zlacker

[parent] [thread] 13 comments
1. kkfx+(OP)[view] [source] 2022-03-23 11:45:26
Honestly It's not a "reasonably secure OS" but an "absurd OS", absurd because for safety we have since few decades a very lightweight and very effective solutions: Plan 9 namespaces.

Actual older than Plan 9 but still alive OSes have done limited and limiting choices but many have something "somewhat equivalent", for instance GNU/Linux cgroups (see FireJail, BubbleWrap etc) or FreeBSD Capsicum. Choosing anything heavyweight is a nonsense.

replies(2): >>AnIdio+8b >>anthk+Oo
2. AnIdio+8b[view] [source] 2022-03-23 13:18:26
>>kkfx+(OP)
Plan 9 was so far ahead of its time we still haven't caught up.
replies(2): >>gnufx+Mq >>edgyqu+bu
3. anthk+Oo[view] [source] 2022-03-23 14:47:39
>>kkfx+(OP)
We had far more secure OSes even before Unix.

https://multicians.org/security.html

On X11 and Unix, XTerm's "secure keyboard" input makes X11 snooping impossible.

replies(1): >>kkfx+y81
◧◩
4. gnufx+Mq[view] [source] [discussion] 2022-03-23 14:57:31
>>AnIdio+8b
If you're talking about security, and regarding namespaces as a coarse-grained capability system, it was late to the game.
replies(1): >>edgyqu+mu
◧◩
5. edgyqu+bu[view] [source] [discussion] 2022-03-23 15:16:22
>>AnIdio+8b
Linux has definitely caught up on all of the features the wider industry deemed essential or nice to have. There may be some things missing but that is due to little demand outside of perhaps hobbyists.
replies(1): >>kkfx+Jw
◧◩◪
6. edgyqu+mu[view] [source] [discussion] 2022-03-23 15:17:27
>>gnufx+Mq
I think they mean the networking (everything is a file on the network.) This wasn’t adopted but Fuse etc have brought that functionality to Linux. If you really want to model plan9 on Linux there’s an app for that that runs atop Linux.
replies(1): >>gnufx+oo1
◧◩◪
7. kkfx+Jw[view] [source] [discussion] 2022-03-23 15:29:59
>>edgyqu+bu
> Linux has definitely caught up on all of the features the wider industry deemed essential or nice to have.

That's the issue: past IT was made human-centric, the Desktop as the center of the digital World, the humans as someone who bend his/her desktop to his/her needs and desires, with a network to communicate with other humans. Modern IT is "big player centric" and evolve just for their own needs and desires witch happen to be far from all the rest of humans.

Did you remember the big push toward full-stack virtualization (on x86) not so many years ago? Who really need it? In most cases those solutions are just ways to sell hw. Such push turn out to be unsustainable on x86 and so the container era was born, again who need it? Oh, a cloud provider that sell VPS yes, it need both full stack virtualization and various paravirtualization solutions, the rest of the world have no benefit running ks at home, often on a single physical machine. Snap/Flatpack/AppImage? Same story they serve the purpose of giving distro and community independence to commercial players but who need them?

All "modern" IT is prehistoric* respect of original Xerox/Symbolics and even AT&T IT, but sold as new not to improve our life but against our interest giving us just some crumbs and lock-in for the sake of few big players. Those in the FLOSS world who follow the trend are actually workers for free against their own interests.

The demand is "little" just because ignorance is high. And that's a classic in all society, people who know, people with culture, are always a minority, but that's does not means their "desire" are minor, they just know their interest others do not but would benefit equally. And that's why FLOSS should be mandatory and universities MUST be public and well founded to drive the research ahead of the private sector that can only pick some research to implement and sell the outcome not drive the society toward a devastating path.

replies(1): >>edgyqu+8K
◧◩◪◨
8. edgyqu+8K[view] [source] [discussion] 2022-03-23 16:37:02
>>kkfx+Jw
Hmm I’m not sure I disagree with your premise but I do disagree with the bit about virtualization. It was pushed by corporations (and things like docker) because they do provide a quality of life I never had before. Im talking just development at that, I don’t keep a local Linux server anymore (I was a dialy user for 15 years) because it’s all just a docker compose away.

I think it definitely had its place before containerization but that is when it took off everywhere. It wasn’t a single push it was a years in the making process.

replies(1): >>kkfx+Y31
◧◩◪◨⬒
9. kkfx+Y31[view] [source] [discussion] 2022-03-23 18:16:59
>>edgyqu+8K
That's because you know "the new classic" and "the containers" not something else. If you knew NixOS or Guix System you you knew that for far less you can get far more.

A small example: IoT is now a must for modern houses with p.v. etc, Home Assistant is the most well known FLOSS solution. They suggest to deploy it via a docker image, so you need few Gb on disk just for it, relative ram etc. If you deploy via pip is just 321Mb, nothing else. Actually many system package managers support pip integration.

Not only, my entire home infra configuration is an org-mode file, easy to read, share, move just ~2000 lines, with a ks infra? I probably need around 4-5 time the lines in crappy YAML with constant babysitting to keep anything up to date. My actual infra is just two desktop, a laptop, a homeserver and few IoT devices (p.v. system, VMC controlled via ModBUS interface from the homeserver, few others goodies). The sole crappy YAML config for HA is four time* the entire NixOS infra config.

In a single click (on an org-mode link to tangle the config and on org-babel to run terminator and a script inside it) from one desktop or server I can generate a new custom NixOS iso for any other system, copy it to a tftp share for boot or on a ventoy-managed usb stick/ssd and manually boot the target machine. That machine will became the exact functional copy of the original one. With docker and classic distro? Well RH have kickstart is a bit less nightmarish than preseed and it's also limited, build a custom iso is a long process anyway, for Debian based is even longer. I do not know for Arch and co. A custom NixOS iso is just a single (or more, if I want them split) file passed to nix-build '<nixpkgs/nixos>' -A config.system.build.isoImage -I nixos-config=isoconfig.nix for Guix is just slightly longer.

With Plan 9 well, I do not even need an ISO since the infra is also the network... Countless of services and relevant network protocols are meaningless in a live plan 9, for instance sending emails potentially do not demand SMTP, the sender MUA just mount the network share of the recipient and save a file there. All is built-in in the system. Reading a website? The same: mount the exposed filesystem and open documents with your favorite viewer. Want something on another machine? Just open their relevant graphic display and there you go, no need for anydesk/bomgar/teamviewer/citrix/guacamole/*

But I can add more: no need for big cloud infra. These days we have enough bandwidth and computing power to have essentially all the real redundancies we need at home, that scale with the scale of the owner.

replies(1): >>anthk+b75
◧◩
10. kkfx+y81[view] [source] [discussion] 2022-03-23 18:46:25
>>anthk+Oo
Well, unix is another really bad OS compared to it's historical predecessors: at first they decide for a bad programming language to need less hw horsepower and separate that cheap language from the user language (C for the system, for "complex" things, shell scripts for the end user), for equal reasons they decide that's no need for GUIs, while far before unix we have had GUIs, touch monitor, even the world first video-conference with screen sharing in LAN (the so called Mother of all the Demos, in 1968 [1] then they realize that's was not that good and graphic systems start to appear on Unix, far limited, complex, that completely violate unix principles since for GUIs there were no IPCs, classic PostScript GUIs do support some user-programming but not really something like classic systems, CDE support a certain integration but again nothing like classic systems.

Since them all "modern" systems keep rediscovering in limited, limited and bug ridden ways what historical systems have done far better decades before...

I think many should just see classic advertisement like https://youtu.be/M0zgj2p7Ww4 than see it's date and where we are today...

It's not only security it's the overall design. In the past hw resources was limited an so hacks and slowness were common, hw itself being "in a pioneering phase" was full of hacks and ugliness but evolving those systems would have led us too the moon while we are still in the middle age...

[1] https://youtu.be/yJDv-zdhzMY

◧◩◪◨
11. gnufx+oo1[view] [source] [discussion] 2022-03-23 20:18:34
>>edgyqu+mu
Heaven knows what someone conflating cgroups and namespaces means in connexion with Qubes. Anyway, if you want to know what I mean, read the paper "Security in Plan 9". "Linux" is irrelevant, and the various Plan 9 stuff-on-Unix efforts surely aren't going to improve the security of the OS.
replies(1): >>edgyqu+Cw3
◧◩◪◨⬒
12. edgyqu+Cw3[view] [source] [discussion] 2022-03-24 15:12:27
>>gnufx+oo1
You are the one who mentioned security, not the other user. My point was I don’t think they were referring to security as Plan9s most famous features very much have made their way into every major OS out there.
replies(1): >>gnufx+iQ4
◧◩◪◨⬒⬓
13. gnufx+iQ4[view] [source] [discussion] 2022-03-24 22:17:26
>>edgyqu+Cw3
I was going by the top of the thread and choosing to assume the rest wasn't just non sequitor. I don't actually see all resources in GNU/Linux (for instance) available for me to mount remotely into my namespace via a uniform protocol.
◧◩◪◨⬒⬓
14. anthk+b75[view] [source] [discussion] 2022-03-24 23:59:11
>>kkfx+Y31
I would switch (yes, switch) into 9front if it wasn't for mouse chords.
[go to top]