Re: [gnome-love] Graphical 'su' utility for GNOME

[Malcolm Tredinnick <malcolm commsecure com au>]

On Tue, Oct 23, 2001 at 04:40:36PM +0200, Hongli Lai wrote:
> I read the last GNOME summary, and it appears that many people
> are looking for a graphical 'su' utility.
> Su today I decided to just port kdesu to GNOME.
> The current version still depends heavily on kdelibs, but it
> use GTK+ for it's GUI and is already useable.
> The source code is here:
> http://members1.chello.nl/~h.lai/gnomesu-0.0.1.tar.bz2
>
> Of course lots of things have to be done before it's finished.
> Any chance that this will be included in a future GNOME release?

Well, like you say, there are a few things that need to be done before
it is finished (some mentioned below), so it would be better to do those
and then see if the app stands on its own as something that could be
included. As an idea, it's useful, but people have tried this before and
there are some problems.

> BTW, is it acceptable for a GNOME program to depend on kdelibs?
> I don't know any GNOME machines that don't have KDE as well.

No, that's a generally bad idea. For example, if somebody was trying to
use GNOME in an embedded application (e.g. a PDA), then you have just
increased the storage requirements by a significant amount by requiring
the core KDE libraries, the C++ runtime support, etc. What is missing
from the GNOME libraries that you need? Secondly, I would disagree with
your observation about always having KDE install. I know a number of
people (including myself) who either don't install KDE initially or
remove it when disk space gets tight or for other reasons (I'm
constantly fighting the disk space battle).

Dependency on KDE libs also requires somebody using your app to not only
track GNOME updates and patches, but also to follow developments in the
KDE world in order to have compatible versions of their libraries
around.

Some other observations...

An 'su' utility needs to run setuid root, introducing all of the
inherent security problems. Previously, there has been advice _not_ to
use ther GTK libraries in a setuid application, since they haven't been
designed or audited for that purpose. That advice may well still apply
-- search some of the gnome-devel and gtk-* mailing list archives for
the relevant threads here.

You possibly have a license conflict in your source code. Libgnome and
the GTK group of libraries are all LGPL and your product requires those
to compile and run. I think that conflicts with part 3(a) of the
Artistic License you have included (IANAL, so draw your own conclusions,
but it seems like you could alter the source and not contribute back
changes just by renaming some things, which is not allowed if the
sources you alter are the LGPL portions). I would rather avoid a license
debate on this list, but that is something you and your fellow
maintainers will need to work out.

Malcolm

-- 
Telepath required. You know where to apply...