Subject: Re: CVS commit: src/sys
To: Christos Zoulas <>
From: Elad Efrat <>
List: tech-security
Date: 06/24/2007 19:57:18
Christos Zoulas wrote:
> On Jun 24,  7:05pm, (Elad Efrat) wrote:
> -- Subject: Re: CVS commit: src/sys
> | that's exactly what I'm saying: it's there since forever. I don't recall
> | anyone coming up and saying that it's so painful and kauth should be
> | adjusted to support more than 16 groups.
> | 
> | if that were the case, do you think that (1) kauth would not address it
> | since day 1 and (2) I would have ignored it completely for the year+
> | kauth has been in the tree?
> The only reason the 16 group limit was brought up is because dsl's new
> functions hide it inside kauth, whereas before it was exposed. Since the
> limit is not visible anymore, it is conceivable that it will be easier
> to remove the limit in the future.

you know very well that the 16 group thing is a side effect and not a
goal of dsl's changes. I think you are trying to justify the commit
after the fact, rather than focus on the issue that kauth is now broken
because of it.

that is unprofessional, weak, and I'm disappointed that this is what you
choose to do.

like I said, there are two issues here that are orthogonal: simplifying
the compat code, and removing the 16 group limit. if the 16 group limit
is suddenly the biggest problem for netbsd (ridiculous), please back out
the changes and start a thread pointing out:

   - why it is a problem,
   - how you solved it in the past 20 years,
   - why it has become so critical as of yesterday,
   - why exposing kauth internals is the only way to solve it

> | and, I'm asking again: why didn't the changes in question go up for
> | public discussion? and assuming they would have, what do you think would
> | be the consensus?
> Because this is not a perfect world. In retrospect they should have. 

you *still* avoid answering my question of what you think would be the
consensus assuming they would have been discussed. :)

> It
> is not like we post every diff in tech-* before it gets committed. This
> is why we have source-changes; to review the commits and catch issues
> like this one and fix them.

then please change the commit guidelines, and make it clear that commits
that go into the netbsd tree are not peer reviewed and discussed. this
will help people make smarter choices about the operating system they
rely on.