Re: [Koha-devel] RSS method for checking and warning about current installed version
At 08:55 PM 12/3/2013 -0200, Tomas Cohen Arazi wrote:
My main concern is people having Koha instances that already reached EOL and/or are not supported anymore. How to do it is the topic in discussion. I like the idea of a button (maybe in the form of a tab in the about page ;-) and maybe with a disclamer notice and a confirmation button). Having a syspref defaulting to "disabled" could work if this is troublesome in several jurisdictions.
I'm referring to professionals who know full well what they are doing with their library systems, we don't need the security implications of any "preference" having external file editing capability. If amateurs need reminding, that's another question that should be available during installation, not afterwards. Look around the landscape: does perl, or apache, or mysql, or zebra, or etc, etc... do this? You say "could work" -- I'm suggesting that security must be bullet proof. As far as I'm concerned, this avenue should be blackballed for a standard install/upgrade. It's just the thin end of the wedge towards other intrusions. Best regards -- Paul
Regards To+
On Tue, Dec 3, 2013 at 7:46 PM, Paul A <<mailto:paul.a@navalmarinearchive.com>paul.a@navalmarinearchive.com> wrote: At 07:48 AM 12/4/2013 +1300, Chris Cormack wrote:
On 4/12/2013 6:38 am, "Tomas Cohen Arazi" <<mailto:tomascohen@gmail.com>tomascohen@gmail.com> wrote:
What would you think of adding some way for the
<http://about.pl>about.pl page to load information on newer versions available, or even if the currently used branch has reached EOL?
I like this idea, assuming it is an opt in option. (and easily switched off again too) Chris
Tomás, please tell me that this does NOT involve instances of Koha attempting, unsupervised, to contact an external website.
Thanks and best regards, Paul
_______________________________________________ Koha-devel mailing list <mailto:Koha-devel@lists.koha-community.org>Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : <http://www.koha-community.org/>http://www.koha-community.org/ git : <http://git.koha-community.org/>http://git.koha-community.org/ bugs : <http://bugs.koha-community.org/>http://bugs.koha-community.org/
-- Tomás Cohen Arazi ProsecretarÃa de Informática Universidad Nacional de Córdoba â +54 351 4333190 ext 13168 GPG: B76C 6E7C 2D80 551A C765  E225 0A27 2EA1 B2F3 C15F
On Tue, Dec 3, 2013 at 8:35 PM, Paul A <paul.a@navalmarinearchive.com>wrote:
At 08:55 PM 12/3/2013 -0200, Tomas Cohen Arazi wrote:
My main concern is people having Koha instances that already reached EOL and/or are not supported anymore. How to do it is the topic in discussion. I like the idea of a button (maybe in the form of a tab in the about page ;-) and maybe with a disclamer notice and a confirmation button). Having a syspref defaulting to "disabled" could work if this is troublesome in several jurisdictions.
I'm referring to professionals who know full well what they are doing with their library systems, we don't need the security implications of any "preference" having external file editing capability. If amateurs need reminding, that's another question that should be available during installation, not afterwards.
Look around the landscape: does perl, or apache, or mysql, or zebra, or etc, etc... do this?
I'll bet your favorite browser has the option to notify you of updates. Furthermore, I'll bet you allow it to. The last time I did a fresh Ubuntu install, (a few weeks ago) I was offered the option of automagic updates (either full or just security). I'd bet Debian has this option too (probably other distros as well). So I'm not sure I see the sky falling yet. Not to knock security concerns, but this is well established practice as far as I can see. And I think that's the sort of thing we're talking about here. FTR: I'd love to see some sort of notification system implemented. Kind Regards, Chris
Christopher Nighswonger schreef op di 03-12-2013 om 20:57 [-0500]:
The last time I did a fresh Ubuntu install, (a few weeks ago) I was offered the option of automagic updates (either full or just security). I'd bet Debian has this option too (probably other distros as well).
This is even more common in web things. Wordpress does this, Vanilla (forum software) does, I seem to recall that Gallery does too. -- Robin Sheat Catalyst IT Ltd. ✆ +64 4 803 2204 GPG: 5FA7 4B49 1E4D CAA4 4C38 8505 77F5 B724 F871 3BDF
Christopher Nighswonger wrote:
The last time I did a fresh Ubuntu install, (a few weeks ago) I was offered the option of automagic updates (either full or just security). I'd bet Debian has this option too (probably other distros as well).
And I bet debian has it switched off by default - I had to install the unattended-upgrades packages specifically and even then, it seemed to be switched off (have to enable it via the Software Sources program (available in System/Administration). I would prefer Koha to have something like About: Check for Updates, rather than any set-by-default feature. Hope that informs, -- MJ Ray (slef), member of www.software.coop, a for-more-than-profit co-op http://koha-community.org supporter, web and library systems developer. In My Opinion Only: see http://mjr.towers.org.uk/email.html Available for hire (including development) at http://www.software.coop/
participants (4)
-
Christopher Nighswonger -
MJ Ray -
Paul A -
Robin Sheat