Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is Silverblue?

fedoramagazine.org

Post reply on HN
Print view View original

71–80 of 140 posts

Re: What is Silverblue?

#71

Post by Barrin92 »

okasaki wrote: post #69

This seems poorly motivated. > What are the benefits of an immutable OS? > One of the main benefits is security. The base operating system is mounted as read-only, and thus cannot be modified by malicious software. The only way to alter the system is through the rpm-ostree utility. How is this different from the current experience? "Operating system" files already aren't writable by the user. The only way to alter th…

>The only way to alter the system is through the "sudo" utility.

The sudo utility doesn't really give any guarantees or produces reproducible states. You can mess around with sudo however you like.rpm-ostree transactions are completely reversible.

Silverblue is the equivalent of an accountant having a transparent history of your machine states. Sudo is like grabbing a pencil, a rubber, and a spraycan and gowing to town.

Re: What is Silverblue?

#72

Post by gigatexal »

antpls wrote: post #21

Basically : the OS is itself a layered read-only "container", on top of which flatpak is the recommended way to install applications. I wish someone built an OS based on k8s as a service and application orchestrator. We wouldn't have to reinvent all the config files, the command line tools and we could reuse knowledge between cluster and single-machine administration. Plus k8s already voluntary abstracted the underly…

No way. I get paid to write YAML hell for k8s at work. I don’t want my desktop to have to work like that. Not all things need to be K8s

Re: What is Silverblue?

#73

Post by Jasper_ »

microtonal wrote: post #33
pkulak wrote: post #5

Earlier quoted context omitted.

They are updated and maintained automatically, even if your distro isn't.

What do you mean by 'maintained' automatically? Many flatpaks use their own custom compiled dependencies that are outdated. I took a frequently-used dependency used to decode untrusted data (ffmpeg). Many Flatpaks on Flathub use outdated ffmpeg versions. Some examples: - VLC ships with a slightly older version of ffmpeg (4.1.3) with two known CVEs: https://github.com/flathub/org.videolan.VLC/blob/f1b27c13b13... - Mak…

Blindly updating ffmpeg without the app being tested for it is a recipe for disaster -- ffmpeg has made API breaks in the past, and that meant that when an ffmpeg system update was required, all projects depending on it would need to upgrade to the new API.

So often, a distribution would be held back on an old ffmpeg (perhaps patched with some of the CVE fixes by a distro maintainer who might not be familiar with the codebase) to isolate the churn of upstream.

flatpak lets app maintainers update at their leisure, which actually gets them on a faster update cycle.

Re: What is Silverblue?

#74

Post by tannhaeuser »

aleks_me2 wrote: post #61

Oh no. The benefit of Linux is to be able to build your own Setup (Server,Desktop). Now with this "Solution" the user have more and more a closed System where every change creates a lot unnecessary steps to install another software. I agree that on servers the container runtime makes a lot of sense but not on Desktops where changes happen every day.

I agree, and I whish others could see this as what it is - a push to make everything so overcomplicated and repository-locked in the name of security that you need endless maintenance and a support contract to run even basic software on your PC, thereby taking F/OSS ad absurdum. When in reality we haven't seen significant end-user F/OSS in almost a decade.

Re: What is Silverblue?

#75

Post by vetinari »

edwintorok wrote: post #70
microtonal wrote: post #54

Earlier quoted context omitted.

But there are also large differences. Silverblue still uses a single namespace for all libraries (unless you count Flatpaks, which can bring their own dependencies), whereas on NixOS you can have many different versions of the same library in parallel. In NixOS, the whole system is defined declaratively, including the system configuration, whereas Silverblue uses a mutable /etc.

Also with NixOS you can install a package and start using it immediately, whereas with SilverBlue you first have to reboot the system to use the new package or after installing updates (or use one of the experimental live update features that tend to break booting the system). If you don't change the set of installed packages often, and reboot your system daily to get the updates, then SilverBlue works quite nicely.…

In Silverblue, your /usr is really immutable, so when you install package, you are installing it into different tree than the one currently running. Reboot switches to that newly constructed tree.

Re: What is Silverblue?

#76

Post by vetinari »

viraptor wrote: post #39
bnegreve wrote: post #29

Earlier quoted context omitted.

On my laptop: How many libraries are loaded: $ sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | wc -l 15429 How many unique library names: $ sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | sort | uniq | wc -l 872 Top 10 most shared libraries: sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | awk '{count[$…

That's a good idea to measure the sharing! Fortunately even if every app gets containerised, not all of those libraries will be duplicated. Specifically each app which forks on its own will still preserve sharing. For example 11 firefox processes I'm running now would share the libraries, whether it's running directly or from docker.

Flatpak has a notion of runtimes, that are shared among applications. All the shared libraries in these runtimes will share their mmaped regions.

On top of that, ostree does deduplication based on file checksum. So if different packages ship the same binary, it will be only one copy on the disk and again, the mmaped regions will be shared among processes.

Re: What is Silverblue?

#77

Post by robin_reala »

Sounds similar to what Apple’s doing with Catalina. On https://www.apple.com/macos/catalina-preview/ they say:

Dedicated system volume.

macOS Catalina runs in its own read-only volume, so it’s separate from all other data on your Mac, and nothing can accidentally overwrite your system files. And Gatekeeper ensures that new apps you install have been checked for known security issues before you run them, so you’re always using good software.

Re: What is Silverblue?

#78

Post by e2le »

saagarjha wrote: post #68
microtonal wrote: post #26

Earlier quoted context omitted.

This is what Nix gets right. Even if static linking is used, if some dependency is updated, all packages that have that dependency in its transitive closure get recompiled.

Sounds a bit inconvenient if something low level gets changed, no? If libc changes you’re in for a day of builds…

Who says you need to compile anything? Nix allows you to download the binaries from their "build cache" if you so choose to, the same is true for guix.

Re: What is Silverblue?

#79

Post by arendtio »

How do they do things like security updates (e.g. OpenSSL)?

I mean, if the system is immutable, do I have to download an install a completely new image? How often do such updates arrive?

And what does immutable even mean in practice? Do I have to start from a CD image or some special boot mode every time I want to install system updates?

Re: What is Silverblue?

#80

Post by mhxion »

okasaki wrote: post #69

This seems poorly motivated. > What are the benefits of an immutable OS? > One of the main benefits is security. The base operating system is mounted as read-only, and thus cannot be modified by malicious software. The only way to alter the system is through the rpm-ostree utility. How is this different from the current experience? "Operating system" files already aren't writable by the user. The only way to alter th…

> How often does this happen? I've worked with complete Linux noobies who were "forced" to use Linux in a VM daily and I've never seen this happen.

Depends on the noob, and just because you never met a situation like that doesn't mean nobody else experiences too (disclosure: it happens all the time)

I was somewhat a noob, I tried to edit Ubuntu's Yaru theme and I messed up and deleted the corrupted system files. There was nothing to worry since I already made backups of the original files, the distress came when I realized I accidentally deleted my good backup files (was bad regex). I wasn't really worried at that moment cause I hoped there would be some repository out there, I could just fetch my files. There was none, none of the latest Ubuntu version or any close old version. Turns out distribution packages are so big (sensibly) it's not that simple to deploy a remote master repository. That was my "wtf open source" moment. I still somehow managed to fix it without any stackoverflow or AskUbuntu. Anyway that's just one case top off my head.

Post reply on HN