duncaen
Joined 8 years ago
Karma
107
Submissions
28
Member since
May 1
Recent submissions
Comment · 5 years ago
What extra steps? Arch is missing debug packages, a package manager that can detect bad partial updates, different architectures etc.
Comment · 5 years ago
Regex to parse lisp expressions?
Comment · 5 years ago
This is not what happened according to them:
https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....
> (4). Once any maintainer of the community responds to the email, indicating “looks good”, we immediately point out the introduced bug and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our proper patch. In all the three cases, maintainers explicitly acknowledged and confirmed to not move forward with the incorrect patches. This way, we ensure that the incorrect patches will not be adopted or committed into the Git tree of Linux.
Comment · 5 years ago
See page 9 of the already published paper:
https://raw.githubusercontent.com/QiushiWu/qiushiwu.github.i...
> We send the emails to the Linux communityand seek their feedback. The experiment is not to blame any maintainers but to reveal issues in the process. The IRB of University of Minnesota reviewed the procedures of the experiment and determined that this is not human research. We obtained a formal IRB-exempt letter. The experiment will not collect any personal data, individual behaviors, or personal opinions. It is limited to studying the patching process OSS communities follow, instead of individuals.
Comment · 5 years ago
I would say that the concept and implementation in C is inherently insecure. Switching to something less reviewed because there is a sudo vulnerability is not a guarantee that you are now "safer" especially if those ports are not reviewed.
As far as I can say, never ever use slicer69/doas, I've found 3 critical security vulnerabilities in it, the author does not understand C or how it should work in general.
Here are 3 examples if issues I found and the author used misleading commit titles to hide the issues and made excuses saying a clear buffer overflow very similar to the one found in sudo is just "potential":
- https://github.com/slicer69/doas/commit/261c2164496dbebe6e3e...
- https://github.com/slicer69/doas/commit/2f83222829448e5bc4c9...
I even had to do a PR myself to fix an issue the author was not able to understand and more and more people started to use it:
Comment · 6 years ago
1. Void Linux doesn't claim its BSD inspired, BSD inspired could mean 100 different things.
2. runit is not a "sysv-style" init, its the complete opposite. runit is a supervisor and inspired by daemontools. A "rc init" is more closely related to "sysv-style" than runit is.
3. > I like OpenBSD's init system: super simple and best of all, no bs runlevels!
Runit has no runlevels, can actually automatically restart services when they die, can signal services without relying on pid files (which are prone to race conditions) and can create a pipe between a service and a log service that will never lose any logs.
Comment · 6 years ago
Not gentoo. I think you are thinking of chromeos.
Comment · 7 years ago
The size for `sockaddr_storage` is not defined by POSIX, but `sockaddr_un` is defined, and you can't just change the `sun_path` to a pointer, so to increase `sun_path` you would have to increase the `sockaddr_storage` struct size.
This comes with other downsides, first is incompatibility with other OSes, most OSes seem to be around 104-109 bytes.
Second new problem would be that with any larger value each socket call would have to copy more data, even if they are not unix sockets. If you change it to something that looks sensible like `PATH_MAX` you end up increasing memory requirements for any application that works with sockets.
Comment · 7 years ago
Not really.
From this German article[0]:
> Knoppix' Startvorgang läuft nach wie vor per Sys-V-Init mit wenigen Bash-Skripten, welche die Systemdienste effizient sequenziell oder parallel starten.
> Knoppix' boot sequence still uses Sys-V-Ini, with some bash scripts which start the system services efficiently sequential or in parallel.
So it has still all the downsides of sysvinit, except that might start sevices in a more efficient order or some in parallel.
[0]: https://www.golem.de/news/live-linux-knoppix-8-0-bringt-mode...
Comment · 7 years ago
If production is servers, then alpine is the better choice as it provides stable releases.
Void Linux is a nice desktop system and you can run it on single servers you personally take care of.
But I would rather not use it at scale for servers as updating rolling release can always lead to issues and not updating will leave security issues unfixed.
The one benefit would probably providing a glibc version if you require it.
(I'm a Void Linux contributor.)
Comment · 7 years ago
Most websites don't have redundant servers but its still there and used by a lot of big sites.
The whole point of it is to connect to multiple A and AAAA records with a very short delay (250ms in chrome). The browsers use poll to get notified about the first established connection and then use it. So if one A/AAAA records IP is unreachable or slow it will use a another one. There will be no fallout (except maybe for clients that don't use something like happy eyeballs, but any browser does that) if you have multiple A/AAAA records and one of them is down.
[ my public key: https://keybase.io/duncaen; my proof: https://keybase.io/duncaen/sigs/an9O2dncEHKC5cX8gtegGbytGvzYGEnprTgXjzRIorU ]