<div dir="ltr"><div dir="ltr">On Sun, Feb 20, 2022 at 1:08 AM Heiko Becker <<a href="mailto:heiko.becker@kde.org">heiko.becker@kde.org</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
On Saturday, 19 February 2022 10:11:06 CET, Ben Cooksley wrote:<br>
> It has recently come to my attention that some distributions have missed<br>
> emails sent to this list recently regarding issues with Discover/KNS. As<br>
> these issues are rather critical I am now requiring all distributions to<br>
> explicitly acknowledge receipt of these emails and to declare the actions<br>
> they have taken. As a reminder, end-user systems without these patches are<br>
> participating in a distributed denial of service attack on KDE.org<br>
> infrastructure.<br>
><br>
> The two emails which distributions need to keep in mind are:<br>
> - <a href="https://mail.kde.org/pipermail/distributions/2022-February/001140.html" rel="noreferrer" target="_blank">https://mail.kde.org/pipermail/distributions/2022-February/001140.html</a><br>
> - <a href="https://mail.kde.org/pipermail/distributions/2022-February/001142.html" rel="noreferrer" target="_blank">https://mail.kde.org/pipermail/distributions/2022-February/001142.html</a><br>
<br>
Exherbo already has 5.24.1/5.91.0 and while I don't have numbers, I suspect <br>
our Discover installations are not that frequent anyway, due to missing <br>
package kit support for our package manager and our technical target <br>
audience.<br></blockquote><div><br></div><div>I took a sample yesterday for a period just short of 2 minutes and received the following results:</div><div><br></div><div><span style="font-family:monospace"><span style="color:rgb(0,0,0)"> 1 "KNewStuff/5.88.0-discover/5.23.5"
</span><br> 1 "KNewStuff/5.89.0-discover/5.23.4"
<br> 1 "KNewStuff/5.89.0-discoverupdate/5.23.5"
<br> 1 "KNewStuff/5.90.0-systemsettings/5.23.5"
<br> 2 "KNewStuff/5.90.0-discoverupdate/5.24.0"
<br> 2 "KNewStuff/5.90.0-kpackage-knshandler/5.90.0"
<br> 6 "KNewStuff/5.90.0-discover/5.23.5"
<br> 10 "KNewStuff/5.86.0-discover/5.22.5"
<br> 13 "KNewStuff/5.86.0-discoverupdate/5.23.2"
<br> 29 "KNewStuff/5.88.0-plasma-discover-update/"
<br> 245 "KNewStuff/5.88.0-discoverupdate/5.23.5"
<br> 296 "KNewStuff/5.90.0-discoverupdate/5.23.5"
<br> 9082 "KNewStuff/5.86.0-plasma-discover-update/"
<br> 10215 "Mozilla/5.0"<br></span></div><div><br></div><div>As can be seen, KF 5.86 is still by far the dominant group, along with Mozilla/5.0 (which means these end user systems are running Frameworks prior to 5.87 - the only reason we see 5.86 is because Ubuntu patched their packages to include the changes added in 5.87). Note that this is a legacy endpoint which clients shouldn't be communicating with, so the above really should be nil but it appears that updates are starting to take effect for the other groups as I do recall them being more prevalent previously.</div><div><br></div><div>If any distributions currently support versions prior to 5.87 please look at least into backporting the *.knsrc changes (which are just URL/data changes - no code) as those will shift the load to our CDN from the main <a href="http://download.kde.org">download.kde.org</a> redirector at least for those users.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Regards,<br>
Heiko<br></blockquote><div><br></div><div>Thanks,</div><div>Ben </div></div></div>