Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

Post reply on HN
Print view View original

91–100 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#91

Post by DaanDeMeyer »

devsda wrote: post #70
DaanDeMeyer wrote: post #54

Earlier quoted context omitted.

Daan here, founding engineer and systemd maintainer. So we try to make every new feature that might be disruptive optional in systemd and opt-in. Of course we don't always succeed and there will always be differences in opinion. Also, we're a team of people that started in open source and have done open source for most of our careers. We definitely don't intend to change that at all. Keeping systemd a healthy project…

Thanks Daan for your contributions to systemd. If you were not a systemd maintainer and have started this project/company independently targeting systemd, you would have to go through the same process as everyone and I would have expected the systemd maintainers to, look at it objectively and review with healthy skepticism before accepting it. But we cannot rely on that basic checks and balances anymore and that's th…

Systemd upstream has reviewers and maintainers from a bunch of different companies, and some independent: Red Hat, Meta, Microsoft, etc. This isn't changing, we'll continue to work through consensus of maintainers regardless of which company we work at.

Re: Lennart Poettering, Christian Brauner founded a new company

#92

Post by Nextgrid »

s_dev wrote: post #59
DaanDeMeyer wrote: post #54

Earlier quoted context omitted.

Daan here, founding engineer and systemd maintainer. So we try to make every new feature that might be disruptive optional in systemd and opt-in. Of course we don't always succeed and there will always be differences in opinion. Also, we're a team of people that started in open source and have done open source for most of our careers. We definitely don't intend to change that at all. Keeping systemd a healthy project…

>We are building cryptographically verifiable integrity into Linux systems. Every system starts in a verified state and stays trusted over time. What problem does this solve for Linux or people who use Linux? Why is this different from me simply enabling encryption on the drive?

It prevents malware that obtained root access once from forever replacing your kernel/initrd and achieving persistence that way.

Re: Lennart Poettering, Christian Brauner founded a new company

#93

Post by plagiarist »

microtonal wrote: post #45
chaps wrote: post #37

Earlier quoted context omitted.

As someone who's lost many hours troubleshooting systemd failures, I would like an answer to this question, too.

You won't believe how many hours we have lost troubleshooting SysV init and Upstart issues. systemd is so much better in every way, reliable parallel init with dependencies, proper handling of double forking, much easier to secure services ( systemd-analyze security ), proper timer handling (yay, no more cron), proper temporary file/directory handling, centralized logs, etc. It improves on about every level compared…

The problem is not systemd vs SysV et al, the problem is systemd spreading like a cancer throughout the entire operating system.

Also trying to use systemd with podman is frustrating as hell. You just cannot run a system service using podman as a non-root user and have it work correctly.

Re: Lennart Poettering, Christian Brauner founded a new company

#94

Post by smartmic »

shrubble wrote: post #74
microtonal wrote: post #45

Earlier quoted context omitted.

You won't believe how many hours we have lost troubleshooting SysV init and Upstart issues. systemd is so much better in every way, reliable parallel init with dependencies, proper handling of double forking, much easier to secure services ( systemd-analyze security ), proper timer handling (yay, no more cron), proper temporary file/directory handling, centralized logs, etc. It improves on about every level compared…

There’s a reason why Devuan (a non systemd Debian) exists. Don’t want to get into a massive argument, but there are legitimate reasons for some to go in a different direction.

And Void Linux. And Gentoo. And Alpine Linux. And Slackware. And others.

Re: Lennart Poettering, Christian Brauner founded a new company

#95

Post by toast0 »

Nextgrid wrote: post #87
toast0 wrote: post #73

Earlier quoted context omitted.

> systemd is so much better in every way, How can I cancel a systemd startup task that blocks the login prompt? / how is forcing me to wait for dhcp on a network interface that isn't even plugged in a better experience?

Your distribution has configured your GDM or Getty to have some dependency on something that ultimately waits on dhcpcd/network-online.target. It’s not really the fault of systemd; it just enables new possibilities that were previously difficult/impossible and now the usage of said possibilities is surfacing problems.

It is the fault of systemd that there's no interactive control.

On other inits, I can hit ctrl-C to break out of a poorly configured setup. Yes, it's more difficult when there's potentially parallelism. But systemd is not uniformly better than everything else when it lacks interactivity.

And it might not be better than everything else if common distributions set it up wrong because it's difficult to set it up right. If we're willing to discount problems related to one init system because the distribution is holding it wrong, then why don't we blame problems with other init systems on distributions or applications, too? There's no need to restart crashing applications if applications don't crash, etc.

Re: Lennart Poettering, Christian Brauner founded a new company

#96

Post by cwillu »

9NRtKyP4 wrote: post #67

Remote attestation is another technology that is not inherently restrictive of software freedom. But here are some examples of technologies that have already restricted freedom due to oligopoly combined with network effects: * smartphone device integrity checks (SafetyNet / Play Integrity / Apple DeviceCheck) * HDMI/HDCP * streaming DRM (Widevine / FairPlay) * Secure Boot (vendor-keyed deployments) * printers w/ sign…

It very clearly is restrictive of software freedom. I've never suffered from an evil maid breaking into my house to access my computer, but I've _very_ frequently suffered from corporations trying to prevent me from doing what I wish with my own things. We need to push back on this notion that this sort of thing was _ever_ for the end-user's benefit, because it's not.

Re: Lennart Poettering, Christian Brauner founded a new company

#97

Post by storystarling »

plagiarist wrote: post #93
microtonal wrote: post #45

Earlier quoted context omitted.

You won't believe how many hours we have lost troubleshooting SysV init and Upstart issues. systemd is so much better in every way, reliable parallel init with dependencies, proper handling of double forking, much easier to secure services ( systemd-analyze security ), proper timer handling (yay, no more cron), proper temporary file/directory handling, centralized logs, etc. It improves on about every level compared…

The problem is not systemd vs SysV et al, the problem is systemd spreading like a cancer throughout the entire operating system. Also trying to use systemd with podman is frustrating as hell. You just cannot run a system service using podman as a non-root user and have it work correctly.

Quadlet actually solves this. It's the newer way to define containers for systemd and handles the rootless user case properly. I migrated my services to it recently and it's much more robust than the old generate scripts.

Re: Lennart Poettering, Christian Brauner founded a new company

#98

Post by Nextgrid »

MarkusWandel wrote: post #78

My only experience with Linux secure boot so far.... I wasn't even aware that it was secure booted. And I needed to run something (I think it was the Displaylink driver) that needs to jam itself into the kernel. And the convoluted process to do it failed (it's packaged for Ubuntu but I was installing it on a slightly outdated Fedora system). What, this part is only needed for secure boot? I'm not sec... oh. So go bac…

Secure Boot only extends the chain of trust from your firmware down the first UEFI binary it loads.

Currently SB is effectively useless because it will at best authenticate your kernel but the initrd and subsequent userspace (including programs that run as root) are unverified and can be replaced by malicious alternatives.

Secure Boot as it stands right now in the Linux world is effectively an annoyance that’s only there as a shortcut to get distros to boot on systems that trust Microsoft’s keys but otherwise offer no actual security.

It however doesn’t have to be this way, and I welcome efforts to make Linux just as secure as proprietary OSes who actually have full code signature verification all the way down to userspace.

Re: Lennart Poettering, Christian Brauner founded a new company

#99

Post by cwillu »

bri3d wrote: post #46

The typical HN rage-posting about DRM aside, there's no reason that remote attestation can't be used in the opposite direction: to assert that a server is running only the exact code stack it claims to be, avoiding backdoors. This can even be used with fully open-source software, creating an opportunity for OSS cloud-hosted services which can guarantee that the OSS and the build running on the server match. This is a…

Like evil maid attacks, this is a vanishingly rare scenario brought out to try to justify technology that will overwhelmingly be used to restrict computing freedom.
Post reply on HN