From 2b57710fbbae22e74b053a3283ff8b51d4a309e8 Mon Sep 17 00:00:00 2001
From: Joanna Rutkowska <joanna@invisiblethingslab.com>
Date: Thu, 5 Dec 2013 10:18:50 +0000
Subject: [PATCH] SoftwareUpdateVM changed

Correct inaccuracies and handicapped logic in the last edit
---
 SoftwareUpdateVM.md | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/SoftwareUpdateVM.md b/SoftwareUpdateVM.md
index 1bf7c8a0..60e18d36 100644
--- a/SoftwareUpdateVM.md
+++ b/SoftwareUpdateVM.md
@@ -89,6 +89,4 @@ qvm-create <vmname> --template <templatename> --label <label>
 Temporarily allowing networking for software installation
 ---------------------------------------------------------
 
-Some applications cannot be installed using the standard yum repositories, and need to be manually downloaded and installed. These applications are less secure. So it is recommended to install them only in a Standalone VM.
-
-When the installation requires internet connection to access repositories, it will not complete because Standalone VM firewall rules only allow connection to standard yum repositories. So it is necessary to modify firewall rules to allow internet access. Of course, as soon as software installation is completed, firewall rules should be returned to the default state.
+Some 3rd party applications cannot be installed using the standard yum repositories, and need to be manually downloaded and installed. When the installation requires internet connection to access 3rd party repositories, it will naturally fail when run in a Template VM because the default firewall rules for templates only allow connections to standard yum repositories. So it is necessary to modify firewall rules to allow less restrictive internet access for the time of the installation, if one really wants to install those applications into a template. As soon as software installation is completed, firewall rules should be returned back to the default state. The user should decided by themselves whether such 3rd party applications should be equally trusted as the ones that come from the standard Fedora signed repositories and whether their installation will not compromise the default Template VM, and potentially consider installing them into a separate template or a standalone VM (in which case the problem of limited networking access doesn't apply by default), as described above.