Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The sad state of sysadmin in the age of containers

vitavonni.de

Post reply on HN
Print view View original

11–20 of 466 posts

Re: The sad state of sysadmin in the age of containers

#11

Post by lmm »

make is the least-auditable build tool imaginable. You don't have to obfuscate a Makefile, they come pre-obfuscated; you could put the "own me" commands right there in "plain" Make. Not to mention that it's often easier to tell whether a Java .class file is doing anything nefarious than whether a .c file is. How many sysadmins read the entire source of everything they install anyway?

Maven, on the contrary, is the biggest single source of signed packages around. Every package in maven central has a GPG signature - the exact same gold standard that Debian follows. The problems Debian faces with packaging Hadoop are largely of their own making; Debian was happy to integrate Perl/CPAN into apt, but somehow refuses to do the same with any other language.

> Instead of writing clean, modular architecture, everything these days morphs into a huge mess of interlocked dependencies. Last I checked, the Hadoop classpath was already over 100 jars. I bet it is now 150

That's exactly what clean modular architecture means. Small jars that do one thing well. They're all signed.

Bigtop is indeed terrible for security, but its target audience is people who want a one-stop build solution - not the kind of people who want to build everything themselves and carefully audit it. If you are someone who cares about security, the hadoop jars are right there with pgp signatures in the maven central repository, and the source is there if you want to build it.

Re: The sad state of sysadmin in the age of containers

#12

Post by hurin »

blfr wrote: post #4

This bothers me as well. Even tasks as simple as adding a repository are now being "improved" with a curl | sudo bash style setup[1]. However, installing from source with make was (and remains) a mess. It may work if you're dedicated to maintaining one application and (part of) its stack. But even then it usually leads to out of date software and tracking versions by hand. Many people have this weird aversion to doin…

> Many people have this weird aversion to doing basic sysadmin stuff with Linux. What makes it weird is that it's really simple. Often easier than figuring out another deploy system.

While I agree with the articles main points - the GNU build system is far from simple. Basically an arcane syntax limited to unix-based systems and 5 or 6 100+ page manuals to cover.

It doesn't excuse it - but I think it's easy to see why people turn to curl | sudo bash as the author puts it.

Re: The sad state of sysadmin in the age of containers

#14

Post by mauricemir »

blfr wrote: post #4

This bothers me as well. Even tasks as simple as adding a repository are now being "improved" with a curl | sudo bash style setup[1]. However, installing from source with make was (and remains) a mess. It may work if you're dedicated to maintaining one application and (part of) its stack. But even then it usually leads to out of date software and tracking versions by hand. Many people have this weird aversion to doin…

:-)

I managed to get haddoop running on a small cluster from scratch Michael Nolls turtorial is a good starting point.

Full stack should mean you can and have used a soldering iron in anger and also have at least a CCNA level of networking.

Re: The sad state of sysadmin in the age of containers

#15

Post by peteretep »

[deleted] wrote: post #13

[deleted]

    > As far as I know, it's also still standard practice in
    > most companies to either read the source code of open-
    > source stuff before deploying it to production (binary
    > or build) or get a support contract from someone else
    > who has
I'm afraid I have no better, more cogent response for this than 'lol'.

Re: The sad state of sysadmin in the age of containers

#16

Post by loopbit »

DomreiRoam wrote: post #10

"Maven, ivy and sbt are the go-to tools for having your system download unsigned binary data from the internet and run it on your computer." You should setup a maven repository (Nexus, Artifactory) for your organisation if you want to have more control on binaries. Seems that artifactory can host docker files: https://www.jfrog.com/confluence/display/RTF/Docker+Reposito...

Kind of what I was going to say... The article seems to blame the tools, but there are more secure ways of using these same tools.

Re: The sad state of sysadmin in the age of containers

#20

Post by empressplay »

peteretep wrote: post #15
[deleted] wrote: post #13

[deleted]

> As far as I know, it's also still standard practice in > most companies to either read the source code of open- > source stuff before deploying it to production (binary > or build) or get a support contract from someone else > who has I'm afraid I have no better, more cogent response for this than 'lol'.

At the risk of my karma I'll have to maintain that for companies who are subject to regulation (publicly-traded companies, banks, etc.) what I said is still standard. Unless you have any specific instances to the contrary you're willing to offer?
Post reply on HN