[WBEL-devel] Open Letter to John Morris, Beau WBEL members, et al.

[John Morris]

Normally this reply would be off-list, but since you made a public post 
AND drug other private posts on-list.....

On Mon, 15 Dec 2003, donavan nelson wrote:

> Your lack of communication regarding whiteboxlinux.net and certain aspects of
> WBEL have become disturbing to myself and a number of members of the WBEL
> community.  Indirect communication via two proxies is not acceptable.

Define 'unacceptable'.  :)  Don't know who the other 'proxy' is but Jamey
is pretty much an authoratative source.... when I can get him moving in
the right direction that is.....  (he is a volunteer here at the library,
so not exactly someone in the formal chain of command.)  We (being not
only Jamey and myself, but serveral others not on the mailing list) had
been kicking ideas around as to how we wanted to deal with some of these
issues but hadn't really settled anything.  But the note from Jamey was at
my request to have him offload some of this list stuff while the
deathmarch to -final was in the last big push.

> When I first emailed you regarding WBEL (mailed at 11/18/2003 20:38:54
> CST responded to at 11/19/2003 03:08:15 CST), your response was very
> encouraging.
>   You seemed very enthusiastic about WBEL, providing long detailed answers to
> _all_ my questions including my bug report.  At that time or very shortly
> there after, I suggested to you that this was going to go crazy.  And yet, I don't
> think we have even gotten close to critical mass with this project (wait until
> after the final release), but I have to wonder if your enthusiasm for WBEL
> is still as virulent as it was back in Mid November.

I know, you seem to think this will be the next best thing to sliced 
bread, and a great ground floor opportunity.  As in:

> > Are you going to place any restrictions on the ISO images that are
> > produced as "-final"?  Or would you consider it?  Nothing crazy,
> > something along the lines that you can't sell disks with the FINAL isos
> > on them.  But they can be freely downloaded and shared, just not sold.  
> > I'm not certain if such a license exists, but I'm sure it does.

But yes, I was and still am enthusiastic about reports from bug hunters.  
I just didn't have the free time to figure out what the appropriate
reaction should be when someone pops up from nowhere, squatting on the
other two major domains (suprised you missed .info and .biz...) dreaming
grand dreams of turning a small focused project into a major 'community'
destination.  I had a vague feeling of unease, but couldn't find a good
reason to object because the other way to look at the situation was to 
view it as someone jumping in, grabbing the ball and running with it.

Then last week something happened that clarified my thinking.  A similar
tempest in a teapot blew over on another project's list that I follow.  
Specifically, someone on the mythtv list got the notion that without a
webforum, bugzilla, etc, that that project just wasn't going anywhere.  
(sound familiar?)  Well the whole heated debate ended when the project
founder stated bluntly that HE would never participate on a web forum.  
Reason? I suspect I don't have to spell it out to most of this list.  
Reasons I agree with, webforums are slow, klunky, each one is different,
and you have to GO to them.  Email is just there (all too much of it but
that is another rant)  and with a good archive it can be searched and
allows new users to get up to speed.

All that said, if this project gets much traction it has the potential to 
attract a lot of the sort of people who, to put it bluntly, most of us 
would rather went to a webforum to discuss end user sort of issues.  So in 
that view, whiteboxlinux.net will probably have it's chance to serve a 
valuable function.  It could very well totally replace the whitebox-users 
mailing list.

> In addition, myself and others in the community have some additional issues. 
> These include:
> 
> 1) Numerous offers from the community offering various things.  To the
> best of my knowledge, none of these have been accept, and in many cases
> not even acknowledged.

Depends.  Yes I have been shamefully neglectful of my inbox the last 
couple of weeks.  The ones I have been pouncing on most eagerly have been 
bug reports and mirror offers.  (Although I know I have missed replying to 
a couple, but will be digging through the backlog now that the push is 
over.)

> 2) Your lack of response to my private emails, particularly regarding wbl.net.

As stated above, hadn't really figured out what I thought about wbl.net.

> 3) Your lack of communication regarding the future of WBEL.  Are you going to
> do WBEL update 1 when RH releases the first update for RHEL 3?  What are your
> plans when RH releases RHEL 3.x (or RHEL 4)?  We aren't certain if WBEL 3 is
> the product and updates for the next few years is it.

As of now, no on Update 1 as a full release.  I have seen the package list 
over on the taroon mailing list and while it will be a fairly large number 
of errata releases, it is probably best managed as just a bunch of errata.  
As for the next update, who knows.  I do know I wouldn't want to see the 
errata exceed a single CD, so that would be the outside bound on where I'd 
want to stop and respin the base set.

> 4) Who's project is this?  Is this John Morris' WBEL or the communities
> that you created?  Right now if you fell ill, got hit by a bus, or just
> got mad and quit WBEL, I don't think the community would survive.

Guess that depends how useful it is.  If it is useful enough that someone 
else was motivated enough to step forward it would probably survive.  I 
was really tempted to just quote djb here though.  ;)

> I'd like to see some kind of action that promotes the dissemination of
> WBEL core knowledge.  Sure, many of us could reinvent the wheel, but we
> don't want to.

This is planned, and has been discussed previously on the list.  A 
detailed, expanded howto on exactly how to rebuild.

> Several people have expressed concern to me that one person is
> maintaining WBEL and that their companies, thought not scared of using
> an open source distribution, have serious concern about adopting a
> distribution with a community incapable of maintaining and continuing
> the distribution.

That is their problem, not mine.  If they are so unfamiliar with Linux 
that they doubt their ability to, in the event I croak and nobody bothers 
to pick up the baton, rebuild an SRPM when a notice appears on the RH 
mailing list or on LWN then they probably NEED the support services 
offered by Red Hat and should just suck it up and buy RHEL3.

> 5) Have you provided any member of the community a copy of the key used
> to sign the WBEL system?  This entire key issue is also a bigger issue.  
> What are you going sign?

Just a suspicion, but this next statement is likely to arouse cheers from
some, although you probably won't like it.  There are currently TWO copies
of the signing keys.  Both are on CD-R, one is in a rack near my desk for
ready access and the other is in a fireproof datasafe.  One more will
eventually be burned and taken home as an offsite copy.  The passphrase
exists in three places.  My head, an encrypted list of passwords in my
Visor and on a sheet containing all of the system passwords kept
squirreled away here at the library, "in case John gets hit by a bus."

And yes, the issue of what I will sign is a bigger issue and no I don't 
have all of those answers yet.  Wish I did, but it is an important issue 
and needs to be done right.  Security is very easy to screw up and very 
hard to fix after the fact.

I would prefer if a way could be found to make up2date import some 
additional keys as needed, so outside ports could just use their own key 
for binary packages.

Source packages aren't as big of a problem.  All I have to do there is
insist on pristine source + patch, look at the patch and .spec and sign.  
But unless someone can figure a way (hint: can't be done) to confirm a
binary rpm came from a specific source, or a way to cross compile, I
probably shouldn't sign a binary I can't even install and run.

> 6) I was working with a gentleman offering free bandwidth for WBEL if we
> joined the websites and put some banner ads promoting his web hosting
> company.  He stopped talking (emailing) me.  Since you where CC'd on every
> communication between him and myself, did you ask him to stop?  (No, I haven't
> asked him, I don't want to put him in the position of having to answer.)

Nope.

> I'm prepared to put into motion a community driven WBEL website.  This would
> include most of the features available on the current wbl.net site, plus
> several additions:  mainly project collaboration (project management kinda
> crap), several projects, journals (or blogs so people have any easy way to
> provide quick and timely updates), amongst other.

No problem with most of that.  But email is my preferred communication
method so don't expect me to be clicking and drooling my way through a web
based forum very often.  It is just too damned slow and inconvient.  Even
on a local wire most are slow, over the 'net they are horrid compared to
the performace of a local mail client.  I know bugzilla (or other bug
tracking) is helpful as the number of outstanding bugs reaches a critical
mass, but I really hope to avoid that by holding the number of outstanding
bugs in WBEL (as opposed to bugs that also exist in RHEL and can be kicked
into their existing bugzilla) to a minimum.  (famous last words)

> 4. Items 1-3 for IA64 and AMD64, the community needs a place to
> share information for these (sub)projects.

Quite possible the Itanic and AMD64 efforts will generate enough traffic 
to need their own list, but perhaps not.  Depends just how much of a 
horror they end up being to compile.

> For each project plans include, topical forums, bug tracker, request
> tracker, plus other things useful to a project, documentation tiki,
> news, howtos, faqs, etc.  All the stuff integral to a successful
> project.

Not wanting to burst your bubble here, but I'm really hoping WBEL does not
NEED most of that.  Remember, keep the focus.  WBEL is RHEL with the
serial numbers filed off, anything more is dangerous mission creep.  
Request trackers are therefore redundent.  FAQs and howtos beyond
documenting the small but real differences and the rebuild procedure are
also redundant.  Copious documentation for Red Hat Linux/Fedora and RHEL
exists and more is generated daily.  99% of it is directly applicable.

-- 
John M.      http://www.beau.org/~jmorris        This post is 100% M$ Free!
Geekcode 3.1:GCS C+++ UL++++$ P++ L+++ W++ w--- Y++ b++ 5+++ R tv- e* r