Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maybe you shouldn't install new software for a bit

xeiaso.net

Post reply on HN
Print view View original

451–460 of 497 posts

Re: Maybe you shouldn't install new software for a bit

#451

Post by skydhash »

kibwen wrote: post #409
c7b wrote: post #179

Earlier quoted context omitted.

I don't have an answer what the alternative is going to look like. But smarter people than me may find something. C/C++ are doing fine without package managers. Go at least has a more capable standard library than Rust. But I'm not sure if Go's import github approach is the answer. One idea I've been entertaining is to not allow transitive imports in packages. It would probably lead to far fewer and more capable pack…

> C/C++ are doing fine without package managers. More or less the entire Debian apparatus is an organization devoted to being a C/C++ package manager, and while as an end-user it's adequate for installing applications it's still an enormous pain to use packages as libraries even with apt and friends. And once you get outside of apt, you're in an endless hellscape. People don't seem to understand that the real reason…

> it's still an enormous pain to use packages as libraries even with apt and friends. And once you get outside of apt, you're in an endless hellscape

I strongly doubt that. Especially with tools like pkg-config that let you generate the set of flags for a package. If anything I've seen more horrendous build scripts from people that are trying to be clever and trying to support everything under the sun.

Re: Maybe you shouldn't install new software for a bit

#452

Post by josephg »

grebc wrote: post #430
sroerick wrote: post #386

Earlier quoted context omitted.

There's an interesting distinction here where one approach is to build sandboxes that limit exposure, while the other is just allowing the program to be more secure. One approach is "Trust No Code" and the other is "Trusted code should run safely". the first one sounds better on paper, but leads to a very complicated system. That said, I haven't worked with jails much or other forms of sandboxing. It just seems to me…

I definitely lean to the “trusted code should run safely” because it’s just simpler in general. At what point do you trust the system? And if you don’t trust any of it what are you trying to accomplish? Re OpenBSD: I think it just shows we’re all human(fallible) at the end of the day :)

> Re OpenBSD: I think it just shows we’re all human(fallible) at the end of the day :)

Yeah. Its yet another reminder that "being really careful" isn't an adequate security policy. Attackers only need to find 1 bug. Defenders need to protect everything. In large systems, you need defence in depth. Pledge? Yeah. NX? Yeah. Process isolation between subsystems? Yeah lets have that too. Static verification? Love it. Rust's borrow checker? Sure. We need it all.

Re: Maybe you shouldn't install new software for a bit

#453

Post by LoganDark »

Melatonic wrote: post #437
LoganDark wrote: post #432

Earlier quoted context omitted.

Of course. Linux does not share any heritage with BSD though.

Except that they are both based on Unix and (generally) made to run on x86 processors. Which is a pretty big similarity

Linux is not based on Unix. AFAIK it was inspired by Unix, but does not actually share anything.

Re: Maybe you shouldn't install new software for a bit

#454

Post by bshanks »

YZF wrote: post #191
marcus_holmes wrote: post #57

This was always a nightmare waiting to happen. The sheer mass of packages and the consequent vast attack surface for supply chain attacks was always a problem that was eventually going to blow up in everyone's face. But it was too convenient. Anyone warning about it or trying to limit the damage was shouted down by people who had no experience of any other way of doing things. "import antigravity" is just too easy to…

I worked for one company where we were super conservative. Every external component was versioned. Nothing was updated without review and usually after it had plenty of soak time. Pretty much everything built from source code (compilers, kernel etc.). Builds [build servers/infra] can't reach the Internet at all and there's process around getting any change in. We reviewed all relevant CVEs as they came out to make a…

What's the conservative best practice for a solo founder (a one person company; assume the person spends ~20 hours per week on software development/maintenance and the rest of the time on other stuff)?

Re: Maybe you shouldn't install new software for a bit

#455

Post by dag100 »

pocksuppet wrote: post #362
dag100 wrote: post #100

Earlier quoted context omitted.

Calling FreeBSD "just a distro" is verging on insulting. It's an operating system.

Distros are operating systems.

But operating systems are not distros.

Less laconically, distros generally refer to the userland parts of the operating systems rather than the actual kernel. FreeBSD does not use the Linux kernel so calling it a distro, which typically refer specifically to Linux distros, wouldn't be accurate.

Re: Maybe you shouldn't install new software for a bit

#456

Post by dataflow »

KronisLV wrote: post #260
dataflow wrote: post #219

Earlier quoted context omitted.

> Everyone seems to think they are doing the right thing I like to think people would agree more on the appropriate method if they saw the risk as large enough. If you could convince everyone that a nuclear bomb would get dropped on their heads (or a comparably devastating event) if a vulnerability gets in, I highly doubt a company like #2 would still believe they're doing things optimally, for example.

> if they saw the risk as large enough. If you expose people to the true risks instead of allowing them to be ignorant, the conclusion that they might come to is that they shouldn’t develop software at all.

The assumption was obviously that they have a compelling need to develop the software. For the sake of illustration: you imagine exposing them to whatever the highest level of risk is that still makes them wiling to develop software.

Re: Maybe you shouldn't install new software for a bit

#457

Post by YZF »

echelon_musk wrote: post #271
YZF wrote: post #191

Earlier quoted context omitted.

I worked for one company where we were super conservative. Every external component was versioned. Nothing was updated without review and usually after it had plenty of soak time. Pretty much everything built from source code (compilers, kernel etc.). Builds [build servers/infra] can't reach the Internet at all and there's process around getting any change in. We reviewed all relevant CVEs as they came out to make a…

Do you ride an R1?

I used to ride a 600R ... yes- that's where my handle comes from ;)

Re: Maybe you shouldn't install new software for a bit

#458

Post by YZF »

shevy-java wrote: post #387
YZF wrote: post #191

Earlier quoted context omitted.

I worked for one company where we were super conservative. Every external component was versioned. Nothing was updated without review and usually after it had plenty of soak time. Pretty much everything built from source code (compilers, kernel etc.). Builds [build servers/infra] can't reach the Internet at all and there's process around getting any change in. We reviewed all relevant CVEs as they came out to make a…

> It's impossible to convince the "frequent upgrader" that maybe that's a risk in terms of introducing new issues. Well, you critisize people who run the latest software here. Two counter-arguments: 1) If you don't upgrade frequently, you end up with super stable debian stuck on ... ancient software. This in turn means that many more recent software, won't work, unless you recompile a lot. I had this issue with mesa…

Pulling the very latest of everything is IMO risky. What I will acknowledge is that not knowing what known issues are in your stack vs. just pulling the latest all the time is less clear. But running more stable older versions of software while tracking new vulnerabilities seems like it mitigates both the risk of new changes introducing new issues and the risk of a new vulnerability not getting addressed. This worked well for company #1 where we delivered some pretty critical products and the bar was very high for reliability and security.

A long time ago I heard that Google reviews every single line of third party code they use, not sure if it's true or if they still do it.

Re: Maybe you shouldn't install new software for a bit

#459

Post by Rendello »

liamwire wrote: post #228
Rendello wrote: post #157

Earlier quoted context omitted.

I'm reminded of another legendary HN thread: https://news.ycombinator.com/item?id=35079

It may well have been your point, but that it's the exact same person makes this even better

It was, yes. I was trying to figure a way to bring it up but I didn't want to imply that the comment here was ignorant for not knowing the account. It's the opposite, HN accounts have so little fanfare and we all talk in the same threads, it's fun!

Re: Maybe you shouldn't install new software for a bit

#460

Post by pocksuppet »

foo12bar wrote: post #91

Don't install anything, use an LLM to write everything from scratch. It may have bugs, but no one will know how to exploit them, especially when closed source. Code is cheap and is becoming cheaper by the day. We need new paradigms.

A remote LLM? Then the LLM vendor is installing things on your machine.
Post reply on HN