An Abrupt End to Debian Live

I find the whole thread somewhat cringey to read and I'm not sure why he thinks it reflects well on him.

Please don't spread FUD.

Debian does a great job of creating and maintaining a stable, secure, and coherent operating system.

They may modify upstream software so that it complies with the Linux FHS, but the goal is to achieve a coherent system (e.g. config in /etc, data in /var/lib, etc). IMO, they do a better job than any other Linux distro.

Debian also has a strict policy on decoupling libraries from programs. This means that when a security update is released (e.g. the security fix for latest libpng vulnerability), you only need to update a single package.

Finally, Debian aims to be stable, which means they'll keep an eye out for vulnerabilities and backport fixes. This is done instead of forcing you to move between versions of software, which has the potential to break things, or create new security issues (e.g. changes in config).

The Debian+openssl vulnerability happened in 2008. Go back, and look at Debian's security record (e.g. go to LWN and see Debian release fixes for the latest vulnerabilities just as quickly as Red Hat and Canonical/Ubuntu).

The ITP bug does not actually do anything with regards to the upload process; it's simply a coordination point. You can ignore the ITP process and upload a package straight to "NEW".

For historical reasons, the team that maintains the Debian package archive is called the "ftp-master" team, though the archive is generally retrieved via HTTP. They have the final authority (subject to, like, a project-wide vote or whatever) on what actually goes into the archive, and it's their job to prevent things like packages being hijacked from an active maintainer, in addition to verifying free software status, non-atrocious packaging quality, etc. Part of that verification takes time, especially for brand-new packages.

What happened in this bug is that Daniel did not file an ITP and uploaded the package, and Serge did file an ITP and uploaded the package, and the NEW queue got both of them. Who's in the right is pretty unclear. Daniel had his package in the queue well ahead, but Serge followed the procedure, and the very reason the procedure exists is to avoid conflicts like this. So Ansgar, a member of the ftp-master team, told them to work it out amongst themselves (a common response for conflicts). Later, Paul, also on the ftp-master team, said the same thing in stronger words, in the email rejecting both of their uploads.

Serge also had uploaded a newer version of cgmanager which unblocked systemd-shim (the compatibility layer for running non-systemd systems). Daniel had uploaded an older version that was not useful for systemd-shim.

So Daniel and Serge worked things out amongst themselves, except Daniel did not actually get around to uploading his package, so Serge uploaded his original package after timing out on Daniel.

Serge was technically in the right, but that isn't really the metric. Serge was also probably socially in the right, but this was unfortunately a murky case.

Paul accepted Serge's next upload after hearing both Serge and Daniel saying that they were working together, even though Serge just uploaded his original package (without Daniel's packaging and without listing him as a maintainer).

There are obvious echos with what happened in Debian Live: Daniel feels hurt because other people ignored work he was doing in favor of their own thing, and everyone else felt frustrated because Daniel's work didn't support things that the rest of Debian needed, and there was no sign of that changing in a timely fashion.

I have invited people from debian to make conferences and know myself one of the former DLP.

Debian has something scarily bureaucratic in its organization.

As an effect of conway's law (structure of the organization gets in the product) the debian developer's guide is like hellish, their level of indirection for forcing everyone in the LSB without breaking the change in the "reasonnable" default conf are heavy. And not even close to correction : the spliting package policy (avoiding too much dependency) makes installed python or latex feels broken.

It is like the heaven of both former soviet idealism (comitee of workers handling the positions), and engineers (debian can easily be considered an example of the best practices of ISO 9001/ITIL process)

With good intentions.

I used to be a debian sysadmins for 15 years.

I mean, they really are trying their best to : satisfy everyone in choosing the best default conf/options/requirements so that other packages integrates well. The embedded world, x86, ARM, virtualisation.

But I think bureaucracy sometimes ends up like a cancer. Bureaucracy requires to drains part of your effort into its sustainability, and sometimes the energy involved in bureaucracy itself out sucks to much resources for even getting the job done.

I think they try to hard to do what they think the right things. I am not even sure they have a clear view of their monster blob distro.

Mozilla fundation is another new growing tumor in the world of open source. Do we really need to had statefullness over a stateless protocol in order to bring RT in a non realtime-able container ?

When will the brainwashing of the XUL team will end?

NO! the web browser is a terrible substitute for GUI especially in async fashion.

And js is a terrible scripting language for GUI. Tcl/Tk should be back again.