4 ms·

On the other hand you have the desktop/web thinking of rebooting often (or shutting down when not used, starting up before using) and being on the bleeding edge

by zzalpha 11y ago

On the other hand you have the desktop/web thinking of rebooting often (or shutting down when not used, starting up before using) and being on the bleeding edge. I actually find this line of thinking baffling... I don't remember the last time I actively chose to shutdown/reboot voluntarily. Spending time optimizing the boot sequence strikes me as a total waste of effort. Modern computers support sleep and hibernate... why would anyone choose to reboot except to apply OS updates on certain operating systems that insist on a reboot? I would much rather focus on uptime stability and flawless sleep/hibernate so we can encourage people to never reboot unless they're forced to. That'd better serve phones, tablets, and other devices that share this infrastructure and need this capability, and it would cater to a public that is getting used to always-on, always-available technology.

digi_owl 11y ago
Best i can tell, it comes from the -sec community. This because a encrypted HDD in a laptop is at its safest when the laptop is turned fully off. At that point you have no keys in RAM or anything like that. Thus when you do not use your computer you turn it off, you do not sleep, you do not hibernate, you turn it off. The systemd devs have a thing about listening to the -sec community. You can see this in how while the Linux default is to treat namespace mounts at private, systemd mount them as shared unless told otherwise. This because the -sec people recommend it that way (allows a sysadmin to override mounts from outside the namespace, to avoid dos-ing apparently). Then again they also have a bit of theater in them. For example they accepted a patch to lock the computer if a HID devices was plugged in. But while the original patch did it on any device, they modified it so that it only happens on the device ids of known mouse wigglers used in police computer seizure kits.
- JoshTriplett 11y ago
  > Then again they also have a bit of theater in them. For example they accepted a patch to lock the computer if a HID devices was plugged in. But while the original patch did it on any device, they modified it so that it only happens on the device ids of known mouse wigglers used in police computer seizure kits. There was a series of two patches: one to logind to add a mechanism to tell all active user sessions to lock, and one to the udev rules provided with systemd to add a policy that plugging in a known mouse wiggler causes all active user sessions to lock. (It wouldn't make any sense to lock the screen when inserting any HID device.) Separately from that, logind also implements other policies for when to lock the screen, such as when closing a laptop lid without an external monitor connected.
  - digi_owl 11y ago
    And how bloody hard it is to make the wiggler change the ID to look like any old mouse? Or one gets kitbashed out of a existing mouse? Or a new one comes to market that is not part of the IDs systemd have on file?
pathsjs 11y ago
Of all the non technical people I know, exactly zero know that hibernate even exists as an option. Everyone just switches off the pc when done.
- bluejekyll 11y ago
  Really? Everyone I know just closes their laptop. And then the fear of the dreaded sleep, has them walking around the office with them open all the time.
  - pathsjs 11y ago
    Yeah, I have seen this for small periods of time. Anything longer and to avoid the battery drain the shutdown is used. This is why I mentioned hibernation. Standby is ok only for a few hours at most on laptops.
    - falcolas 11y ago
      Most laptops I use move transparently between sleep and hibernation when the laptop is closed. No use intervention required.
to3m 11y ago
I restart every now and again just to make sure it still works, and that everything I expect to get loaded, gets loaded. Nothing worse than being obliged to do it for whatever reason and finding out the hard way (while you're in the middle of something else...) that something's gone wrong. It also puts the computer back into a known state, and gives you smaller PIDs/thread IDs/etc. again...
calpaterson 11y ago
Linux distributions do need to reboot on a regular basis to apply security patches. In particular any kernel changes need a restart to take effect. The last security advisory affecting the linux kernel for Debian was 5 days ago (https://www.debian.org/security/2015/dsa-3426 https://www.debian.org/security/2015/dsa-3426). There was another one about a month before that (https://www.debian.org/security/2015/dsa-3426 https://www.debian.org/security/2015/dsa-3426). Additionally because of the way shared libraries are loaded in Linux after you apply the patches you might have old, unpatched versions of (eg openssl) linked into currently running processes. There are a few ways to handle this but a restart is one very simple one that is guaranteed to work. Consequently any Linux machine that has more than about a month of uptime is probably missing patches. 500 days of uptime corresponds to a huge number of unpatched vulnerabilities. So restarting is quite important and is unlikely to go away soon.
- pdkl95 11y ago
  You don't need to restart to patch openssl. Kernel-patches are usually the only reason a restart is needed. This idea that a restart is needed is Windows-style thinking. > more than about a month of uptime is probably missing patches Only when you don't know how to properly maintain a Linux box. A reboot is one way to handle patches. It is even recommended when you are changing anything related to the startup process. For everything else, you simply need to restart any process using the old libs. If it wasn't a security patch, you can often simply wait for processes to finish normally.
  - calpaterson 11y ago
    I did mention that there are multiple options for dealing with out-of-date libraries. I implied it but I didn't make it clear: debian's security team releases a kernel patch about once a month. This is where the ceiling on uptime comes from.
    - regularfry 11y ago
      Only because ksplice got borged. Which, in a funny way, makes this Oracle's fault...
johnny22 11y ago
fast boot is most important for container or virtual machines than actual desktop machines.

by zzalpha 11y ago

digi_owl 11y ago

Best i can tell, it comes from the -sec community. This because a encrypted HDD in a laptop is at its safest when the laptop is turned fully off. At that point you have no keys in RAM or anything like that. Thus when you do not use your computer you turn it off, you do not sleep, you do not hibernate, you turn it off. The systemd devs have a thing about listening to the -sec community. You can see this in how while the Linux default is to treat namespace mounts at private, systemd mount them as shared unless told otherwise. This because the -sec people recommend it that way (allows a sysadmin to override mounts from outside the namespace, to avoid dos-ing apparently). Then again they also have a bit of theater in them. For example they accepted a patch to lock the computer if a HID devices was plugged in. But while the original patch did it on any device, they modified it so that it only happens on the device ids of known mouse wigglers used in police computer seizure kits.

JoshTriplett 11y ago
> Then again they also have a bit of theater in them. For example they accepted a patch to lock the computer if a HID devices was plugged in. But while the original patch did it on any device, they modified it so that it only happens on the device ids of known mouse wigglers used in police computer seizure kits. There was a series of two patches: one to logind to add a mechanism to tell all active user sessions to lock, and one to the udev rules provided with systemd to add a policy that plugging in a known mouse wiggler causes all active user sessions to lock. (It wouldn't make any sense to lock the screen when inserting any HID device.) Separately from that, logind also implements other policies for when to lock the screen, such as when closing a laptop lid without an external monitor connected.
- digi_owl 11y ago
  And how bloody hard it is to make the wiggler change the ID to look like any old mouse? Or one gets kitbashed out of a existing mouse? Or a new one comes to market that is not part of the IDs systemd have on file?

pathsjs 11y ago

Of all the non technical people I know, exactly zero know that hibernate even exists as an option. Everyone just switches off the pc when done.

bluejekyll 11y ago
Really? Everyone I know just closes their laptop. And then the fear of the dreaded sleep, has them walking around the office with them open all the time.
- pathsjs 11y ago
  Yeah, I have seen this for small periods of time. Anything longer and to avoid the battery drain the shutdown is used. This is why I mentioned hibernation. Standby is ok only for a few hours at most on laptops.
  - falcolas 11y ago
    Most laptops I use move transparently between sleep and hibernation when the laptop is closed. No use intervention required.

to3m 11y ago

I restart every now and again just to make sure it still works, and that everything I expect to get loaded, gets loaded. Nothing worse than being obliged to do it for whatever reason and finding out the hard way (while you're in the middle of something else...) that something's gone wrong. It also puts the computer back into a known state, and gives you smaller PIDs/thread IDs/etc. again...

calpaterson 11y ago

Linux distributions do need to reboot on a regular basis to apply security patches. In particular any kernel changes need a restart to take effect. The last security advisory affecting the linux kernel for Debian was 5 days ago (https://www.debian.org/security/2015/dsa-3426 https://www.debian.org/security/2015/dsa-3426). There was another one about a month before that (https://www.debian.org/security/2015/dsa-3426 https://www.debian.org/security/2015/dsa-3426). Additionally because of the way shared libraries are loaded in Linux after you apply the patches you might have old, unpatched versions of (eg openssl) linked into currently running processes. There are a few ways to handle this but a restart is one very simple one that is guaranteed to work. Consequently any Linux machine that has more than about a month of uptime is probably missing patches. 500 days of uptime corresponds to a huge number of unpatched vulnerabilities. So restarting is quite important and is unlikely to go away soon.

pdkl95 11y ago
You don't need to restart to patch openssl. Kernel-patches are usually the only reason a restart is needed. This idea that a restart is needed is Windows-style thinking. > more than about a month of uptime is probably missing patches Only when you don't know how to properly maintain a Linux box. A reboot is one way to handle patches. It is even recommended when you are changing anything related to the startup process. For everything else, you simply need to restart any process using the old libs. If it wasn't a security patch, you can often simply wait for processes to finish normally.
- calpaterson 11y ago
  I did mention that there are multiple options for dealing with out-of-date libraries. I implied it but I didn't make it clear: debian's security team releases a kernel patch about once a month. This is where the ceiling on uptime comes from.
  - regularfry 11y ago
    Only because ksplice got borged. Which, in a funny way, makes this Oracle's fault...

johnny22 11y ago

fast boot is most important for container or virtual machines than actual desktop machines.