CanaryLayout

TL;DR: force them to learn not just systemd, ld, but also all of pthreads and the go runtime itself

IBM could sell the future of the on premises z/xxx boxes as "datacenter in one rack"

Running x86 in z/VM has been a discussion for 25 years. Just fucking do it. Let people run whatever they want.

Just as people are excited about ARM for low-watt computing, make s390x just as exciting for people who want insane vertical resources but using the same dev tools that are used now for easy x86/ARM crossover.

But IBM culture has always been about overcharging a small and rich audience and now they are sitting around hocking their services cohosted thru AWS and everyone who has COBOL and 360ASM running are doing retirements with no plans to use the boxes after its all unloaded.

And no, the paywalled IBM Cloud LPARs are a joke.

The mainframe is not a special thing anymore, hasn't been since the late 90s. It's just a server box.

I work at a shop with a z/14. I would love it if we finished the last COBOL retirements and go back to the mainframe but this time to run container farms, fresh Go code, and use thr power to run way deeper matrices of tests that take days to run locally and cannot afford to run on AWS.

If IBM weren't hostile to the Hercules project and allowed local licensing to run z/OS, CICS, IMS and DB2 on it, perhaps more hobbyists would want to careerpath themselves on to the s390 architecture.

I do love the s390 arch and the massive IO hardware over there, but IBM has paywalled down entry so hard that there is no audience.

They even went to the trouble of making Go binaries transportable for direct execution under z/OS. But if you want new people to write code on the platform you need to make access to the platform a thing.

Oh God why.

even easier is to STOP HOSTING SSHD ON IPV4 ON CLEARNET

at minimum, ipv6 only if you absolutely must do it (it absolutely cuts the scans way down)

better is to only host it on vpn

even better is to only activate it with a portknocker, over vpn

even better-better is to set up a private ipv6 peer-to-peer cloud and socat/relay to the private ipv6 network (yggdrasil comes to mind, but there's other solutions to darknet)

your sshd you need for server maintenance/scp/git/rsync should never be hosted on ipv4 clearnet where a chinese bot will find it 3 secs after the route is established after boot.

This does not matter either. The attack came in by loading into systemd via liblzma. It put on a hook and then sits around waiting for sshd to load in so it can learn the symbols then proceeds to swap in the jumps.

sshd is a sitting duck. Bifurcating sshd into a multimodule scheme won't work because some part of it still has to be loaded by systemd.

This is a web of trust issue. In the .NET world where refection attacks happen to commercial software that features dynload assemblies, the only solution they could come up with is to sign all the things, then box up anything that doesn't have a signing mechanism and then sign that, even signing plain old zip files.

Some day we will all have to have keys, and to keep the anon people from leaving they can get an anon key, but anons with keys will never get on the chain where the big distros would ever trust their commits until someone who forked over their passport and photos got a trustable key to sign off on the commits, so that the distro builders can then greenlight pulling it in.

Then I guess to keep the anons hopeful that they are still in the SDLC somewhere their commits can go into the completely untrusted-unstable-crazytown release that no instutution in their right mind would ever lay down in production.

any one of us if we sat on the OSSH team would flip the middle finger. What code is the project supposed to write when nothing on main dyn loaded liblzma. It was brought in from a patch they don't have realistic control over.

This is a Linux problem, and the problem is systemd, which is who brought the lib into memory and init'd it.

Exactly. The attack came in by hitching a ride on to systemd.

sshd is not the problem. the ldd/monolith architecture surrounding systemd is.

What if I duplicated this attack but instead targeted dbus or any other thing that systemd is managing?

Yeah Goroutines are great. Then add something like WebRTC to your project that realistically tops out at 10000 listeners, and people wonder why Twitter Spaces is so buggy...

From what I read on masto, the original maint had personal life breakdown, etc. Their interest in staying as primary maint is gone.

This is a very strong argument for FOSS to pick up the good habit of ditching/un-mainlining projects where they are sitting around for state actors to volunteer injecting commits to, and dep-stripping active projects from this cruft.

Who wants to maintain on a shitty compression format? Someone who is dephunting, it turns out.

Okay so your pirate-torrent person needs liblzma.so Offer it in the scary/oldware section of the package library that you need to hunt down the instructions to turn on. Let the users see that it's marked as obsolete, enterprises will see that it should go on the banlist.