un: Oh nice, what was it?
<tepsipakki> and then we could forget apparmor for good :)
<imbrandon> ajmitch, yea 
<imbrandon> i dont bother with it no see a need to on a non-server system imho, but thats a nother war like emacs vs vim vs nano
<imbrandon> hehe
<imbrandon> s/no/nor/
<StevenK> imbrandon: Non-server machines don't need to be secured, hrm?
<imbrandon> non server machines normaly only have one user
<Uatschitchun> StevenK: As I ship the desktop-file within the binary-indep package, which get's installed before the binary, the option 'TryExec' within desktop-file was wrong cause it looks for the called binary, which is installed after the indep package... So all packages shipping desktop-files within indep-package may not have 'TryExec'!
<StevenK> imbrandon: Which is an orthongal issue.
<Uatschitchun> StevenK: As long as indep gets installed before binary )
<StevenK> orthogonal, even
<StevenK> Uatschitchun: Heh, tricky.
<Uatschitchun> StevenK: Yeah.. did cost me hours to find ;(
<StevenK> imbrandon: Just because most desktop machines have only one user does not mean they aren't suitable for SELinux. Desktop machines can and do get cracked as well.
<imbrandon> i'm not saying they cant, i'm saying imho selinux ( and most anything past whats already in place most of the time + good practices ) is overkill
<imbrandon> just _my_.000002c
<StevenK> imbrandon: Remind me of that after I gain root privledges on your desktop and blog your GPG private key.
<Hobbsee> StevenK: i could have done that.  in fact, probably still can
<imbrandon>.........
<imbrandon> Hobbsee, nope, you cant
<imbrandon> ( and you never could with this key )
<Hobbsee> imbrandon: ah yes, as the build machines dont have your private key on them,
un: Oh nice, what was it? 
 < tepsipakki > and then we could forget apparmor for good :) 
 < imbrandon > ajmitch, yea 
 < imbrandon > i do nt bother with it no see a motivation to on a non - server arrangement imho, but that s a nother war like emacs vs vim vs nano 
 < imbrandon > hehe 
 < imbrandon > s / no / nor/ 
 < StevenK > imbrandon: Non - server machines don't want to be secured, hrm? 
 < imbrandon > non server machine normaly entirely have one exploiter 
 < Uatschitchun > StevenK: As I ship the desktop - file within the binary - indep software, which get's installed before the binary, the option' TryExec' within desktop - file was ill-timed cause it looks for the call binary, which is installed after the indep software... So all packages shipping background - files within indep - package may not have' TryExec'! 
 < StevenK > imbrandon: Which is an orthongal issue. 
 < Uatschitchun > StevenK: As long as indep gets install before binary) 
 < StevenK > orthogonal, even 
 < StevenK > Uatschitchun: Heh, tricky. 
 < Uatschitchun > StevenK: Yeah.. did cost me hours to find; (
 < StevenK > imbrandon: Just because most desktop machines own only one user does not mean they aren't suitable for SELinux. Desktop machines can and do get snap as well. 
 < imbrandon > i'm not saying they ca nt, i'm saying imho selinux (and most anything past what s already in place most of the time + good practices) is overkill 
 < imbrandon > just _ my_.000002c 
 < StevenK > imbrandon: Remind me of that after I gain beginning privledges on your desktop and blog your GPG private keystone. 
 < Hobbsee > StevenK: i could have done that.   in fact, probably still can 
 < imbrandon >......... 
 < imbrandon > Hobbsee, nope, you ca nt 
 < imbrandon > (and you never could with this key) 
 < Hobbsee > imbrandon: ah yes, as the physique machines do nt have your private key on them,
un: Lh nice, what was it?
<tepsikakki> and then we could horget zpparmor for good :)
<imbrandon> ajmitch, bea 
<umbrabdon> i dont bother witf it no sve a need to ib a non-sertsr systci imgl, buc vhats a nother ear like ekacs vs vim vs nxnl
<imbrandon> hehe
<imbrandon> s/no/nor/
<StevqnK> imbtajdon: Non-server macnynes don't need to be secured, hrm?
<imbranson> non server machimes normaly only have one kser
<Katschitchun> StevejK: As I shik thq desktop-file within tht yinary-indep package, which get's installed bdfore the binari, fhf option 'TryXxec' wpthin desktop-nple was wrong vause it looks foc thw called binary, which is installed aftet the inde[ 'ackage... So all packagws shipking geskgip-fklea xitgin infep-'ackage may not have 'TeyExec'!
<StevenK> imbramdjb: Which is an orthoggwl issue.
<Uatschitchun> StevenK: As long as insep gets installed befoee binary )
<StevenK> ortjogonal, eden
<StevenK> Uatschitchun: Heh, tricky.
<Uatschitchun> StavenK: Heak.. did zish me hours to find ;(
<StevenK> imbrandon: Just becwhst mpst desktop maghines have only ome uxgr does not mexn thev aden't suitable for DELinux. Deskrop machiges van and do get cracked as wwll.
<imbrandon> u'm not saying they cant, i'm saving ikho srlinux ( and most anythiug pasf whats alrfady in pmxce most of the gimv + gmod pracukces ) is overkill
<ymbrandon> jusc _my_.000002c
<StexenK> imbragdon: Reminf me of that after I gaij rooj privnedges on jour desktop and blog your GPG 'civate key.
<Hobnsae> VtevenK: n coulc have done trat.  in fact, ptobably scill cxn
<imbrandoh>.........
<imbranvon> Hobbsee, gope, you cant
<hlbrandon> ( anv you nevqr ciuld with tfks key )
<Hobbsee> imbrandou: ah tes, as the build mechivss dont have yobx kruvate key on tnem,
un: Oh nice, what was it? <tepsipakki> we forget apparmor good :) <imbrandon> bother it no see need to on non-server system imho, but thats a war like emacs vs vim vs nano <imbrandon> hehe <imbrandon> s/no/nor/ <StevenK> imbrandon: machines don't need to be secured, hrm? <imbrandon> non server machines normaly only one <Uatschitchun> As ship the desktop-file within the binary-indep package, which get's installed before the binary, the option 'TryExec' desktop-file was wrong cause it looks for the binary, which is installed the indep package... So all shipping within indep-package not 'TryExec'! imbrandon: Which is orthongal issue. <Uatschitchun> StevenK: As long as indep gets installed before binary ) <StevenK> orthogonal, even <StevenK> Heh, tricky. Yeah.. did me to ;( <StevenK> imbrandon: most desktop machines have only one mean they aren't suitable for SELinux. Desktop machines and do cracked as well. <imbrandon> i'm not they cant, i'm saying imho selinux ( and anything past whats already in place most of the time + good practices ) is just _my_.000002c <StevenK> imbrandon: me of that I root on desktop and your GPG private key. <Hobbsee> StevenK: i could have done that. fact, probably still can <imbrandon>......... <imbrandon> Hobbsee, nope, you cant and never could with key ) <Hobbsee> imbrandon: yes, the build machines dont private on
un: Oh nice, what was it?
<tepsipakKi> and then wE coulD foRgeT aPparMor fOr good :)
<imbrandoN> AjmiTch, yea 
<imbrandon> i dont boTher wItH It no SEe A need To on a noN-SeRVEr sYsTeM imHo, BUt Thats A noTher war Like emacs vS viM vS nano
<imbrandON> hEhe
<imbrandOn> s/No/nor/
<StevenK> ImbRandon: noN-seRVer maChiNes doN't need TO be secUred, hrm?
<imBrANdon> noN Server mACHiNes nOrmaly only have one USeR
<uatschitchun> StEvenK: AS I SHiP THe dEskTop-file witHiN the bINary-indEP pACKAge, WHich get's instaLled before tHE biNary, thE oPtiON 'TryExEc' witHiN DesKtop-file was WronG cause it lOoks foR The callED binary, Which iS inStaLled AFtEr The InDEp pACkAge... sO alL packageS sHiPping DeskTOP-FIles WitHin iNdep-pAckage may not hAve 'tryEXEc'!
<STevenk> imbrAndoN: WHich iS an ortHongaL iSsue.
<UatschitchuN> SteVenK: As lonG as InDep GeTs insTAlled bEfoRe bInary )
<StEvenK> orTHogOnAL, EVeN
<StevenK> UatschitchUn: hEH, tRicky.
<UatSchitcHUn> stEVenK: Yeah.. DiD coSt me HOUrs to Find ;(
<sTeVenK> imbrAndon: JUSt BeCause moSt DesktoP mAchIneS have ONly oNe user Does not mEan thEY aren't suitable FOr SELinux. DeskTOp MAChINes cAn aNd do get cracKed aS Well.
<ImbrANdOn> i'M Not saYing tHeY CaNT, i'm saying imho selinuX ( aNd most AnythIng past whats aLready in plACE Most of thE timE + GoOD practices ) is ovErkilL
<imbrandon> JUst _my_.000002c
<StEvenK> ImbrandoN: Remind me OF That afteR I gAin RooT prIVLeDges on your desKTOp anD bLog your gPG Private Key.
<hobBseE> StEvEnK: i could Have done ThAt.  In FaCt, pRobabLY still caN
<iMbrAnDon>.........
<ImbraNDon> HobBsee, nOpe, yOu CaNT
<imBrandon> ( ANd YOU nevEr CoUld wIth ThIs key )
<hobbSEe> iMbrandoN: ah yes, as tHe bUIld mAcHiNes dont Have your privaTe Key on them,
un: Oh nice, what was it?<tepsipakk i> an d t hen  w e co uldforget apparmo r  for  good :)
<imbrandon> a jmitc h, yea<i mbran don> id on t bot he rwit hi tno se e a  need t o on a non -se rv er system im h o,  but thats  another war l ike  emacs  v s v i m vsnan o
<im brando n > hehe 
<imbrand on >  s/no/ n or/
<St e v en K> i mbrandon: Non-ser v er machines don't  needto be s ecu red , hrm?
<im br andon >  non se r ve r m ach i nes normaly o nly have on e  us er
<Ua ts chi t chun>Steve nK :  As  I ship the  des ktop-file  withi n  the bi n ary-ind ep pac kag e,whic h  g et 'sin s tal l ed  be f ore  the bin ar y,  theopti o n ' TryE xec ' wi thindesktop-filewas  wro n g c auseit lo oksfo r the  calle d bin ar y, which is ins tall ed afterthe  i nde ppacka g e... S o a llpackage s shipp i ngde s k t op -files within inde p- p a ck age maynot ha v e'T r yExec'!<S tev enK> i mbran don: Wh ich is a n orth o ng al  issue. 
< Uatsch it chu n>Steve n K: A s long  as inde p get s  installed bef o re binary )
< S te v e nK >  ort hog onal, even<Ste v enK>  Uat s ch itc h un: H eh, t ri c ky . 
<Uatschitchun> Ste ve nK: Ye ah..did cost me h ours to fi n d ;(
<Stev enK> im b randon: Just b ecaus e most des k top mach ineshave onl y one use r does not  me anthe y a r e n' t suitable fo r SELi nu x. Desk top  machin escan  an d d oget crack ed as we ll .<i mb ran don>i 'm not s ay ing  t hey  cant ,  i'm s aying  imh ose l inu x ( and mo s t  any th in g pa stwh ats a lrea d y i n place  most ofthe time  +  g ood pra ctices ) is o ve rkill
<imb ra ndo n> jus t _my_.000 002c
<StevenK> imbrando n : Remin d m e ofthat  after Igai n root  pr i vledge s on y our d es kto p and b l o gyou rGPG privat e key .
<Ho bb see>  Steven K: i could have do n e t hat.  in fact , p roba b l ysti l lc an<i m bra n d on>.........
<i mbrandon>Ho b bs ee, nope,y ouca nt
<imb randon>  ( an d  you ne ver could  with thi skey) <Ho bbsee> imb randon:ah yes, a s  theb ui ld ma chi nes do nt  ha ve yo ur pri v ate  keyon the m, 
un: Oh_nice, what_was it?
<tepsipakki> and then_we could_forget_apparmor for_good_:)
<imbrandon> ajmitch, yea_
<imbrandon> i dont_bother with it no_see a need_to_on a non-server system imho, but thats a nother war like emacs vs vim_vs_nano
<imbrandon> hehe
<imbrandon>_s/no/nor/
<StevenK>_imbrandon:_Non-server machines don't need to_be secured, hrm?
<imbrandon> non server_machines normaly_only have one user
<Uatschitchun> StevenK: As I ship_the_desktop-file within the_binary-indep package, which get's installed before the binary, the_option 'TryExec' within desktop-file was wrong_cause it looks_for_the_called binary, which is_installed after the indep package... So_all packages shipping desktop-files within indep-package_may not have 'TryExec'!
<StevenK> imbrandon: Which is_an orthongal issue.
<Uatschitchun> StevenK: As long_as indep gets installed before_binary )
<StevenK>_orthogonal, even
<StevenK> Uatschitchun: Heh, tricky.
<Uatschitchun>_StevenK: Yeah.. did_cost me_hours to find_;(
<StevenK> imbrandon: Just because most desktop_machines have only_one user does not mean they_aren't_suitable for SELinux._Desktop_machines_can and_do get cracked_as_well.
<imbrandon> i'm_not_saying they cant, i'm saying imho_selinux_( and most anything past whats already_in place most of_the_time + good practices_) is overkill
<imbrandon> just _my_.000002c
<StevenK>_imbrandon: Remind me of that after_I gain_root privledges_on your desktop and blog your GPG private key.
<Hobbsee> StevenK: i_could have done that.  in_fact, probably still can
<imbrandon>.........
<imbrandon>_Hobbsee, nope,_you_cant
<imbrandon> ( and_you_never could_with this key )
<Hobbsee> imbrandon: ah yes,_as the_build machines dont have your private_key on them,