Viewing profile — gnoack

Yes, "en-bugging" :)

+1 It is also a testament to solid engineering and attention to good security practices in general. These still work, also against fancy new AI attackers. When sophisticated attack…

How does this change the point that is being made in the article? Your agent is also only taking one of the existing roles that humans today occupy (e.g. the software operator or d…

Those are pathname UNIX domain sockets, so you address them through the socket file, which is conventionally stored somewhere under /run. You can run "netstat --listening --unix" t…

I think you are misrepresenting this; Varlink is based on much more conventional UNIX technology than Dbus, which is decades old: You connect to a named UNIX socket through its soc…

Etoile had its own Smalltalk dialect back in the day, Pragmatic Smalltalk. This was a Smalltalk based on the Objective-C runtime, based on an OMeta implementation and a LLVM backen…

CDE was open sourced a while back: https://sourceforge.net/projects/cdesktopenv/

Absolutely, seccomp is also an unprivileged sandboxing mechanism in Linux. It does have the drawback however that the policies are defined in terms of system call numbers and their…

Landlock is currently still lacking some wrapper libraries that make it easier to use, in C. We do have libraries for Go and Rust, and the invocation is much more terse there, e.g.…

The way I interpreted most of these "subclassing" cases in the GoF diagrams was actually as "subtyping", and then it makes more sense. Regarding no one having a lock on the term "d…

It's tracked in https://github.com/landlock-lsm/go-landlock/issues/35 - signals and abstract Unix sockets do unfortunately not interact well with the inherently multithreaded Go ru…

+1 A rough description of upcoming network restriction features in Landlock and how they map to the BSD socket API is in the talk at https://youtu.be/K2onopkMhuM?start=2025 startin…

(Author of go-Landlock here) Awesome! I'm happy to hear that you and others are interested in the configuration language. We should probably coordinate that on the Landlock mailing…

OpenBSD did get it right, but they also have a more relaxed scheme for backwards compatibility across releases. Linux's strict ABI compatibility guarantees complicate matters sligh…

(Author of that library here) It is a library, as already linked in the other comment: https://github.com/landlock-lsm/go-landlock The landrun tool is built on the same library. We…

Exactly, for resource limits you can use setrlimit(2) or cgroups if needed.

(Landlock reviewer here) Namespaces can also be used for sandboxing, but they have a series of problems. Most importantly, they require more substantial changes to your program tha…

I ended up building my own Wiki in Go at some point, although I use this mainly for my own smaller purposes. Description and demo instance at: https://wiki.gnoack.org/UkuleleWeb It…

I find this an offensive comment. The GIGO principle applies to documentation, and we would be in a much worse place if we didn't have the man page documentation written and review…

It is not the Debian package maintainer stepping down here, but the project maintainer.

This is the project that maintains the user-facing documentation for Linux itself. Anyone who does system administration on Linux, who uses the command line, or who programs in C i…

I think this is a big misinterpretation of that Alan Kay quote, which was in response to https://news.ycombinator.com/item?id=11941656 - the author of that comment aims to create a…

In "UNIX - A History and a Memoir", Brian Kernighan is telling the story of doing that in 1972 (chapter 4.5, about "Grep") grep '^[behilos]*$' /usr/dict/web2