From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 38214381DC0F; Sat, 6 Mar 2021 17:51:50 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 38214381DC0F From: "sergiodj at sergiodj dot net" To: elfutils-devel@sourceware.org Subject: [Bug debuginfod/27532] debuginfod should ask the user for permission before downloading files Date: Sat, 06 Mar 2021 17:51:49 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: elfutils X-Bugzilla-Component: debuginfod X-Bugzilla-Version: unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: sergiodj at sergiodj dot net X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: elfutils-devel@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Elfutils-devel mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 Mar 2021 17:51:50 -0000 https://sourceware.org/bugzilla/show_bug.cgi?id=3D27532 --- Comment #2 from Sergio Durigan Junior --- Thanks for the reply, Frank. Yeah, I thought about the good practices, too. My rationale for filing this bug against debuginfod instead of e.g. GDB is that it is more uniform to ha= ve the actual agent who performs the download worry about obtaining permission, instead of having each library user (GDB, perf, etc.) do it. As for the setting of the environment variable being considered consent, on= e of the points raised in the discussion on debian-devel is that, with the way things are implemented now (using a /etc/profile.d/ snippet), the user will likely not be aware that DEBUGINFOD_URLS is set unless she herself was the = one who installed the system. Also, and arguably, DEBUGINFOD_URLS's purpose is just to specify which debuginfod servers should be consulted, not if it is = OK to do the actual request. Anyway, I'm not opposed to the idea that it is the actual library user who should obtain explicit user consent here. In a way, you could even consider that libdebuginfod is a wrapper around libcurl, and I totally agree that the library should implement the mechanism and that its clients should implement the policy. --=20 You are receiving this mail because: You are on the CC list for the bug.=