391–400 of 466 posts
Earlier quoted context omitted.
I posted a slightly provocative tweet about this, and the CEO of NodeSource took exception... sad days. https://twitter.com/kylegordon/status/590860756075294721
He seems to be way nicer and more professional than you..?
Earlier quoted context omitted.
It doesn't have to be circular. The script is secured by HTTPS (and hopefully has the key embedded in the script itself?) which can then retrieve the installer and verify it using the key.
The problem is that in this scenario, the GPG key and signature serves no practical purpose. The whole security, whether GPG is invoked or not, relies on the security of the HTTPS connection alone. If the HTTPS cannot be trusted alone, then everything is lost as a compromised HTTPS connection can be used supply both a comprimised GPG key and a compromised package, or, indeed, anything at all that is legal to `| sudo…
So even if you trust https works, it's still a tricky proposition - it's not really similar to a distro's package distribution channel.
Can someone tell me what realistic security problems this mode of operation introduces that can't be mitigated/avoided with sensible network and backup configurations?
Earlier quoted context omitted.
The problem is that in this scenario, the GPG key and signature serves no practical purpose. The whole security, whether GPG is invoked or not, relies on the security of the HTTPS connection alone. If the HTTPS cannot be trusted alone, then everything is lost as a compromised HTTPS connection can be used supply both a comprimised GPG key and a compromised package, or, indeed, anything at all that is legal to `| sudo…
Even if you trust "normal" https certificates, it's still a much more risky proposition. Those certificates only really say that somebody control the domain - not (in general) that he actually owns it or is responsible in any way, and, more critically, don't vet whether somebody is trustworthy or not. You can easily get some other similar-sounding domain as a malicious agent, and validly get an https certificate for…
Earlier quoted context omitted.
I think more disconcerting is the rise of "sysadmins" who think they're qualified sysadmins because they know how to bash and docker.
As a hiring manager, it's very easy to filter these people out at the interview stage. Being a system administrator requires a very specific personality type that has little to do with experience and more to do with attitude and critical thinking. Sadly, people are right that startups are skipping past admins, thinking they're not needed anymore. Then later they need to hire one to clean up the giant mess.
The problem is you old sysadmins are so passé. Software has replaced you, and you need to get over it. Developers are finally liberated to move at full speed without hearing "NO"
Earlier quoted context omitted.
>> No one can tell you how to build hadoop? Well, figure it out. I get the impression that several people working on debian couldn't work this one out!
Hadoop is insane. The elephant is fitting. Is it really the best choice, or has someone done something cleaner in golang or c++11?
Earlier quoted context omitted.
Your terminal doesn't scroll with wheel/trackpad?
It can do continuous scrolling of the terminal or line-by-line scrolling of the pager. Both are poor options for trying to actually read prose content inside the terminal, IMO, and opening a browser is easier.
This bothers me as well. Even tasks as simple as adding a repository are now being "improved" with a curl | sudo bash style setup[1]. However, installing from source with make was (and remains) a mess. It may work if you're dedicated to maintaining one application and (part of) its stack. But even then it usually leads to out of date software and tracking versions by hand. Many people have this weird aversion to doin…
Many people have enormous amounts of experience with anti-patterns yet very little self reflection to identify them. This is an obvious example: http://en.wikipedia.org/wiki/Inner-platform_effect Obviously a config / deployment system, like any other system, will start small and simple and "save a lot of time" but after an infinity of features are bolted on, it'll be infinitely worse than just using a bash script. Ev…
Earlier quoted context omitted.
> They also produce binaries which don't necessarily require a runtime to be available on every server Just like Java[0]. It is just a matter of choosing the right compiler for the use case at hand. [0] - http://www.excelsiorjet.com/ (one from many vendors)
Cool concept, I didn't realise this existed. Can you run Hadoop and friends under this? I've worked at companies with over 500 servers in a Hadoop cluster and literally never once heard about anything other than using Oracle's JRE aside from one proposal to use OpenJDK which was shot down pretty quickly.