11–20 of 52 posts
When will RedHat learn that too many knobs and buttons, especially global settings, result in leaks and exploits? I don't care if the customers demand these. I'm quite happy to enable/disable core dumps in the shell. Make Linux great again!
The normal way I use machines these days is that anyone with login access has some ability to become root. But anyone who is hosting shellboxes (including "bastion" hosts in ISO27001 environments): this is pretty serious.
In fact the Unix uid/gid does provide real security value in practice. It is not absolute, and relative to other barriers commonly used (LSM, cgroup containers, VMs, firewalls, BPF syscall filtering, etc...) it's comparatively weak and porous. But it's not something to dismiss either.
The nature of "defense in depth" security analysis is that you have to embrace that depth and not throw bits out. UID separation has the distinct advantage of being dirt simple to understand and extremely cheap to deploy. Use it.
Quite disappointing someone would enable that kernel option without fully considering the ramifications :/. Do some distributions use systemd-coredump by default? I not just learned about systemd-coredump and I'm wondering if it could be actually useful for develoment purposes; apport doesn't seem to be.
[1]: https://utcc.utoronto.ca/~cks/space/blog/linux/SystemdOomdNo...
And then, there are very few alternatives, because more and more software requires systemd (and even if most things still don't, so much stuff requires glibc so Alpine or OpenBSD aren't always very good as alternatives).
Quite disappointing someone would enable that kernel option without fully considering the ramifications :/. Do some distributions use systemd-coredump by default? I not just learned about systemd-coredump and I'm wondering if it could be actually useful for develoment purposes; apport doesn't seem to be.
systemd-coredump is vuln, systemd-oomd kills the wrong stuff, and you don't even learn that these programs exist (and are running on your system) until you find out from a CVE or a blog post detailing how to mitigate the problem[1]. [1]: https://utcc.utoronto.ca/~cks/space/blog/linux/SystemdOomdNo... And then, there are very few alternatives, because more and more software requires systemd (and even if most things st…
https://news.ycombinator.com/item?id=33894469 (2 weeks ago, 134 comments)
Quite disappointing someone would enable that kernel option without fully considering the ramifications :/. Do some distributions use systemd-coredump by default? I not just learned about systemd-coredump and I'm wondering if it could be actually useful for develoment purposes; apport doesn't seem to be.
systemd-coredump is vuln, systemd-oomd kills the wrong stuff, and you don't even learn that these programs exist (and are running on your system) until you find out from a CVE or a blog post detailing how to mitigate the problem[1]. [1]: https://utcc.utoronto.ca/~cks/space/blog/linux/SystemdOomdNo... And then, there are very few alternatives, because more and more software requires systemd (and even if most things st…
I've been running Alpine Linux in production for 4 years now.
Quite disappointing someone would enable that kernel option without fully considering the ramifications :/. Do some distributions use systemd-coredump by default? I not just learned about systemd-coredump and I'm wondering if it could be actually useful for develoment purposes; apport doesn't seem to be.
Quite disappointing someone would enable that kernel option without fully considering the ramifications :/. Do some distributions use systemd-coredump by default? I not just learned about systemd-coredump and I'm wondering if it could be actually useful for develoment purposes; apport doesn't seem to be.
systemd-coredump is honestly incredibly useful. Any time an application randomly crashes in the background, you can easily pop it in a debugger to look through the backtrace without having to re-run it. Very handy for when the crashes are not easily reproducible, or you didn't expect something to fail and are not sure how to make it fail again.
Quite disappointing someone would enable that kernel option without fully considering the ramifications :/. Do some distributions use systemd-coredump by default? I not just learned about systemd-coredump and I'm wondering if it could be actually useful for develoment purposes; apport doesn't seem to be.
systemd-coredump is honestly incredibly useful. Any time an application randomly crashes in the background, you can easily pop it in a debugger to look through the backtrace without having to re-run it. Very handy for when the crashes are not easily reproducible, or you didn't expect something to fail and are not sure how to make it fail again.
Earlier quoted context omitted.
systemd-coredump is vuln, systemd-oomd kills the wrong stuff, and you don't even learn that these programs exist (and are running on your system) until you find out from a CVE or a blog post detailing how to mitigate the problem[1]. [1]: https://utcc.utoronto.ca/~cks/space/blog/linux/SystemdOomdNo... And then, there are very few alternatives, because more and more software requires systemd (and even if most things st…
You can turn the situation around: Pick some non-systemd OS, stick to it, and avoid software that does not run on it. You will end up with the old and boring tech, but it will be robust and run more reliable in the long term. I've been running Alpine Linux in production for 4 years now.
Not always. I have sway and pipewire running smooth as can be on my systemd-free workstation. As well as recent releases of Linux, glibc, Mesa, and Firefox. All the essentials are there and up to date for me!
Earlier quoted context omitted.
systemd-coredump is vuln, systemd-oomd kills the wrong stuff, and you don't even learn that these programs exist (and are running on your system) until you find out from a CVE or a blog post detailing how to mitigate the problem[1]. [1]: https://utcc.utoronto.ca/~cks/space/blog/linux/SystemdOomdNo... And then, there are very few alternatives, because more and more software requires systemd (and even if most things st…
You can turn the situation around: Pick some non-systemd OS, stick to it, and avoid software that does not run on it. You will end up with the old and boring tech, but it will be robust and run more reliable in the long term. I've been running Alpine Linux in production for 4 years now.