Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is Silverblue?

fedoramagazine.org

Post reply on HN
Print view View original

41–50 of 140 posts

Re: What is Silverblue?

#41

Post by bnegreve »

viraptor wrote: post #39
bnegreve wrote: post #29

Earlier quoted context omitted.

On my laptop: How many libraries are loaded: $ sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | wc -l 15429 How many unique library names: $ sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | sort | uniq | wc -l 872 Top 10 most shared libraries: sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | awk '{count[$…

That's a good idea to measure the sharing! Fortunately even if every app gets containerised, not all of those libraries will be duplicated. Specifically each app which forks on its own will still preserve sharing. For example 11 firefox processes I'm running now would share the libraries, whether it's running directly or from docker.

On linux, none of these libraries are duplicated, they are loaded once, and shared across all processes that need them.

Re: What is Silverblue?

#42

Post by pcr910303 »

KUcxrAVrtI wrote: post #17
pcr910303 wrote: post #12

Earlier quoted context omitted.

Not trying to be sarcastic, but opinions like this make me sure that the Desktop Linux won’t fly. > I'm not sure why there is this push for Linux to have the "download and double click" install experience of windows / Mac.

There isn't a desktop any more, we might as well be trying to make Linux for the mini computer if you're chasing the desktop market.

I was meaning consumer-targeted-computers (which includes laptops).

Re: What is Silverblue?

#43

Post by Yuioup »

microtonal wrote: post #33
pkulak wrote: post #5

Earlier quoted context omitted.

They are updated and maintained automatically, even if your distro isn't.

What do you mean by 'maintained' automatically? Many flatpaks use their own custom compiled dependencies that are outdated. I took a frequently-used dependency used to decode untrusted data (ffmpeg). Many Flatpaks on Flathub use outdated ffmpeg versions. Some examples: - VLC ships with a slightly older version of ffmpeg (4.1.3) with two known CVEs: https://github.com/flathub/org.videolan.VLC/blob/f1b27c13b13... - Mak…

Aren't flatpaks sandboxed? Does that help mitigate the risk somewhat?

Re: What is Silverblue?

#44

Post by lifeisstillgood »

I have been working on a similar idea (well ok the concept of an immutable desktop - the tech is completely different) - https://github.com/mikadosoftware/workstation/tree/master/bi...

The article is completely right about this being the future of user OS's - even my half-broke me-ware above has changed how I think about using my laptop - just knowing exactly what is under me is exactly what I have set is ... reassuring.

Being able to know I can try things out and a reboot gets me back to my last known good point is ... well a bit like a video game with savepoints. And there becomes an utter focus on data and non-data. And probably the best advantage is that you ratchet up - every security improvement I think of becomes built in and makes my platform one tiny bit higher

SilverBlue is well worth watching - I say they really are into something

Re: What is Silverblue?

#45

Post by sjellis »

lugg wrote: post #4
saltedshiv wrote: post #3

Earlier quoted context omitted.

Are flatpaks not all sandboxed? I thought the concept of flatpak and snap was that it offered sandboxing in a way what was never implemented to normal repo packages

Flatpak uses kernel namespaces (like docker) to run software with a bundled set of libraries. From their FAQ: > Flatpak mostly deployed as a convenient library bundling technology early on, with the sandboxing or containerization being phased in over time for most applications. I don't really know if sandboxing is worth it for me. Running everything inside docker cotnaienrs sounds like an absolute nightmare when it c…

They are also adding per-application isolation of settings:

https://blogs.gnome.org/mclasen/2019/07/12/settings-in-a-san...

Flatpak is one piece of a broader design to secure Linux workstations. It is also intended to work in conjunction with Wayland and the in-development Pipewire. These lock down video and audio respectively, so that shared resources can't be misused by applications.

Re: What is Silverblue?

#46

Post by garmaine »

microtonal wrote: post #37
garmaine wrote: post #34

Earlier quoted context omitted.

...where? No joke. I seriously don't see desktops running rich applications around anywhere, except the mini-computer / workstation use case. Generally people are running a glorified thin terminal with a browser or putty connection to a dosbox app. People who actually do things on their own computers generally run laptops now. The exceptions are people who do demanding work loads, and they run workstations that can h…

Walk into any random company, there will be many desktops. Sure, some applications are web applications, but they will typically also use Microsoft Office and a smattering of more niche applications. We happen to live across an office tower. People sit and work behind desktops.

Interesting. The offices in the part of the world where I live generally consist of flat surfaces where employees place their company-provided laptops.

The exception is things like receptionists, or other areas where multiple employees share a common terminal. But as mentioned before, those computers are basically used as stationary, large-screen browsers or thin clients for cloud applications. Email? Excel? It's been a decade since I've seen people doing that on desktops in office environments.

Re: What is Silverblue?

#48

Post by barrkel »

bnegreve wrote: post #41
viraptor wrote: post #39

Earlier quoted context omitted.

That's a good idea to measure the sharing! Fortunately even if every app gets containerised, not all of those libraries will be duplicated. Specifically each app which forks on its own will still preserve sharing. For example 11 firefox processes I'm running now would share the libraries, whether it's running directly or from docker.

On linux, none of these libraries are duplicated, they are loaded once, and shared across all processes that need them.

Even when the processes are loading the libraries from different paths, in different filesystems, in different containers? How does it page in data on demand if the first container that loaded the library is killed and its filesystem unloaded?

It's not easy to share libraries across containers, unless they can be built to share a base layer in a stacked union filesystem approach.

Re: What is Silverblue?

#49

Post by 01100011 »

sjellis wrote: post #47

It's worth a moment to give credit to the long defunct Stateless Linux project: https://fedoraproject.org/wiki/StatelessLinux This was imagined a decade ago, but the technology and the market weren't ready then. I am really excited to see it as an actual product.

I'm guessing there are embedded Linux deployments that went this direction even earlier. Read-only rootfs is generally a good idea if you can swing it. You gain the ability to sign the rootfs which is good for security.

Re: What is Silverblue?

#50

Post by paulcarroty »

Concept is interested, but read-only rootfs is stupid, really. It's kind of lock-in.

Of course, ro - great for security, but if something happens with any critical system component like bootloader - I prefer to able patch/fix it myself and don't wait days/weeks for distmakers.

Clear Linux use similar concept, but they allow write access and handle whole fs tree and bundle depends on server side.

Post reply on HN