Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What do you want to see in Debian 10 (“buster”)?

news.ycombinator.com

Post reply on HN
Print view View original

321–329 of 329 posts

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#321

Post by hultner »

pja wrote: post #225
hultner wrote: post #222

- HEADLINE: Run testing or unstable containers with ease on stable - DESCRIPTION: I would absolutely love a well supported container system for running testing/unstable in a container. I feel that docker requires a lot upfront work with mixed results. We often develop software using packages of the next debian version (such as Python 3.6) and these packages aren't always available in backports or otherwise outside of…

I know it’s not as lightweight as a container system, but I’ve had quite good experiences on this front with virt-manager (and it’s associated command-line tools virsh, virt-install et al). It’s straightforward to spin up fresh local virtual machines, and you get access to the full KVM infrastructure if you need it.

That is what I've been using as well but it would be nice with a more lean and lightweight system. Otherwise virsh, etc is really good, much more reliable then Docker from my experience.

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#322

Post by zeroheure »

HEADLINE: improve Rescue Mode in debian-installer

DESCRIPTION: How to help users who got problems installing Debian ? The bug reports against d-i shows that problems are various and unpredictible. So the only way to help is to provide tools for looking around documentation and breaking system.

1. in d-i itself : if something goes bad, propose to save logs (and others output like disk informations) on usb key, on the network, on the internet, etc.

2. add some urls where user can found help

3. look for little improvements when launching Rescue Mode : for example access it through ssh, display disk information (remember this patch bug#798465 ?), suggest some config files and log to look in, etc.

4. provide basical help on d-i tools. For example, why grub-installer can't show 2 lines about options ?

5. everything that can't be achieved because of limited space or Ram should be available in a dedicated page on debian.org

Etc.

These are just selected samples. There is many little rooms for improvements on this point.

DISTRIBUTION: stable and sid

ROLE: sysadmin

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#323

Post by aleden »

heftysync wrote: post #282
aleden wrote: post #188

- HEADLINE: port pledge(2) from OpenBSD - DESCRIPTION: Debian has been a great source of innovation and leadership within the OSS world. Make the next big move by adopting pledge(2) from OpenBSD to be the first major mandatory security feature on Linux. There is little hassle in making programs use it, and the LOC in the kernel is tiny compared to say SELinux. See [1] for more details. [1] http://www.openbsd.org/pape…

This isn't as easy as it sounds. Pledge works in OpenBSD because OpenBSD is simple and all of the necessary code lives in one tree. Pledge is supported in the vast majority of OpenBSD base programs but very few ports. If programs aren't written in a careful manner or with an eye to privsep, you end up with pledges that don't protect much since they are so broad. There are a lot of programs you can't pledge even with…

These are good points. However unlike SELinux / AppArmor, a Debian package maintainer does not need to do make sure things are set up right for pledge- programs that aren't pledge'd will run just fine (i.e. all syscalls are allowed by default, not the other way around). So even though adding pledge to the kernel does nothing by itself, can't usermode programs (the ones for which pledge makes since) slowly make themselves more secure?

> It's not impossible for Linux, but there would have to be a lot more conditional cases in the Linux kernel to handle all of the various ways that programs would use it.

Why would there be a lot more conditional cases in the kernel? I'm just imagining having a bitvector whitelist[] for each task_struct and then in the syscall_trace_enter functions one indexes into current->whitelist if it's __NR_pledge.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#324

Post by kasabali »

jopsen wrote: post #306
catdog wrote: post #135

Earlier quoted context omitted.

Debian has reportbug and reportbug-ng.

I know that when I google an error code and somehow find a bug from debian it's always often obscure mailing list archive. If I google a docker error code, I often end up on a github issue.

It is not Debian's fault that Google prioritizes ad ridden mailing list mirror links over the neat & clean bugs.debian.org pages.

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#325

Post by ibaldouy »

rahiel wrote: post #250
ptman wrote: post #223

Earlier quoted context omitted.

Why not SELinux?

Because Debian has already done much work on integrating AppArmor [1]. And Debian based distro's like Ubuntu, Tails, and Subgraph also work on AppArmor so choosing AppArmor over SELinux means overall less work for the Debian community. [1]: https://wiki.debian.org/AppArmor/Progress

SELinux is more secure, flexible and comprehensive, so Debian should adopt it by default... Anyway if AppArmor gets selected by default, I hope I can switch somewhat easily to SELinux if I want to.

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#326

Post by ibaldouy »

kimented wrote: post #320

- HEADLINE: Ask all questions in one go - DESCRIPTION: I like to install Debian on old computers, and the better way to do so is to use the netinstall CD. But the installation is quite long, because of slow network and slow computer. Then, I must watch the computer every few minutes to respond at some questions (which desktop, software options...). Sometime I do not respond, and the installation is stuck for a while.…

This is already done through DebConf, but some packages use it wrong so DebConf can't ask the questions before actually installing the package :-(. If you see some package asking questions in the middle of the instalation instead of at the start, please, file a bug report for it. Thanks!!!

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#327

Post by ibaldouy »

- HEADLINE: 100% SystemD

- DESCRIPTION: Currently many packages still ship without SystemD unit files using LSB init.d scripts instead and of course not using any security measures like private tmp, capabilities, etc...

- DISTRIBUTION: Buster

- ROLE/AFFILIATION: Freelance Linux sysadmin

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#328

Post by EmanueleAina »

falcolas wrote: post #194
majewsky wrote: post #182

Earlier quoted context omitted.

> - It's effectively a black box that nobody but the systemd team really understands; and the response by said team to problems with systemd too often defaults to "you're doing it wrong" I'm seeing this attitude a lot. Just last week, at our Linux User Group meeting, someone brought in a notebook with Debian 9, which didn't boot up correctly because drives were not detected. The issue turned out to be really simple (…

So, the "impossible it was to diagnose anything with systemd" comes about because "systemd-analyze plot" and "journalctl" have no meaning prior to systemd. It's a whole new toolset which needs to be learned. It doesn't follow any existing patterns, which makes it harder to learn if you're already familiar with troubleshooting init prior to systemd (troubleshooting which would have started with a quick trip to /var/lo…

Doesn't that applies to the kernel, libc, openssl, the X server, desktop environments, and web browsers?

Re: Ask HN: What do you want to see in Debian 10 (“buster”)?

#329

Post by kasabali »

oanepackino wrote: post #318

- HEADLINE: Remove Perl and Python as dependencies for the base system - DESCRIPTION: A minimalist default install as a common base for containers, servers and desktops should not depend on interpreters except for a POSIX compliant shell. The FreeBSD project put a lot of effort into removing perl in 2002 and succeeded. - DISTRIBUTION: stable - ROLE/AFFILIATION: Software developer, Germany

Python is not part of the base system (at least it is not installed nor required in minbase debootstrap profile and apt recommends is disabled).

I wholeheartedly agree with removing Perl. Also a lot of other questionable packages in the essential set.

Post reply on HN