121–130 of 160 posts
Is it just me or would it be a good time to learn a bigger lesson from Heartbleed and Shellshock: Minimalism is seriously a good idea. "Features" are not harmless and cost way more than you think. Providing more flexibility or functionality than absolutely necessary should really be considered and called out as defective, smelly and a bad practice.
Earlier quoted context omitted.
Hmnn well I wonder just how much safer BSD is compared to Linux... I would consider linux to have more eyes on it, and if I remember correctly, LibreSSL was not infallible (despite all the shaming of OpenSSL folks that went on)
OpenBSD is actually formally reviewed/audited, not just relying on "many eyes." Of course you have to remember that only the base install is covered; software in packages/ports is not included in that.
Earlier quoted context omitted.
Hmnn well I wonder just how much safer BSD is compared to Linux... I would consider linux to have more eyes on it, and if I remember correctly, LibreSSL was not infallible (despite all the shaming of OpenSSL folks that went on)
> if I remember correctly, LibreSSL was not infallible LibreSSL is a fork of OpenSSL - it would not be a huge surprise if there remained OpenSSL bugs in it.
nvm, here's the link-
http://www.theregister.co.uk/2014/07/17/libressl_crypto_bug/
Is it just me or would it be a good time to learn a bigger lesson from Heartbleed and Shellshock: Minimalism is seriously a good idea. "Features" are not harmless and cost way more than you think. Providing more flexibility or functionality than absolutely necessary should really be considered and called out as defective, smelly and a bad practice.
The plan9 community have been bashing bash for years. "It's got to much code, a shell should just execute shellscript not handle input" Perhaps they'll listen now - haha as if
Earlier quoted context omitted.
It's unlikely many consumer routers would be running Bash. They'd more likely have Busybox with the bog standard Bourne Shell. And same goes for most other embedded Linux devices too. Though I'm not suggesting that one shouldn't check their own devices to be safe rather than sure.
And how would one go about checking a typical Netgear home wireless router? The only way to manage it is http://192.168.1.1 right? Or do they typically also offer some kind of shell (telnet? ssh?) access?
Is it just me or would it be a good time to learn a bigger lesson from Heartbleed and Shellshock: Minimalism is seriously a good idea. "Features" are not harmless and cost way more than you think. Providing more flexibility or functionality than absolutely necessary should really be considered and called out as defective, smelly and a bad practice.
All the ones I know only want to sell "features".
Your words are absolutely 100% true, 1wd.
But I have become cynical that the world of software developers and their best customers (e.g., the ones who love "features") will never, ever follow your advice.
Personally, I prefer minimalism irrespective of the security benefits. But "engineering", a term many HN readers might attribute to their own work, like to speak of "trade-offs". All engineering involves trade-offs.
When you go without "features", sometimes you actually get something in return. What you "get" might not always be obvious. This week, it should be obvious. At least to everyone who chooses a more minimal shell without surplus features.
http://mywiki.wooledge.org/Bashism http://news.ycombinator.com/item?id=6866696p
Is it just me or would it be a good time to learn a bigger lesson from Heartbleed and Shellshock: Minimalism is seriously a good idea. "Features" are not harmless and cost way more than you think. Providing more flexibility or functionality than absolutely necessary should really be considered and called out as defective, smelly and a bad practice.
That so many things delegate setting environment variables to the system shell is what allows a vulnerability like this to be so pervasive. Why does a DHCP client pass server-originated data to a full shell? In some ways, it's a form of minimalism.
Earlier quoted context omitted.
Um, "haven't bothered"? Think about all the Linux/Unix -based devices that could be affected here, it's in the millions. Do you run a local server on your box? How about your Linux-based router? Has it been patched yet? Why not, it's been more than 24 hours now.
> How about your Linux-based router? In the embedded world, people rarely run full GNU userland utils. They're extremely big and bloated, and embedded devicse needs maximum bang for buck. Therefore most of them comes with busybox, which besides being incredibly compact also is 100% unaffected. Same goes for Android/Linux-based phones. Most don't come with a proper shell at all, and those who do, usually have busybox.
If this is true, there's been a fair amount of paranoia on HN that has gone sadly unanswered with corrections.
Earlier quoted context omitted.
One thing to recall is that much of the complexity in systemd comes from replacing a whole bunch of dodgy, special purpose code written in shell scripts (init scripts) and in the daemons it manages (daemonization code, various kinds of racy startup dependencies, etc). Just saying "systemd is complex" is fairly sloppy thinking; the question is, is it more or less complex than re-implementing that functionality poorly…
There's significantly less complex ways to do this sort of thing, though. One that I've been looking at implementing into a distro lately is nosh[0] (and execline[1]). Every bit of code is implemented as a separate, independent utility that can be chained together through the nosh/execlineb "shell", which does no parsing and only a tiny bit of lexing. This way, it's easy to pick and choose what features and complexit…
Earlier quoted context omitted.
> if I remember correctly, LibreSSL was not infallible LibreSSL is a fork of OpenSSL - it would not be a huge surprise if there remained OpenSSL bugs in it.
My point was that some OpenBSD guys rewrote OpenSSL in an attempt to fix it, yet also introduced some bugs (I read one article about a bug that was introduced by them, though I don't have a link, nor want to search the internet for it)... nvm, here's the link- http://www.theregister.co.uk/2014/07/17/libressl_crypto_bug/