Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shorewall – The End of the Road

sourceforge.net

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Shorewall – The End of the Road

#41

Post by djsumdog »

nerdbaggy wrote: post #33
_wmd wrote: post #4

A project of this popularity and maturity essentially announcing they're shuttering because a single long-term contributor is retiring.. if ever there was a damning indictment of modern consumption-driven open source, I don't know what is

I feel like most open source projects are like that. https://github.com/antirez/redis/pulse/monthly https://github.com/django/django/pulse/monthly https://github.com/moby/moby/pulse/monthly

I don't understand. Everything you linked has multiple authors/contributors. It's the opposite of a sole author.

Re: Shorewall – The End of the Road

#42

Post by ken »

nerdbaggy wrote: post #33
_wmd wrote: post #4

A project of this popularity and maturity essentially announcing they're shuttering because a single long-term contributor is retiring.. if ever there was a damning indictment of modern consumption-driven open source, I don't know what is

I feel like most open source projects are like that. https://github.com/antirez/redis/pulse/monthly https://github.com/django/django/pulse/monthly https://github.com/moby/moby/pulse/monthly

I feel like many non-open-source projects are like that, too. I've worked on more than one corporate project where the original programmer was the only person who really understood how half of it worked, and still wrote most of the code. When he left, the project died.

Re: Shorewall – The End of the Road

#43

Post by dmix »

kiallmacinnes wrote: post #20
sadris wrote: post #18

Earlier quoted context omitted.

It's just a wrapper around iptables...

Wrapper or not, building a wrapper that works for as many use cases for as long a time as Shorewall has is something. Frankly, it sounds like your suggesting that because he didn't invent the underlying network stack, or network protocols, that makes it a quick and dirty half day or so project. 99.9% of development work in recent years hasn't been inventing new stuff, it's been building wrappers. Wrappers that compos…

All software is built on abstractions. I’m sure IPTablss is a giant “wrapper” around the Linux OS networking stack.

Nothing wrong with a wrapper of the underlying system has had the real world field testing, longetivity, and adoption that IPTablws has.

Re: Shorewall – The End of the Road

#44

Post by densone »

Yes this is a wrapper and it persisted iptables well. But for anyone that says shorewall is just a wrapper, probably just skimmed a manual and don’t understand the real genius here.

what shorewall really did was make iptables feel like a polished usable firewall. iptables on its own is shit to work with. shorewall made it easy to use in so many cases.

congrats on your retirement and thanks for a great tool that I used for many years.

Re: Shorewall – The End of the Road

#45

Post by tylerjl »

pard68 wrote: post #23
albeec13 wrote: post #13

Welp. I recently completed an Arch-linux and PCEngines-based DIY router build and stumbled upon Shorewall as an alternative to straight-up IP tables... I'm not looking forward to changing this setup.

I stumbled across a blog post that used Arch and Shorewall to roll a diy router. Any chance you used a blog post for inspiration and if so do you have the link still? I have been trying to find it ever since...

Was it my blog post? https://blog.tjll.net/building-my-perfect-router/

Re: Shorewall – The End of the Road

#46

Post by sliken »

sadris wrote: post #19
ansible wrote: post #8

Earlier quoted context omitted.

It is possible the maintainers of the various OS distribution packages will band together and maintain development. BTW, what's the general recommendation for people looking to migrate to another Linux firewall package?

iptables-persistent on Debian. Or iptables-services on redhat

Bleah, iptables is rather hostile. Sure, you have a webserver, add a rule to allow TCP over 80. Later you revisit, decide you need to add 443. So you do the obvious and change "80" to "80,443". Which fails. Turns out there's a completely different way to match multiple ports. Or you could write a rule per port... making mistakes much more likely and much harder to spot.

Re: Shorewall – The End of the Road

#47

Post by pferde »

sadris wrote: post #18
farisjarrah wrote: post #15

Earlier quoted context omitted.

Just think about the networking changes that have happened in the last 50 years. This guy is insane to have lived through, and engineered against soo many changes in computer networking. I mean... If you are looking back at this guy's career, you need to realize, to this guy, Linux is a young whipper snapper of an OS. Megabit-speed networks werent even really a thing until this guy was like in his late forties or som…

It's just a wrapper around iptables...

Yes, and penicillin is just a pill that kills some bacteria.

Re: Shorewall – The End of the Road

#48

Post by nullandvoid »

j45 wrote: post #35
merlincorey wrote: post #2

Very impressive that this software was built and maintained by a mostly solo developer into their 70's. Talk about software lifecycle. I wonder if there is much of a community around this software and if there is someone who may take over the future direction, much like how Emacs' head maintainership was recently (relatively) given up by RMS.

How is it impressive because of age?

Because it goes against the rhetorical that tech is a "young persons" game that many of the large tech companies seem to imply.

On a side note whilst many people fail to deliver a side project they have spent a few months developing this man has been released and developing his for 20 years which I believe is praise worthy

Re: Shorewall – The End of the Road

#49

Post by scarejunba »

_wmd wrote: post #4

A project of this popularity and maturity essentially announcing they're shuttering because a single long-term contributor is retiring.. if ever there was a damning indictment of modern consumption-driven open source, I don't know what is

What’s modern about it? The guy has been at it for twenty years. And it’s always been this way.

Re: Shorewall – The End of the Road

#50

Post by vukk »

neosavvy wrote: post #6

Man I think I used this software back when I was working out of my closet back in 2004 trying to finish school. This was a nice abstraction on top of IPTables. I definitely remember screwing up rules which caused me to have to drive to the data center about 15 miles from my house after kicking myself out of machines I was SSH'd into.

First thing on shorewall was always to set ADMINISABSENTMINDED=Yes :)
Post reply on HN