Interview with Debian's New Project Leader

With the recent news that Anthony Towns will be taking over as the Debian Project Leader, Linux.com took a few minutes to sit down and feel out the new DPL-elect. From the interview: "The immediate plan is to organize the various ideas I've had so that I can work out which ones are actually worth working on, and what order to do them in; and to make sure that all the people who volunteered to be DPL during the campaign, or offered their help don't go away without some good ideas about extra things they can do. "

Comments

ftpmaster

[th173]

I am not happy with an ftpmaster as new project leader. They were the cause why the last one gave up.

But on the other hand, there is finally a chance for some movement and some chances; both are needed by this brilliant and outstanding project which is completely stuck by politics now; just like "the real life"(tm) *sigh*.

Re:ftpmaster

[ISayWeOnlyToBePolite]

...ftpmaster as new project leader. They were the cause why the last one gave up.

Do you have any publicly available info to back that up, I've only seen refrences to an unnamed personal tragedy as to the reason of Brandens demise.

Re:ftpmaster

[wysiwia]

I don't know anything about Brandon Robinson but Martin Schulze (Debians Stable Release Manager) also resigned because of the ftpmaster (http://www.heise.de/newsticker/meldung/70616, german).

O. Wyss

Re:ftpmaster

[Anonymous Coward]

I am not happy with an ftpmaster as new project leader. They were the cause why the last one gave up.

It's an interesting paradox. A member of "the Debian cabal" was elected DPL. Personally I voted for none of the above since all of the candidates this year seemed resigned to the idea that the DPL has no power. The DPL does have power under the Debian constitution to appoint and replace delegates, but past DPLs have given in to the idea that there are no delegates...that the ftp-masters, DAM, etc are unaccountable to the DPL and by extension the Debian project as a whole.

In some ways it's a good thing that the DPL can't assert any real authority over other members of the project, but it also makes the DPL election a silly waste of time and energy and runs counter to a plain reading of the Debian constitution. If the DPL is a powerless and symbolic title we might as well make Ian Murdock, Bruce Perens or some other recognizable individual DPL for life and stop with the silly elections.
Anthony's platform was more active than the other potential DPL's, but it included plenty of caviats to indicate that ultimately he'll follow the tradition of doing very little with the position. For instance:

Another issue was that of "supporting delegates". As it turns out, that's perhaps an overly limited description, since a number of roles, including the security team and ftpmaster, might be better thought of as "infrastructure maintainers" instead, which implies a different relationship to the DPL.

And:
Some of the goals I hope to work towards in the coming year include getting updates accepted into the archive more frequently than once a day, having frequent beta releases of etch/testing that we can legitimately call a release (benefiting from the ongoing work of the installer and testing-security teams), and having reliably quick resolution of RC bugs in unstable. None of those require, or even necessarily benefit from magical DPL powers; but I think the project will benefit if whoever is elected DPL takes that idea on board, and sets a good example at making frequent and improvements to Debian.

For me, these simply aren't compelling reasons to elect a DPL. OTOH, Anthony's platform was better than what the other candidates offered.

Re:ftpmaster

[BacOs]

It's Branden with an e - he hates it when people misspell his name

How about this.

[LWATCDR]

Good luck, a good number of people are depending on you.

I don't use Debian for my workstation. I do use it in an embedded device I am working on.
Keep it stable and keep them the new stuff coming.

Re:How about this.

[ObsessiveMathsFreak]

Keep it stable and keep them the new stuff coming.

Your aim is sabotage sir!

Great interview

[Anonymous Coward]

unfortunately, it took Debian several years to release it because it had to be translated into 15 languages, including aramaic

Re:Great interview

[jrock-jr]

...etch (the codename for the forthcoming release, due in December)...

was anyone else surprised that the etch release date is this december?

Re:Debian? What's That?

[Anonymous Coward]

What is this "Debian" about which you write? Oh that's right, that's the gang of idiots that took over TWO FUCKING YEARS to include KDE3 in sid.

MOD PARENT UP! It only took me one and a half year to compile KDE on my Gnetwo-b0x3n, which proves why Gnetwo is the right choice for production server workstations.

Besides, I think Ubuntu, on which Debian is based, is much stabler the Debian. Don't get me wrong, Debian is not that bad for a distribution run by amateur newbies and unemployed sys-admins, but it still has to catch up in all areas.

If Debian is run by the DPL

[Beryllium Sphere(tm)]

then is Gentoo ruled by the GPL?

Re:If Debian is run by the DPL

[iabervon]

Yes, but you can change that with a USE flag.

Good luck

[upside]

Firstly, congrats and good luck to Anthony from an avid Debian user.

Having read the article and AT's campaign platform I got the sense that the project really needs not only direction, but also a leader who can steer the project while keeping people onboard and happy. This means leading the people as well as managing the project.

It seems that bickering and infighting are open source projects' achilles' heel due to strong personalities and oversensitive or overinflated egos. I hope Anthony does a good job at making the Debian team as strong as their product is already.

It's not that easy

[lanc]

One needs a stable _and_ fresh distro.
Debian is stable. period.
And bureaucratic.
and many others base their work on it and give nothing back.
and Debian moves as slowly as a rheumatic snake.

BUT

Debian is still the least bad. ( != best, that is nonexistent for years now)

Re:It's not that easy

[jZnat]

Debian doesn't really move slow at all; the only perceived slowness is in the stable distribution. If you keep up to date with unstable (which will literally always have something to update for you every day), you'd notice that they keep up to date with the majority of its software. For instance, KOffice 1.5 just came out, and it's available in Debian Sid (unstable) and thusly also available in Ubuntu Dapper (they keep their developmental releases in sync with Sid until a release-freeze starts every six months).

Re:It's not that easy

[lanc]

Unstable? On a productive server? contradiction. Again - I did that years long. I want a stable release on my productive boxes. Not mixing with etch, not mixing with ubuntu, no backports.org, no experimental branch. Pretty please.

Re:It's not that easy

[petermgreen]

BUT you don't wan't that kind of upgrade treadmill on a production box. And if you don't follow the upgrade treadmill you lose any modicum of security support.

the REAL problem is that most developers run the bleeding edge distros (unlike in the windows world where people test at least down to 2K and often down to 98 or even 95!)

wheras i can't reliablly run recent linux software on woody (which is newer than windows XP!)

running sarge is tenable for the moment but unless debian gets their house in order and delivers a release at least every couple of years then we are going to see the same issues that woody had all over again.

Re:It's not that easy

[Anonymous Coward]

The debian project officially tells me to *not* run debian unstable and to expect it to break.

I have experienced debian unstable breakages such as Xfree86 being broken and unusable for days.

Unstable is *not* the answer. In spite of all the fanboy anecdotal evidence to the contrary.

Re:It's not that easy

[Trogre]

You think that's bad? Try running testing.

Re:It's not that easy

[Relyt]

I think you have the two mixed up. Stuff only makes it into testing after it has already been in unstable. Most of the stuff that makes it into testing works.

OTOH, running a sid(unstable)-based desktop system is a lot of fun if you don't depend on it. It is like a game of russian roultette every time you run apt-get upgrade. What will break this time?

Re:It's not that easy

[swillden]

And if you don't follow the upgrade treadmill you lose any modicum of security support.

Testing now has a security team.

Re:It's not that easy

[runderwo]

I think that is an utterly ridiculous idea for anyone who is not a developer. The "testing" distribution is there for a reason, use it!

This release started as a copy of sarge, and is currently in a state called testing. That means that things should not break as badly as in unstable or experimental distributions, because packages are allowed to enter this distribution only after a certain period of time has passed, and when they don't have any release-critical bugs filed against them.

The downside with testing is that you need to subscribe to debian-security-announce to keep abreast of security problems and see if you need to pull from unstable or backport a fix. Security releases for testing are not done in a managed fashion, i.e., they trickle down when the package passes all the usual criteria to enter testing.

Neither testing nor unstable is suitable for a non-development machine.

Re:It's not that easy

[lord_rob the only on]

Have you heard of apt-listbugs ? Every time yoou upgrade your system, it checks the BTS (Debian Bug Tracking System) and displays grave bugs related to packages you are about to upgrade. You can check the reported bugs (most of them are not related to the version you are about to install or to the platform you are using)

I have been using apt-listbugs for a while actually, and I have never experienced any bad crash recently with sid.

Re:It's not that easy

[petermgreen]

All secure-testing did is try to get security updates to those on the testing treadmill faster. you still have to either stay on the upgrade treadmill to make use of them (mixing bits from testing a few months apart can be a very bad idea).

Noone is going to provide security updates targeted at where testing was a couple of months ago.

the ONLY ways to get timely security support are
1: stay on the upgrade treadmill for testing or unstable (which is a lot of work and has fairly high risk of breaking something at any time)
2: use a stable release
3: make your own stable branch and backport fixes to it (which will be a massive ammount of work especially if you plan to do serious testing of every fix).
4: use the results of someone else who did 3 (e.g. use ubuntu)

Re:It's not that easy

[swillden]

stay on the upgrade treadmill for testing

Yes, however, with testing this is neither very much work, nor is it very risky. In fact, in my experience, it's not risky at all as long as you watch what's being upgraded. I've never experienced any breakage due to testing updates, but what has happened to me is that an app is upgraded to a new major release that uses a different configuration format, etc., and requires effort on my part to make it work the way it did before. That's only happened to me a couple of times over the last five years.

For my desktop machines, I think testing is the best choice (though I actually run unstable on my primary box). I run testing on servers, too, but only where I actually need some package that isn't in stable.

Re:It's not that easy

[petermgreen]

but what has happened to me is that an app is upgraded to a new major release that uses a different configuration format, etc., and requires effort on my part to make it work the way it did before.
i consider that to be breaking.

yes it doesn't happen too often but i still wouldn't wan't to risk a server.

also while your right its not that much effort for one box i wouldn't wan't to maintain more than a couple of testing boxes.

Re:It's not that easy

[swillden]

yes it doesn't happen too often but i still wouldn't wan't to risk a server.

Which is why if you're running testing on a server you need to pay attention to what's being upgraded. If you see some package receiving a major upgrade, hold it until you can investigate it.

also while your right its not that much effort for one box i wouldn't wan't to maintain more than a couple of testing boxes.

Actually, it's not much different. The same packages are going to be the issue on each machine, so the effort doesn't increase with the number of boxes. I keep a testing system running in a VM on my laptop so I can investigate the -- fairly rare -- changes that I think may break something.

Obviously it's easier just to stick with stable... and if you need a really stable system, there's no better choice. But for those machines who need something that isn't in stable, testing is a good choice. Better than, say, Ubuntu, because the supported lifetime will be longer. If I install a testing box today, I know I'll continue to have supported security updates until etch's successor's successor is released, which is six or more years in the future, unlike Ubuntu which only supports its releases for two years.

First suggestion for the new chap:

[caluml]

You know what most pisses me off about Debian? I can't apt-get install mod_security because of their licencing issues.
I'm really glad they have principles. I really am. I admire them for sticking to their guns. But because of this, I have to jump through hoops, and use third party packages, or install the apache source packages and build against them.
It's all a lot of faffing around. Have 2 repositories. One for people that want only the most GPL'd, clean packages. And another one where they put the same packages, as well as the ones that people want.
Debian aren't going to change the world with this system, and they're just going to make it hard for people to have a complete system as they want.

Now, here come all the posts telling me "You just need to do this", or "Point your apt at this server", or x, y, z. Why not just have a setup flag or a config file - perhaps if /etc/allow-other-packages exists, it works.

Re:First suggestion for the new chap:

[butterwise]

You know what pisses me off most? I don't know what it is! Grrrr!

Re:First suggestion for the new chap:

[jZnat]

You have included contrib and non-free in your sources.list, haven't you? Example:

deb ftp://ftp.us.debian.org/debian sid main contrib non-free

Re:First suggestion for the new chap:

[fregaham]

It's illegal to distribute mod_security binary under GPL. Apache could sue Debian for copyright infrigenment if they did.

Re:First suggestion for the new chap:

[Jorgensen]

"I'm really glad they have principles."...

"Debian aren't going to change the world with this system, and they're just going to make it hard for people to have a complete system as they want."

Sorry, but you can't have it both ways. Either it's OK for Debian to have principles (and thus Debian is doing the "right thing") or Debian should forego the principles to make it easier for you to not abide them?

Logic Error. Parsing abandoned.

Re:First suggestion for the new chap:

[discord5]

I can't apt-get install mod_security because of their licencing issues.

Don't choose a distro that has that as one of their guidelines then. Debian is a great distribution if you're willing to abide by the principles on which it's built, unfortunatly sooner or later you'll find something that is missing because of it. In all honesty, the easiest thing to do is to build the package for yourself then, if you really want to use debian.

Again, this isn't a solution that works for everyone. There are time-issues, costs asociated with building those packages, and you have to keep them up to date yourself, but if you've got a couple of machines that need that package, building it once and running "dpkg -i" on several machines is a small price to pay

Now, here come all the posts telling me "You just need to do this", or "Point your apt at this server", or x, y, z. Why not just have a setup flag or a config file - perhaps if /etc/allow-other-packages exists, it works.

Really, what did you expect, this is slashdot after all. Nobody is forcing you to use debian, you know, and you can always get involved. But again, many people (like myself) simply don't have the time to get involved and build a package they can install themselves, apt it from someplace, or whatever seems like the best solution at the time.

If this is unacceptable, debian is not the distribution for you. You're better off with Redhat perhaps, or any other distro that doesn't make such an issue out of licensing. This isn't an elitist argument here, saying debian isn't for you in this case, it's simply pointing out that perhaps there are more time- and cost-effective solutions for you.

Re:First suggestion for the new chap:

[marcello_dl]

The allow other package flag doesn't need to exist as it's always TRUE. The config file is, guess what, /etc/apt/sources.list

This solution is more general than the one you propose, as you can choose where to fetch the unofficial packages if alternatives exist.

There is also a sources.list.d directory where to put .list files, I discovered it now.

Re:First suggestion for the new chap:

[zerblat]

I don't think Apache is the problem here. I might be wrong, but I don't think the Apache license puts any restrictions on the license terms of modules that are loaded into Apache. The problem is that the author of mod_security chose a license (GPL) for it that doesn't allow you to use it for what it was intended for (i.e. being loaded into Apache). The author could easily solve this by changing the license (e.g. adding an explicit exception permiting you to use it with Apache).

Obviously, it's very unlikely that he would sue Debian for distributing mod_security, and even if he did, I don't think he would be likely to win, considering it does seem like his intensions are for mod_security to be used with apache. Nevertheless, the fact is that Debian doesn't have a valid license from the copyright holder to distribute the software, so there's no way they can. The only one who can solve this is the author of mod_security (either that, or if Apache switched to a GPL-compatible license). The situation is pretty much the same as it was with KDE, before Qt was GPLd.

Re:First suggestion for the new chap:

[asuffield]

Obviously, it's very unlikely that he would sue Debian for distributing mod_security, and even if he did, I don't think he would be likely to win, considering it does seem like his intensions are for mod_security to be used with apache.

Since copyright violations are now a crime in many countries, Debian could be prosecuted by the government. That's either the DA or DHS in the US. The author would have little or no control over this; it would be a political decision.

That makes these things a lot trickier than they ought to be.

Re:First suggestion for the new chap:

[Rutulian]

I like how nobody in this thread, including the parent actually tried to investigate the problem. mod_security is gpl'd and available in Debian as libapache2-mod-security, so wtf are you talking about? Next time try to actually look for the packages before claiming that they don't exist.

In general, though, Debian already does what you ask for. It has a main distribution, for software that meets the Debian Free Software Guidelines, and a non-free distribution for other software. If Debian doesn't distribute something (officially), there is probably a serious legal hindrance, and other distributions like Red Hat probably don't distribute it either. However, also like Red Hat, there are unofficial repositories you can use to get these packages if you don't care about the ethical/legal issues. I don't really see why this should or how this could be easier. Anything more automagical, like /etc/allow-packages, would be a legal problem for Debian to support officially.

Re:First suggestion for the new chap:

[debiansid]

I can't apt-get install mod_security because of their licencing issues.

You're probably looking in the wrong place. libapache-mod-security is the package you're looking for. It's only in stable, not in testing and unstable.

It's all a lot of faffing around. Have 2 repositories. One for people that want only the most GPL'd, clean packages. And another one where they put the same packages, as well as the ones that people want.

They already do. The proprietary software is in the non-free branch.

Re:First suggestion for the new chap:

[caluml]

No - you can see both sides of an argument, and not agree with them both. I admire people who have principles and stick to them. However, this doesn't mean to say I agree with those principles all the time. See?

Re:First suggestion for the new chap:

[NateTech]

Why not get pissed at mod_security's license and talk to THEM about it rather than get pissed at Debian? Your ire is misdirected.

Or go write a replacement that has proper open source licensing.

Plenty of options. None you like. Not Debian's fault.

His first act as the Debian overlord...

[Anonymous Coward]

A Coke machine in the cafeteria! Yeah!

The "best" distro right now...

[MoxFulder]

In my opinion, the combination of Debian+Ubuntu is simply "the best" right now. I went from Debian to Ubuntu on my laptop about a year ago, and recently installed Ubuntu on my new AMD64 box.

Ubuntu is very stable, installed *almost* flawlessly (NVidia :-/) on my new AMD64 box, and best of all it's based on Debian. Also, they take a principled stand (IMHO) against closed-source software, but are more pragmatic in terms of offering closed-source packages while alternatives are developed.

Plus, Ubuntu and Debian devs interact a lot as far as I can tell, so Ubuntu is contributing to the improvement of Debian to a significant degree.

The way I see it:
* Debian is a super-stable FLOSS-only server OS
* Ubuntu is its almost-as-stable up-to-the-minute desktop OS

Neither of them is "the best" alone, but the combined strengths of the two are a knockout in my opinion.

Re:The "best" distro right now...

[lanc]

* Debian is a super-stable FLOSS-only server OS

Stable, no question about that. But always outdated.

marvin:~# for i in mysql-server tomcat4 tomcat5 postgresql ; do echo $i ; apt-cache show $i | grep ^Version ; done
mysql-server
Version: 4.0.24-10sarge1
Version: 4.0.24-10
tomcat4
Version: 4.1.31-3
tomcat5
W: Unable to locate package tomcat5
E: No packages found
postgresql
Version: 7.4.7-6sarge1
marvin:~#

yes, I am aware of apt-get source -b ... but the more machines I administer, the less magic I want to do on them. Don't get me wrong - I was/am/willbe a debian admin - just don't get overenthiusiastic.

Re:The "best" distro right now...

[Wolfrider]

IMHO, the *biggest* thing Ubuntu needs to work on, is BOOT SPEED. Bust out the parallel-INIT that we've been needing for YEARS.

On a 750MHz laptop with 384MB of Ram, it takes *several* minutes to boot into console (non-X) mode. XP takes 2 minutes on the same machine. Not a troll, I use Linux for 90% of my day-day work. But since XP boots faster, I end up booting that instead, if all I'm going to be doing is light work/Web browsing.

Re:The "best" distro right now...

[Kjella]

Stable, no question about that. But always outdated.

Well, if there wasn't a trade-off there, there'd be nothing to discuss would there? Debian is a really great server - if the server already does what you want it to do. If you are just waiting for that new feature in version $X just released, well you better have patience if you want to run it on debian stable. What Debian is doing is not very glamorous, but I think it's important. The only other free alternative in that class is CentOS, which is nothing but RHEL repackaged. The others are either too busy with the latest & greatest, or something you'd have to pay for. I'm glad there's at least one community project focusing on the really stable server.

Re:The "best" distro right now...

[Anonymous Coward]

You should watch to see if it is hanging on any part of the bootup. Likely candidates would be:

- wireless lan searching for an access point, delays bringing up the network.
- trouble contacting ntp.ubuntulinux.org to sync the clock (big delay)
- any sort of fsck

That's just off the top of my head. But I run a machine with similar specs and have nowhere near the Ubuntu boot time that you are reporting, even when I'm starting up X.

Re:The "best" distro right now...

[Sam Haine '95]

The way I see it:
* Debian is a super-stable FLOSS-only server OS

Debian is also the basis for the OS for Nokia's Internet Tablet. So it's the "best" Internet Tablet OS as well.

Re:The "best" distro right now...

[laptop006]

Sarge has Mysql 4.1 (in the mysql-server-4.1 package), which was the latest stable mysql when it was released, etch (current testing) has 5.0, and 5.1 is still in beta.

Re:The "best" distro right now...

[advocate_one]

the boot process is being worked on for the Dapper release. On my boxes, I can see a distinct improvement in the boot time in Dapper compared to that of Breezy.

But boot time has never really worried me as my boxes are on 24/7 and only get rebooted for a kernel upgrade. Even my daughter's laptop has got some 40+ days of uptime at the moment...

Re:The "best" distro right now...

[MoxFulder]

I'll second you about Dapper boot time being a great improvement over Breezy. I also have turned off the boot-time NTP sync, as that always introduces a delay.

I keep my laptop off when not in use, since I like to conserve electricity, but my desktop seems to be up all the time these days since I never know when I'll need to remote-access it.

Re:The "best" distro right now...

[Wolfrider]

Thanks. All of those are n/a, I checked. It's just slow, and I've tweaked it to disable stuff that doesn't need to be running.

Right now, the things that seem to take the most time are auto-hardware detection, USB and hotplug stuff. Thisbox has no wireless.

Still, I know there are things that could be running in parallel. M$ did make an effort with XP to speed up the boot process; I'd really like to see *every* Linux distro do the same, as a best-practices issue. Linux should be able to boot *faster* on the same hardware, since it's not even loading a GUI.

That's a pretty fabricated example.

[Homestar Breadmaker]

Go download mod_security and look at the license, it is GPL.

Re:That's a pretty fabricated example.

[kbmccarty]

Go download mod_security and look at the license, it is GPL.

That's actually the reason it was removed from Debian; from what I gather, it uses Apache headers that are licensed under the Apache License, which is apparently incompatible with the GPL. Here's the relevant bug: #313615

Disclaimer: I haven't done enough research to have an opinion on whether this removal was justified or not.

Re:That's a pretty fabricated example.

[caluml]

Yep, that's the issue. Basically, it doesn't matter why, but they don't support it. And that sucks. Sort of like Red Hat and the mp3 stuff. Just flash up a message, and let the user decide. "You're about to install MP3 support for XMMS - are you aware that the MP3 support might be subject to patents worldwide, and do you absolve Red Hat from all responsibilities?"

Re:That's a pretty fabricated example.

[asuffield]

I'm sorry, but saying "I am aware that Redhat is committing a serious crime and absolve them of any responsibility" does not actually stop it being a serious crime or absolve them of any responsibility. Private individuals just can't do that. Talk to your government if you want to do that, and get the stupid laws fixed.

That's the problem. It's probably not illegal for you to receive this software. It's a crime, prosecuted by your government, for Redhat or Debian to give this software to you. Neither you nor Redhat nor Debian has any control over this. The authors of the software only have limited control - they can stop it being a crime (by fixing their license), but they cannot stop the government from prosecuting people for it.

Copyright isn't just a civil offense these days, and that's a big problem here. It means that vendors have to be much more careful about what they give you.

Re:That's a pretty fabricated example.

[Bronster]

It's only a crime if using that software is illegal either where you're downloading it from or where you are located.

Further more, it's quite possible that you work for an organisation that has a blanket licence for the patent or you have individually licenced it.

But feel free to keep pushing the "it's illegal for some people so everyone doing it must be bad" meme.

Re:That's a pretty fabricated example.

[Anonymous Coward]

incompatible licenses are illegal for everyone, so someone doing it must be bad

Re:That's a pretty fabricated example.

[asuffield]

It's only a crime if using that software is illegal either where you're downloading it from or where you are located.

I'm sorry, but you seem to have forgotten that copyright exists.

Copyright is a law which says you may not create copies of certain classes of information and then give those copies to other people. It also says that if you give enough copies to other people then it is a crime. Putting a copy of it up on a web server qualifies. Just ask the MPAA and RIAA.

If you do not have the specific, explicit, correctly formulated permission of all the copyright holders, and none of the exemptions apply (fair use), then copying the work on a large scale is a crime.

If the work you are looking at contained GPLed software, and also is controlled by patent licenses or other copyright licenses, then you explicitly do not have permission to copy the work at all. That's one of the terms of the GPL. You may use the software as much as you like, but you may not copy it.

(Using the software, which you were talking about, is an entirely different matter that has nothing to do with copyright - yes, it's possible to commit crimes in this fashion, but they aren't relevant here.)

Further more, it's quite possible that you work for an organisation that has a blanket licence for the patent or you have individually licenced it.

It does not matter whether the organisation that you work for has a license to use the software. Redhat and Debian do not have a license to give you a copy of the software. That is what matters. It's stupid and inconvinient and poorly thought out, but it's the law.

Re:Debian? What's That?

[clydemaxwell]

I'm self-employed, you insensitive clod!

...and lookin' for a better job...

Not a job I'd want...

[Cumikaze]

That has to be one of the most difficult jobs in Debian. I couldn't imagine having to deal with over a thousand maintainers/developers all screaming for something different. So good luck to the new DPL!


A few things that would be good for this year:

1. Get AMD64 release into the main pool, enough already. Don't wait until December or whatever for Etch - just get it done!

2. Get security.d.o mirrored on a few more servers.

3. Try and trim the releases down to every 12 months (or less!) and drop the "when it's ready" attitude because that just drives people away.

4. (related to #3) If it's broken, don't include it, but don't hold up a release because of it - put it in "proposed updates" or something when it's fixed.

5. If it's ready for most archs, but not one (i.e. m68k) release anyway and m68k can just play catch up...

Re:Not a job I'd want...

[petermgreen]

1. Get AMD64 release into the main pool, enough already. Don't wait until December or whatever for Etch - just get it done!
afaict amd64 is almost totally built in the official sid archive now and should be making its way into etch gradually atm

the amd64 sarge is an unoffical rebuild and won't ever be part of the official archives.

3. Try and trim the releases down to every 12 months (or less!) and drop the "when it's ready" attitude because that just drives people away.
i think 12 months is a bit too fast given that the security team don't belive they have the rescources to support 3 versions of debian at once. 18 months or so is probablly about right allowing a year of security support for oldstable followed by a few months of secuirty support for testing in the run up to its release (when people will be doing test migrations etc).

Re:Not a job I'd want...

[Anonymous Coward]

Your comment makes it sound like AMD64 won't ever be in Debian. It has already entered unstable, and is about to propogate to testing (etch)

Re:Not a job I'd want...

[mvdwege]

Try and trim the releases down to every 12 months (or less!) and drop the "when it's ready" attitude because that just drives people away.

I wouldn't know about that. I switched to Debian somewhere in 2002 (during the potato/woody crossover), and it definitely was a fringe distribution at that time. The big players were Red Hat, SuSE and Mandrake.

Since that day, I have seen both Debian itself and Debian derivatives like Linspire and Ubuntu making lots of headway. Debian is very popular as a base distro to start from because:

1. The main archive is fully redistributable Free Software.
2. The very strict packaging policy gives developers a stable base distro to build from.

I don't think the Debian project being very careful stops it from being popular. It might drive some people away, but I don't think that people that measure software quality by the amount of official release deadlines really are the kind of people the Debian project should care about.

If you look at those that advocate Debian the loudest, I see three distinct groups:

1. Server administrators who want a stable environment and have no requirements for the latest and greatest software.
2. Developers who require a basic stable distro to build their own software upon.
3. And a subset of 2: desktop users, both hobbyist and professional, who are willing to do or have done for them a bit of development/debugging to get a workstation install tailored to their personal needs (these tend to run unstable).

Debian succesfully meets the needs of those people, and that is all it should care about. The fanboys who want to brag about living on the bleeding edge can either try unstable, or they should move to Fedora Core or Gentoo, which specifically pander to their needs anyway.

Mart

Re:Not a job I'd want...

[mattyrobinson69]

1: I agree, although ive not had any problems running amd64 sarge on a production webserver

2: Security patches aren't mirrorred because they wont always be up to date.

3/4: It would be nice if stable stayed stable for as long as it does, but occasionally added new packages (eg php5 alongside php4, mysql5 alongside mysql4, apache2.2, etc)

4: Give me Xen!

Re:Not a job I'd want...

[petermgreen]

umm what part of my post implied that?

Are you sure...

[Anonymous Coward]

... you aren't thinking of Gnome?

Tools and standards versus process

[systems]

What I want is simple.

All the software packages I need, in the versions I need/want. And only that.

A distro in my understanding, is a set of packages that don't conflict, so in a way, by choosing exactly what I want I am creating my own distro.

I may also wish to run two different version of the same package.

I may also want to compile some of them to set the compile options to just what I want.

The problem I see with debian, is that it's too dependent on a process, not on tools and standards, this is why I think it will eventually fail, or at least will have variable quality, i.e. few good years and few bad ones.

I don't want a process distro, I want a tools and standard distro, the process should be managed transparently by applying the standard, debian seem to require too much effort which is hard to sustain, to keep its quality.

From where I stand I dee debian is more focused on offering the output of a process, the distros themselves, woody, sarge, etc... and not as much focused on the tools and standards to create a widely inclusive process

Debian best for the enterprise

[Anonymous Coward]

Debian is the best disro for the enterprise, for it is stable (as in "doesn't crash AND doesn't change very often).

If Debian were to make major release more often than once in two (2) years then, I guess, we would have to be looking for something more stable. One release in three (3) years would probably be the best, from our point of view.

Debian is the best choice

[RLiegh]

...when you need your software as out of date as possible!

(I kid, I kid; at least until slackware finishes downloading...)

Re:Debian? What's That?

[Anonymous Coward]

This is a lousy attempt to be funny. Does it make it a troll? I don't know either.

Security updates for testing

[Anonymous Coward]

I noticed that the Debian project have started providing security updates for testing, but it is difficult for an outsider to judge reliable these updates are.

Do all known security problems in testing get fixed?

How fast are they fixed?

Passion of the Debian

[Anonymous Coward]

And the Aramaic version with subtitles was quite good!

Dictated freedom, sorta.

[Anonymous Coward]

What I find very funny about this whole ordeal is that it clearly proves that although "open source" is all about freedom and protecting the right of the individual it cannot do so without violating their own rules and policies and in an environment which doesn't provide the amount of freedom one would imagine. This I conclude by the fact that the most outstanding open source project of them all cannot be lead by a group of people to make it more democratic but appearantly needs one man responsible for making a final decision if there is such a need.

I'm not saying that it is a bad thing perse, but it would be good for the opensource zealots to keep an eye open for those small details before you start criticizing others while carrying out the idea that opensource is the one true "all or nothing" idealistic move whenever people / companies make a small start to wander into that direction. While in fact it eventually turns out that the idealistic organisation itself cannot be truly free and by that I mean through fully democratic decisions. Simply because that would never work.

So the next time a company provides the sourcecode with their product and as such says its open sourced / open source it would be nice to allow them this kind of freedom. Now, since I've given a comment about double standards... From the opensource website I can pick up the definition which says:

9. License Must Not Restrict Other Software

The license must not place restrictions on other software that is distributed along with the licensed software. For example, the license must not insist that all other programs distributed on the same medium must be open-source software.

So when I look at the GPL secion 2 I can see 3 demands to which I must comply before my program can be distributed (a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change., b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License., c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License.).

However, and this is where it gets weird, the section ends with a clear statement saying: "These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.".

So if I have a free piece of software which I want to use in combination with a GPL licensed piece of software with my own modifications and my own additions I'm unable to do so due to the licenses. But doesn't this collide with the opensource definition itself? I have seen many threads on /. criticizing software projects and such saying they should not be allowed to call themselves opensource (or hint in that direction) due to them not complying fully with the opensource definition. I take it all of that is now different ?

Opensource is almost always mentioned with freedom in one sentence. That freedom goes both ways, it would be a good thing if more people started realizing that.

The debian people are very stupid then.

[Homestar Breadmaker]

Headers are not subject to copyright.

Re:The debian people are very stupid then.

[Eunuchswear]

Yahooo! We have a lawyer in the house.

Got any more free expert opinion?

Re:The debian people are very stupid then.

[Homestar Breadmaker]

Sure, just use apache 1.x where the license is GPL compatable. Its not like apache 2 buys you anything besides additional security holes on unix.

So Many Misguided Comments About Debian

[raphae]

So many people seem to be fundamentally misguided in their knowlege of Debian. I keep seeing complaints over and over about the ultra-long release cycle and consequent lack of official .debs for important newer releases of important apps like languages, databases, and application servers. This criticism does have a good basis in many instances as Debian's lag in its stable release behind versions of some major apps can be annoying. After the last release of Sarge it was said that there would not be a repeat of the super-long release cycle anymore and that major changes were being made in the release process. However, to complain that it doesn't have the cutting-edge version of koffice or amarok or something is totally misguided. That quite simply is not what Debian/stable is about nor for. Maybe people think it *should* be for that, but that is another argument altogether. In the meantime, there are testing(etch) and unstable(sid) for people who want the latest. Is not Ubuntu just a Sid snapshot made every 6 months, with dedicated developers dealing with any bugfixes, and maybe some other custom niceties added on?

But then someone else criticizes unstable as being totally unfit for production servers. No duh.

I have been lucky enough that the last few companies I have worked at either already used Debian/stable as their production Linux distro or allowed me to change it to that. And I can say that, having been in a situation of administering clusters of critical production boxes, I *highly* appreciate the ultra-high level of stability of Debian/stable, not to mention much of the ease that comes from administering it due to its superior infrastructure and tools.

I believe that THE biggest problem is a serious lack of enterprise-friendliness. For example, at my current employer we have clusters of HP Proliant boxes. HP has a range of support applications designed to run on its servers running Linux - for example the HP System Monitoring Agents which proactively monitor things like temperature sensors, fans speeds, etc. and take action if thresholds are exceeded. These kinds of tools are imporant in enterprise deployments and HP already makes rpm packages for them but does not provide Debian packages.

Another area is Oracle support. Recently after digging around on Google I did finally find instructions on how to use alien to build .debs from the Oracle Instant Client OCI8 rpms which Oracle releases. Again, a critical enterprise tool release by a major heavyweight with no Debian versions. I would venture to guess that many sysadmins would not figure out how to deploy the instantclient software this way.

I also had the same issue with Debian's PHP which was not compiled with Oracle Instant Client support so I had to rebuild PHP, but here too there were a few tricks and I don't think this is something easily done by the average sysadmin.

Lack of debs for important enterprise tools and applications is a serious problem. Regardless of the Debian project's position regarding free software, etc., I believe that it is critical that it find a way, somehow, to incorporate, allow, or otherwise support critical enterprise components to be included, otherwise it seriously risks whithering away in areas where it counts, and where it really has the potential to show its forte as a distro.

Not only should it be figuring out how to incorportate enterprise components, I believe that it needs to make up for damage by proactively reaching out to companies like HP and Oracle and ensure that Debian versions of their applications and utilities get released. Right now too many companies don't even seem to consider Debian when release their software which is a bad trend.