Re: Brasero 2.27.91 release

[Joerg Schilling fokus fraunhofer de (Joerg Schilling)]

Pacho Ramos <pacho condmat1 ciencias uniovi es> wrote:

> I am currently using brasero-2.26 with cdrtools 2.01.01_alpha57 under
> Gentoo because mkisofs consumes less RAM that cdrkit one. Brasero works

Using less RAM is just a minor part of the changes. genisoimage is full 
of well known bugs that have been fixed long ago in the original or that
did never exist in the original


> fine with it but, please, take care that I am able to use it with
> cdrtools because Gentoo still ships it, on the other hand, much
> "popular" distributions like fedora, mandriva or ubuntu don't include
> cdrtools, then, it's reasonable that brasero also supports other
> backends like libburnia, cdrkit or cdrdao.

I mentioned before:

libburnia	is nonportable and in addition it is based on a Linux
		specific security risk. Linux allows non-privileged
		users to send some SCSI commands that are needed for 
		very simplified CD writing. For a complete solution
		this still is only _parts_ from what is needed and even
		on Linux, you would need root privileges.

		Other OS security is handled more serious and as a result,
		users of libburnia would need to run suid root. This is
		a no-go for X11 based applications as they are too complex
		in order to audit them against potential buffer overflows
		and other problems.

		Calling carefully audited suid root programs like cdrtools
		is the solution for this security risk. BTW: once Linux 
		implements a complete solution for fine grained privileges,
		support could be added to cdrtools. The related support for
		Solaris is in cdrtools since several years.

		Just another note: this project claims not to include any
		byte from cdrtools. Last weekend, it turned out that this
		is not true. Shouldn't OSS projects be honest to their
		users if they take code from other projects?

cdrkit		is in conflict with the Copyright law and cannot be legally
		distributed. cdrkit in addition is full of bugs. Why would 
		someone like to use it?

cdrdao		does not implement anything that in real world usage could
		give any benefits. If you really need something you believe
		you get from cdrdao, this could be implemented in cdrtools
		soon, just ask...

		BTW: everytime I tried cdrdao because I needed a feature
		that was claimed working in cdrdao but that was missing
		in cdrtools, it turned out that the feature does not
		work in cdrdao. I ended up in implementing the feature
		in cdrecord in these cases....

		The BIN/CUE implementation in cdrdao is much less complete
		than the implementation you get from cdrecord. 

		Cdrdao is no longer actively maintained since ~ 3 years.
		There is a more recent version in the SVN but it does not
		compile anymore.

> Maybe if you work a bit with the problems related with licensing... yes,
> I know that you think that license is fine (I have already read that
> topic in cdrtools webpage), but I think that would be better if all
> (distributions and cdrtools upstream) could find a a point for reaching
> a consensous that would allow to ship cdrtools even on distributions
> with stricter licensing rules.

I do everything I believe I could do....

I informed the Linux distributors that distribute the illegal "cdrkit".

What else do you believe I could do?

The claim that there is a license problem with cdrtools is nothing but 
libel. There never was any legal proof for these claims. 

Note: these claims have been published by people who do not own _any_ even
minimal part of the Copyright in the cdrtools project. These people for this
reason cannot sue anybody. 

Although I don't need to proof that this FUD is really FUD, I did ask the 
Sun legal department to prove that. 


> Please, don't think that I am blaming on you, I simply suggest this as a
> cdrtools user since lots of years (since I was using it with xcdroast
> under Slackware-7.1).

Then you could be interested in helping the cdrtools project to defend against
the attacks from anti-oss companies like e.g. RedHat.

Jörg

-- 
 EMail:joerg schily isdn cs tu-berlin de (home) Jörg Schilling D-13353 Berlin
       js cs tu-berlin de                (uni)  
       joerg schilling fokus fraunhofer de (work) Blog: http://schily.blogspot.com/
 URL:  http://cdrecord.berlios.de/private/ ftp://ftp.berlios.de/pub/schily