Why are you using torproject's RPMs? (was: We need a new RPM maintainer)
(forwarding a question from tor-dev since here are probably more ops that might want to answer the question bellow) https://lists.torproject.org/pipermail/tor-dev/2016-June/011073.html Dear tor-relay operators, are you using torproject's RPMs (instead of those provided by your distro maintainer)? If so: Nick Mathewson asked:
People who download our RPMs: in what way are they beneficial?
On Thu, 16 Jun 2016 21:08:49 +0000, nusenu wrote: ...
are you using torproject's RPMs (instead of those provided by your distro maintainer)?
Neither. I build from tor (and openssl) sources myself. Andreas -- "Totally trivial. Famous last words." From: Linus Torvalds <torvalds@*.org> Date: Fri, 22 Jan 2010 07:29:21 -0800
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 16/06/16 23:08, nusenu wrote:
(forwarding a question from tor-dev since here are probably more ops that might want to answer the question bellow) https://lists.torproject.org/pipermail/tor-dev/2016-June/011073.html
Dear tor-relay operators,
are you using torproject's RPMs (instead of those provided by your distro maintainer)?
If so:
Nick Mathewson asked:
People who download our RPMs: in what way are they beneficial?
Because my OS vendor has no Tor packages. If they did, I'd be on a stable release cadence from the OS, with automatic updates. I don't care about being on the bleeding edge until the bleeding edge fixes the broken ipv6-implementation. Until then, I can be a few versions behind without mental stress. As a rule, I refuse to install software manually, as I don't want the maintenance burden of following more -announce lists and recompiling from source every time. If there's no repository, and it isn't packaged upstream, it's a economical tradeoff. My time to build and maintain software packages, tracking every release and spending the time making sure it works, vs. the value of the project. Tor brings no value to me as someone who's hosting an exit relay, so that equation would end with "don't run a relay, it's not worth it". If there was a system package as well as an tor upstream package, I'd generally prefer the system package. They have a proven track record for handling updates smoothly, making sure signing and QA happens on packages. Vendor repositories are generally of worse quality, runs arbitary commands as root on my machines, and may or may not inflict other harm on my system. Even if I run tor, I don't want to give tor devs persistent root access to my computers. //D.S. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJXY9rUAAoJEPzDdnREnjz8SQoQAKap5FcAWV6DljXwemD9eqID vNQ+A5qgh/jCCep7yP51ig9uhSRlvcxpw/AYW5m81ZYSc0B6O1KqJ8na+98e6tTS Zdd/QeR0i8YRQ9lz/NSTF5s+DUje7J4Fm1ZPWH7dhjPio8rtXqW/B+7yblI5OBD+ rpKh4Du7+by/m/WM2HJxJB4mwL+dHaBH3GH2V6OQCEqQE9TTnxLxoNYC10ZAM8Sd G1oRQ+iL3jK17v41T4d+ZO8G/Ah3CZkyWucFcUXjVy8YiQBOMXTBh9MbCw5J8SVk 78nPyFRt7Pc9q8mDpYy8bPHYFC3cGsjA/9xYynJardsvnMlsG3FnqiqTiMlcx/hE JLZqowLDywnlkTb+wpVBbmDe14Jlmv+0i5KlmjHMt0GADixFveZxeIzH19ewPg8k otoNMqqo59JQlk6LoWTdTiPkmxKF0w30SjtUPLMruG1NEOr7jgqA9pueSQidDgwq IjrMpyoLR2ZAXq4sAqyNfWZuvcq+jPScJeHQ3NPAZXKUVM/iVQ/YShyP9kh/fZuK /i3maRVGPTGdSOQQLHoH83Ye5byziTTWVafA1/kvPGqFuZSEo+C7YA5exfFNLpSC /FaRb+sNpJGDWKWmgX8o8LyhlrHr2I4d2UgFfzZCN4Wx0EVZ6SzqNxMp1F4Ua1v/ utR2oJyIN+2HQjvmhenp =0ThJ -----END PGP SIGNATURE-----
Because my OS vendor has no Tor packages.
The torproject provides RPM packages for Fedora and RedHat/CentOS. Fedora has tor packages, on CentOS EPEL is available. So you are using torproject RPMs on non-Fedora/CentOS? (if you don't mind: On what OS are you using the torproject RPMs?)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 17/06/16 13:25, nusenu wrote:
Because my OS vendor has no Tor packages.
The torproject provides RPM packages for Fedora and RedHat/CentOS. Fedora has tor packages, on CentOS EPEL is available.
So you are using torproject RPMs on non-Fedora/CentOS? (if you don't mind: On what OS are you using the torproject RPMs?)
No, I _am_ using the CentOS/epel packages. I used to not do it due to needing a newer feature to get proper routing, but since epel/centos7 that's no longer necessary, which means I prefer the vendor (epel) packages over the Tor project ones. I'm sorry if my message led you to believe otherwise. Vendor repo packages are only ever used as a last resort, because they always grant the vendor remote root executable permissions. //D.S. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJXY+n7AAoJEPzDdnREnjz8ubIP+wYfhNyjRnGNMPSYHTbyvq+y cATSwrjXyAaIkXxf8X6kHsy2dRQwKAet1Mw1aw0pdM7h3NGDrMhZmT/rto2iWtZP Axgs1/VXpgAWkL+hnNxwy8tKCuKsjBnQ5qraBkjs23jVG30/Os5ET3zhQ4OpGA/V vuZhjZyC+vhQbV5jabAITMwbUUCNwZ0UvUcw6ezSU+LyMftII4e42onezMQ6wZ/u 2WhgVh82ZNUH54cPTf7fdPgQMN2QAdSOX599lxKeXNxD7quh72XO943AqPx7Rg2K y//WZ+6uImizA6dGA+ToVSmrXY2Tnod5JZr2tdTmcwbjuGSSMgE6Ans87m0CgPN3 xAUurtOqS5EWojso4Q0FczLdJRNcarOFYAZBtKr7ea+Ta8bzQbMwXpzV3a8IyEz5 2JL/65E+w/P+T4bsxD9vMgOX+L7K5L44AG8LnCa/bTQo5oAgYG2NKMvAe2+DNaAU /5p6hjBHj3zqkkOpHBUXN/2t6Pp3R8q+19xN2sl3n7G/GP19RtW8fl2nSiEOIYiT 6/76cTprycCE0XkoKOxV3+eSNwvGA8ZgwGhuCaPOel+5TS+1t4ruNTAmcydAu3yo 4XWUG95RvDGPNwoaKpJSSsg7OERzCnfXL3xADoUrhRqx7T0SsPzun6Xy2yQG/G5g 9rydBB9qCKKIiLf1dJdv =VJtZ -----END PGP SIGNATURE-----
participants (3)
-
Andreas Krey -
D.S. Ljungmark -
nusenu