Live data from Hacker News

Show HN: CLI tool for saving web pages as a single file

github.com

201–210 of 216 posts

Re: Show HN: CLI tool for saving web pages as a single file

#202
post #162

Earlier quoted context omitted.

I recently took a course on how cgroups and namespaces work, and can be combined to create containers, and my impression is security is a huge kludge. For example, the capabilities are just a seeming random assortment of different permissions, with a big dumping ground in the admin capability. It's hard to see how such a system can be reliably secured. Plus, it's all open source with a couple core contributors. What'…

> my impression is security is a huge kludge Docker itself could be called a huge kluge, at least compared to Solaris 'zones' and FreeBSD 'jails'. They're similar to containers, but are supported directly by the kernel, whereas Docker has to pull together different kernel features to create its abstraction. [0] > What's to stop some state agency inserting its code into the core? No way to review everything 1. This is…

Nothing is safe from government pressure. But, at least with local closed source we know it's going to just be our government pressure. Otherwise, it could be any actor, which may be less friendly towards us.

Re: Show HN: CLI tool for saving web pages as a single file

#203
post #181

Earlier quoted context omitted.

Let me put it another way: how would you implement a dotfile management framework (like any of these: https://dotfiles.github.io )? Programmers seem to really like them, judging by how many of them there are. But the whole point of them is to forcefully usurp the assets of literally every other program on the system. They're user-level rootkits, in a sense. Or, for a simpler, more obvious example: find(1), grep(1), e…

>"Do you want to literally copy your entire hard disk into the 'inbox' of these utilities, in order to get them to search it for you?" Well, let's think about the goal here. grep reads files and outputs lines from those files. It needs full read access to everything you want to search. It does not need write access outside of its sandbox. It does not need direct access to network sockets, audio stuff and so on. Is it…

> It does not need write access outside of its sandbox.

You have SElinux for that, if you like bureaucracy and filing triplicate forms to able to run scripts with side effects.

Re: Show HN: CLI tool for saving web pages as a single file

#204

Earlier quoted context omitted.

FYI: "favorite" is one way of doing that through HN. Bookmarks, or downloads, externally.

Favorites is limited to a certain amount on HN before you start losing the oldest favorite.

That's not true. One user has 46,000. What did you see that made you think this?

Re: Show HN: CLI tool for saving web pages as a single file

#205

One thing I always wonder when I see native software posted here: How do you guys handle the security aspect of executing stuff like this on your machines? Skimming the repo it has about a thousand lines of code and a bunch of dependencies with hundreds of sub-dependencies. Do you read all that code and evaluate the reputation of all dependencies? Do you execute it in a sandboxed environment? Do you just hope for the…

> Do you read all that code and evaluate the reputation of all dependencies? Why of course. I do this for every piece of software on my computer, from the device drivers to the OS, I review every patch to firefox & chrome as well. /s Running someone else's software inherently means extending them trust. This objection is especially confusing on a piece of software where you can actually inspect all the source if you…

Your tongue in cheek points are good.

But on that last bit I disagree. Many, many systems run nothing but stock open source kernel drivers under Linux. I daresay home systems with closed drivers are more of an exception. All those VMs in the "cloud".

Re: Show HN: CLI tool for saving web pages as a single file

#206

One thing I always wonder when I see native software posted here: How do you guys handle the security aspect of executing stuff like this on your machines? Skimming the repo it has about a thousand lines of code and a bunch of dependencies with hundreds of sub-dependencies. Do you read all that code and evaluate the reputation of all dependencies? Do you execute it in a sandboxed environment? Do you just hope for the…

This is a good question. I think you can make it even better by generalizing the problem. How on earth do developers hope to advance general computing forward when simply running programs isn't a solved problem? Most software engineers I know don't run docker on their home PCs. What about people who aren't in IT? Does anyone here even care? The general attitude I see is "plebs don't need to run anything they can't ge…

> sanboxing arbitrary programs by default

See OLPC Bitfrost

http://wiki.laptop.org/go/Bitfrost

Re: Show HN: CLI tool for saving web pages as a single file

#207
post #202

Earlier quoted context omitted.

> my impression is security is a huge kludge Docker itself could be called a huge kluge, at least compared to Solaris 'zones' and FreeBSD 'jails'. They're similar to containers, but are supported directly by the kernel, whereas Docker has to pull together different kernel features to create its abstraction. [0] > What's to stop some state agency inserting its code into the core? No way to review everything 1. This is…

Nothing is safe from government pressure. But, at least with local closed source we know it's going to just be our government pressure. Otherwise, it could be any actor, which may be less friendly towards us.

> with local closed source we know it's going to just be our government pressure

We don't. Companies that produce proprietary code are not immune from attacks on their repository, and are more vulnerable to, say, bribery. They're also more vulnerable to attacks on their distributed binaries - users do not have the option to compile from source, so you compromise every user this way.

Proprietary software is also far more likely to embed 'telemetry' spying, or to use sloppy security practices and rely on security-by-obscurity. Authors of Free and Open Source software know that they (generally at least [0]) cannot get away with this kind of thing.

It simply isn't true that proprietary software is more trustworthy than FOSS. If anything, the opposite appears to be true.

[0] https://news.ycombinator.com/item?id=14754740

Re: Show HN: CLI tool for saving web pages as a single file

#209
post #202

Earlier quoted context omitted.

Nothing is safe from government pressure. But, at least with local closed source we know it's going to just be our government pressure. Otherwise, it could be any actor, which may be less friendly towards us.

> with local closed source we know it's going to just be our government pressure We don't. Companies that produce proprietary code are not immune from attacks on their repository, and are more vulnerable to, say, bribery. They're also more vulnerable to attacks on their distributed binaries - users do not have the option to compile from source, so you compromise every user this way. Proprietary software is also far m…

[citation requested]

Re: Show HN: CLI tool for saving web pages as a single file

#210
post #165

Earlier quoted context omitted.

This is a good question. I think you can make it even better by generalizing the problem. How on earth do developers hope to advance general computing forward when simply running programs isn't a solved problem? Most software engineers I know don't run docker on their home PCs. What about people who aren't in IT? Does anyone here even care? The general attitude I see is "plebs don't need to run anything they can't ge…

But arbitrary programs are... arbitrary. Especially ones run by software engineers, and especially ones run by software engineers as part of a POSIX-alike “utility bag” ecosystem. Who’s to say that the user’s intent by running the program they just downloaded, isn’t to—say—overwrite a system folder? (Oh, wait, that’s exactly what Homebrew does, with the user’s full intent behind it!) There are tons of attempts to do…

Amusing that you should mention Canonical "snaps". I made a snap of monolith and contributed the yaml upstream. https://snapcraft.io/monolith - it's in the edge channel because upstream haven't done a stable release yet. It's a strictly confined application.
Post reply on HN