Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Built Linux from Scratch

thesloth.me

Post reply on HN
Print view View original

71–80 of 105 posts

Re: I Built Linux from Scratch

#71

Post by dessimus »

marginalia_nu wrote: post #7

I built LFS like back in 2005 or something. I remember it took forever. I wonder if it's faster or slower now. My computer is definitely faster, but I also have a creeping suspicion the code has gotten a lot bigger. Then at some point I switched to gentoo. I remember I vacillated between gentoo and slackware. The important thing was that I had an onion on my belt, which was the style at the time.

Significantly faster. A few months ago, after building a new rig for the first time in 6 years or so. I did a gentoo build from minimal to gnome, as exercise/burn-in/cooling testing. With the amount of RAM and cores available now compared to 2005, an 'emerge -e @world' only took a few hours vs the days and days it took back then.

Re: I Built Linux from Scratch

#72

Post by abbbi »

gary_0 wrote: post #5

For something that's more of a prepackaged build-your-own-Linux kit, there's also KISS Linux[0]. It's kind of a microdistro with minimal abstraction over the raw guts, and "packages" are just pre-downloaded source code repos that you compile yourself. The "package manager" is just a shell script. The installation process[1] is entirely manual, so you control every step as you bootstrap up to building your own kernel…

unfortunately its been maintained by only one dev which seems to have turned its back onto tech and has fanished from the web entirely[0]. I think its been forked since and maintained by a small community[1]. I liked the concept and used it for some tiny test machines.

[0] https://www.reddit.com/r/linux/comments/m4pwix/what_happened...

[1] https://github.com/kiss-community

Re: I Built Linux from Scratch

#73

Post by atum47 »

I started doing it back in 2019 after college, but at the same time I was doing job interviews with code challenges that would take 2 - 3 days, so I end up giving up halfway through.

It was a miss calculation on my part, I underestimate how long it would take me to complete the whole LFS thing. Still on my todo list though

Re: I Built Linux from Scratch

#74

Post by denton-scratch »

I deployed ipcop[0] routers a few times.

Ipcop was a pretty good router. It could be booted off a 1.44MB floppy disk. It was built using LFS, so it took a while to install on a home-grade machine (like, a day!). This was ages ago; apparently they're still going.

I didn't learn anything from installing it, except that it's possible, as a user, to build the whole toolchain, the OS, and the application, starting from assembly language. And that using LFS, you can make a really tiny Linux. Making a router was a good application of LFS; I'm surprised the search engines have forgotten it.

[0] http://www.ipcop.org/

It's important that we can always do that.

Re: I Built Linux from Scratch

#75

Post by lrvick »

englishrookie wrote: post #40
lrvick wrote: post #34

Earlier quoted context omitted.

IMO a secure server is an immutable appliance. I still build Linux from scratch most weeks as a core part of my job. Bare bones hardened kernel + shim init + target application are all you need, and will be your highest security/reliability systems. And yeah, threadrippers are a must.

I assume you compile the source code because you want to be sure you don't use any compromised binaries? But how can you be sure the source code wasn't compromised with some obfuscated C code? (Honest question, I'm just a humble application developer.)

It is dramatically easier to hide malware in a compiled artifact than in public source code, not to imply that the latter does not happen.

In security focused orgs though you review all code yourself with the exception of things with extensive third party signed review such as the Linux kernel itself. Even then I review codepaths in the kernel critical for my use case such as random.c

From there, if I -alone- compile containers, kernels, or binaries, someone could coerce me to tamper with them to compromise all downstream users. Same if there was a central build system I can access. To mitigate this I ensure my artifact builds are deterministic, sign my changes, and have team members review my changes, reproduce my artifacts bit for bit, then counter-sign the results.

It is never wise to be in a position where there is possibility of you yourself tampering with things that control anything of value, or else someone will coerce you to help them steal said value.

As a security engineer it is my job to ensure no one ever has to trust anyone, including me.

Re: I Built Linux from Scratch

#76

Post by lrvick »

ilyt wrote: post #60
lrvick wrote: post #34

Earlier quoted context omitted.

IMO a secure server is an immutable appliance. I still build Linux from scratch most weeks as a core part of my job. Bare bones hardened kernel + shim init + target application are all you need, and will be your highest security/reliability systems. And yeah, threadrippers are a must.

As in manually or https://buildroot.org/ ?

I used to make heavy use of buildroot but these days for most of my use cases I just have a kernel, and an init/application binary that I statically compile into the kernel. A simple makefile gets the job done and is easier to review than the whole of buildroot.

Re: I Built Linux from Scratch

#77

Post by severine »

lrvick wrote: post #75
englishrookie wrote: post #40

Earlier quoted context omitted.

I assume you compile the source code because you want to be sure you don't use any compromised binaries? But how can you be sure the source code wasn't compromised with some obfuscated C code? (Honest question, I'm just a humble application developer.)

It is dramatically easier to hide malware in a compiled artifact than in public source code, not to imply that the latter does not happen. In security focused orgs though you review all code yourself with the exception of things with extensive third party signed review such as the Linux kernel itself. Even then I review codepaths in the kernel critical for my use case such as random.c From there, if I -alone- compile…

Typo in your homepage: "Continuious Integration"

Interesting thread!

Re: I Built Linux from Scratch

#79

Post by BeetleB »

Flamebait, but:

> Slackware and LFS are the Haskells of the Linux distribution world. People jump to the extreme end of the spectrum, and either get burnt or remain unproductive for life, when they should have just used OCaml or F# instead.

https://blog.nawaz.org/posts/2023/May/20-years-of-gentoo/

I've done both LFS and Gentoo. While LFS is certainly fun, in practice I don't think you really learn that much more than with Gentoo. The benefit of the latter is it's easy to stick to for life.

Post reply on HN