-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
12 Aug 22:56 Mansour Moufid:
Even with webrsync you still have to trust the mirror(s), and then the Gentoo release infrastructure...
Forgive me my bluntness, but how is that different from trusting you?
The methods are reliable, being Manifests and webrsync, the unknown variable is the trust you give the ones providing you with ebuilds. But those are identified by gpg on both levels.
And the TBB is even worse, cause I also have to trust what's in the binaries. There is no way to tell what was actually compiled there. It could be something different than the sources on the git server.
13 Aug 00:28 Matthew Finkel:
- Given 3), is there a reason Tor is not at least an optional
RDEPEND for torbrowser via a USE flag (or another way)?
There are no optional runtime-only dependencies in gentoo, this could change with GLEP 62. http://www.gentoo.org/proj/en/glep/glep-0062.html
I could however tell the user after compilation that he might want to use tor with this...erm... but I thought that's obvious. The fact that it's not forced for RDEPEND is simply, because there are setups where this is not wanted/required.
13 Aug 00:28 Matthew Finkel:
- If you did/do intend to create an ebuild for the TBB and not
just the browser, it should provide the exact same experience as if the user downloaded it from torproject.org. I think this should include Vidalia launching Torbrowser once the network is configured.
Definitely not. The intention is not to provide an all-in-one experience. I already had those arguments with the guys from #tor
All I am interested in is the question about the firefox build-time configuration and if different build-time configurations could lead to vulnerability in the tor network. If there is the slightest doubt about that, I will remove this ebuild at once or fix it.
- - hasufell