Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The sad state of sysadmin in the age of containers (2015)

vitavonni.de

Post reply on HN
Print view View original

231–240 of 324 posts

Re: The sad state of sysadmin in the age of containers (2015)

#231

Post by pjc50 »

oblio wrote: post #221
pjc50 wrote: post #208

Earlier quoted context omitted.

> sometimes the software is not compatible without the developer knowing it Sure, but this should be considered either a defect or something highlighted by a major version number jump.

Yeah, but who decides if it's a defect? Maybe the defect is subtle and only manifests in rare cases and the upstream rightfully decides that after a risk/payoff analysis, it's not worth fixing it. Or maybe he agrees and fixes it and it's included in distributions 7 years later. I've changed 5 jobs in 7 years (because of life circumstances) and I'm not even a job hopper... How is any commercial shop going to plan arou…

Well, within a debian distribution the Debian developer responsible for the downstream package would get the dependency fixed, either themselves or by badgering the maintainer, and use the fixed Debian version. This gives Debian a consistent set of packages that work together. Yes, it's a lot of work and it's why Debian are behind other distributions and don't include Hadoop. But it reduces the unpleasant surprises.

It's effectively part of insisting that it's properly Free software - if you can't maintain your own bugfixed fork, but have to keep going to an external organisation for their version, is it really Free?

Re: The sad state of sysadmin in the age of containers (2015)

#232

Post by llampx »

doomslice wrote: post #133
weberc2 wrote: post #93

Earlier quoted context omitted.

There’s a pretty straightforward solution to this problem which is to run your own NPM server even if it’s only a caching proxy. For some orgs, the uptime provided by the third party servers is sufficient.

Having been at 3 companies that did this, I can say with certainty that our caching proxies (artifactory in all of them) were much more likely to go down than the public repos were.

They just don't have to be down at the same time to be useful.

Re: The sad state of sysadmin in the age of containers (2015)

#233

Post by bjornjaja »

lmm wrote: post #77

You've got to look at this in a context where platform package managers like apt are simultaneously 1) platform-specific 2) jealous, insisting that every language has to conform to their way of doing things and 3) fundamentally not very good, having very limited ability to do things like install packages for a single user or install multiple versions of the same package. Platform package managers like maven have been…

In my opinion there’s simply too many dependencies to begin with. Some of the simplest things put into a GitHub repository to be “shared” with the world is great—as a gist file. Software needs to be a little more self-contained. Software reuse these days is honestly taking “not reinventing the wheel” to lazy extremes.

System package management systems do things just fine. Ask yourself, “when did I last properly package a Debian library? Do I even know how to do it properly?” Most people won’t be able to answer that because they didn’t.

But truth be told, having each programming language a unique package manager sucks. I’d rather have a consistent way of managing packages on a given system so that I can use various programming languages.

Re: The sad state of sysadmin in the age of containers (2015)

#234

Post by Bjartr »

tonyarkles wrote: post #151
IAmEveryone wrote: post #112

Earlier quoted context omitted.

People adapt to the situation they experience. Github (and other repositories) tend to be stable, so they are used. Network speeds have increased, so we use the network and expend less efforts on local caching etc. There's nothing "complacent" about this: previous generations also relied on infrastructure and didn't plan for prolonged power outages or had backup ham radio network links for when AOL was down. People u…

I half agree with you, and am chuckling a little bit about the "very masculine hunting and zombie-defending skills" part, but... I'd like to offer some perspective. I'm 36 and work on a pretty broad set of consulting projects: some schematic/PCB/mechanical design, firmware, some lower-level desktop/server code, and up and up to web/mobile apps. "Full full stack" if you will. I live in a "major" Canadian city (althoug…

> Some kind of weird Maven/Gradle thing that needs to go out and check something, even though the dependencies have all been pre-installed...

It is often possible to tell Maven at least to work in offline mode and not check for dependency updates.

Re: The sad state of sysadmin in the age of containers (2015)

#235

Post by gmueckl »

takeda wrote: post #201
GordonS wrote: post #122

Earlier quoted context omitted.

> A lot of them involve messy build steps, including downloading binaries or source tarballs without verification Do they though? Whenever I write Dockerfiles that depend on external downloads, I always check the hash matches one baked into the Dockerfile itself, and I've always seen others doing the same.

I have seen this many times, generally the high profile containers do that, and these issues are more common among my peers. This requires self discipline and containers were pushed as a panacea for environments where the discipline is lacking.

What is the point of storing the hash of an external file instead of checking the file into local version control? You're making it a part of your sources either way.

Re: The sad state of sysadmin in the age of containers (2015)

#236

Post by skywhopper »

lmm wrote: post #77

You've got to look at this in a context where platform package managers like apt are simultaneously 1) platform-specific 2) jealous, insisting that every language has to conform to their way of doing things and 3) fundamentally not very good, having very limited ability to do things like install packages for a single user or install multiple versions of the same package. Platform package managers like maven have been…

Maven is just as opinionated, jealous, and terrible, but its impact is restricted to JVM packages, mostly (hopefully) in the development stage, and so the consistency issues don't come up.

I ultimately agree that the system package managers do a poor job of wrapping language-specific package managers. But you lost me when you suggested Maven has a good user experience compared to most OS package managers. If that was a sly joke, then it was a good one.

Re: The sad state of sysadmin in the age of containers (2015)

#237

Post by Avamander »

GordonS wrote: post #204
Avamander wrote: post #185

Earlier quoted context omitted.

You can't see what comes from `curl | bash` before you actually pipe it to bash, click the link and read the article please.

OK, I see - in theory, an attacker in control of the backend could write a handler that could craft a bash script that writes different content when `curl | bash` is used. TBH, while I take your point, I do think it's a little disingenuous of you to claim that "You don't have the opportunity" to inspect the script prior to executing it - you ordinarily will , but can't in the unlikely event of an attack like the arti…

> Off the top of my head, this could be mitigated in a couple of ways:

Or the third opportunity of not piping curl to bash and using a proper repository that has all these integrity and authenticity checks built-in.

Re: The sad state of sysadmin in the age of containers (2015)

#238

Post by sectiondetail »

bjornjaja wrote: post #233
lmm wrote: post #77

You've got to look at this in a context where platform package managers like apt are simultaneously 1) platform-specific 2) jealous, insisting that every language has to conform to their way of doing things and 3) fundamentally not very good, having very limited ability to do things like install packages for a single user or install multiple versions of the same package. Platform package managers like maven have been…

In my opinion there’s simply too many dependencies to begin with. Some of the simplest things put into a GitHub repository to be “shared” with the world is great—as a gist file. Software needs to be a little more self-contained. Software reuse these days is honestly taking “not reinventing the wheel” to lazy extremes. System package management systems do things just fine. Ask yourself, “when did I last properly packa…

>In my opinion there’s simply too many dependencies to begin with. Some of the simplest things put into a GitHub repository to be “shared” with the world is great—as a gist file. Software needs to be a little more self-contained. Software reuse these days is honestly taking “not reinventing the wheel” to lazy extremes.

All true. Did we learn nothing from the left-pad incident?

Re: The sad state of sysadmin in the age of containers (2015)

#239

Post by disintegore »

z3t4 wrote: post #116

So you dont want to run (insert software here, like your IDE) in the cloud, and you dont want to run it yourself because you dont trust it (its open source). Then how do you want it delivered? Snaps? Docker? KVM image?

In an InstallShield package, with a 7-step license activation process.

Let's face it, security is an asymptote. I just want someone I can call and scream at when we eventually get pwned and I'm ready to pay for that privilege.

Re: The sad state of sysadmin in the age of containers (2015)

#240

Post by [deleted] »

regularfry wrote: post #173
Annatar wrote: post #63

Earlier quoted context omitted.

"But we need to figure out the tooling and ecosystem story to build, verify and update container deployments securely." Already done: Solaris zones. Available in the SmartOS distribution near you. Combine with OS packaging, imgadm and vmadm commands for maximum impact.

I suspect there's a similar story around LXC available.

[deleted]
Post reply on HN