does. Maybe it is that it conflicts with what I see as morally wrong. Although I rarely post to Arch Linux anymore, and I am not around on IRC, I still read a large number of the emails which go to the mailing list. So I assure you, if I am spending the hours it takes to draft the emails to contest this, it has bothered me! I am struggling to articulate the feeling behind it but I will try anyways. It feels like Orhun has spent a ton of time developing their own pastebin, they have lost their public provider, they need a host and to outreach. They are a staff member at Arch Linux and saw an opportunity, if they can get Arch Linux to adopt a pastebin, he could slip his project in as the solution to be picked. Simply discussing it on list right now is giving it attention, people who have never heard of it are likely to check it out. In order for it to be fair other solutions MUST be discussed, that was my original point. I will repeat my disclaimer from the previous email, I have never spoken to Orhun, I have no bias against him. I have never used rustypaste, I do not know whether it is good or bad, and therefore completely unbiased towards it too. What I do know is that what was being discussed was a pastebin for Arch Linux, and the ONLY solution which has been suggested just happens to have been suggested by the developer of the solution, its hardly a coincidence.
Actually, if it is beneficial/relevant to everyone and it happens to be developed by one of the trusted member of the Arch staff, that's even better right?
What happens if there is a breakdown between Orhun and the Arch Staff, you picked a solution based on the fact it was developed by a trusted member but things broken down and you are left with a solution which you might of not originally have picked if you had discussed other solutions in the first place. Sure, its a nice benefit if it is the best solution out of the others available AND it benefits everyone in the community AND it is developed by a trusted member. But evaluating this boolean expression there is an issue, no other solution has been considered.
Again, as you said yourself, the debate here should be "is rustypaste a good fit for a potential paste service offered by Arch?" rather than whoever developed it (and whatever hypothetical personal gain they will get from this).
Sure, but Orhun should abstain from this decision, they can't have a say in the adoption of their own project because they are biased. If I was in the same position I would abstain too. Oh, and other solutions need to be discussed along with rustypaste.
I indeed did try to correct some misconception and redirect the questions away to refocus on the actual matter/debate. It wasn't done in bad faith though, sorry if you felt the contrary.
Apologies then for the accusation.
Don't get me wrong, I'm all for discussing such subjects publicly and transparently so that *everyone* can express their thoughts. Yet, I felt like those assumptions/misconceptions led to off-topic questioning (at least for the time being, as no decision has been taken yet) which I didn't felt was helpful regarding the current debate.
I do not feel anything here is offtopic. But obviously others disagree.
Thanks for expressing your thoughts (sincerely). I just shared mine, nothing more :)
Apologies for causing friction. Ralf:
Be that as it may, I did not take Polarian's comments as a personal insinuation against Orhun. As I understand it, it was just to point out that there is a possibility that things could look bad.
Yes this is what I was getting at, thank you :) Orhun:
Frankly, I find the topic of discussion brought up in the last 3-4 emails to be counterproductive and off-topic from what I intended to discuss in this thread.
Not in the slightest, I believe they are important considerations.
In my personal opinion, to move forward, we need to discuss the pros and cons of such a service and the best possible way to host it
In my personal opinion we need to decide on two things before that: 1. Does Arch Linux need a pastebin/upload server, the consensus seems like a no to me... so why proceed? 2. Is rustypaste the right solution? This hasn't even been discussed yet, and you are brushing over it and trying to move it onto (3) 3. How should rustypaste be hosted? So (1) has already had many concerns raised for, so you can't say its really been agreed on yet. Which means (2) and (3) are irrelevant until (1) has been decided.
I’d love to hear the reconsiderations of Anthraxx, Jelle, and Foxboron on this, based on my previous email. :)
Sounds like a good idea, provided it follows the 3 steps above :) As a sidenote I request Foxboron abstains from an opinion on what I have said if they intent to take the same stance as on IRC the last time we spoke. They should understand the reason I am requesting this (if not please offlist me).
I brought this up to Arch Linux because I think having such a service would be pretty cool. I’m also open to other suggestions — feel free to drop a comment on the issue: <https://github.com/orhun/rustypaste/issues/326> :)
This issue is about hosting a public instance for the rustypaste community. This solidifies my point made to Antiz. Oh some added evidence for my point is [3], Orhan has struggled with a public instance for a while it seems, no offence given I hope they find a viable solution to their problem, but using Arch to provide it is wrong. Please can you clarify, is this for the rustypaste community or for the Arch Linux community, as this issue suggests the former.
I feel like having something accessible with the terminal *and* accessible with a frontend would be a good solution.
Agreed. I do believe that this is something a lot of pastebins miss, you got pastebins like 0x0 which are great for the terminal, and then you got bpa.st and dpaste.org (and countless others) which are accessible from the web. I am yet to find a pastebin which does both, if someone does know of one please link them, thank you!
I've been bit more than once by a search turning up a mailing list or forum post discussing what's probably my problem only to find vital information missing my being elsewhere. Sometimes a mailing list post points to a long-dead forum. Other times, a pastebin has killed the content.
I never really understood why people use pastebin in email, there is no email limit apart from file size, which text is unlikely to ever exceed. Take OpenBSD for example, their bugs mailing list sends the logs within the email... it will always be accessible as long as the mailing list archive is preserved.
place the data alongside the prose, e.g. a (MIME) attachment. Let them live or die together.
IMO I find that attachments make things more annoying... keeping logs or configs within the main body of the email is the easiest way to read and comment on the issues. Maybe others disagree on this and hate a huge email to filter through, this is just my personal preference. I have many times requested that people who attach PKGBUILD's to emails to aur-general put it into the main body of the email, so I can properly quote what I want to reference, its just simpler.
So what does it add to our community? The IRC already recommends use of 0x0 or termbin.com. Both of which rely on open source software that can be selfhosted by users with ease.
+1
how often is a pasting service really required, when reporting an issue that might or might not be a packaging issue?
It is never used for reporting issues, the only time (to my knowledge) that a pastebin is needed is when you are sharing logs or configs over on #archlinux when asking for support. On the mailing lists the logs and configs can be added to the body of the email, on the forums it can be uploaded or added to the body of the post and to report issues on gitlab, it can be added to the body of the post or as an attachment. Pastebin, to the best of my knowledge, is IRC ONLY. Take care, -- Polarian GPG signature: 0770E5312238C760 Jabber/XMPP: polarian@icebound.dev [1] https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/th... [2] https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/me... [3] https://github.com/orhun/rustypaste/issues/279
Hello, It sounds like there are a wide range of opinions, and the topic of discussion is becoming increasingly hard to track over time. I'm proposing that we take a step back and discuss this at the upcoming Arch Linux Summit and then bring our notes to the mailing list before potentially taking any action, if that turns out to be the way to go. Best, Orhun
participants (4)
-
Orhun Parmaksiz
-
Polarian
-
Ralf Mardorf
-
Rein Fernhout (Levitating)