3 ms·

My apologies, but your entire comment reads like this: "They are dumb, because they don't do it how I would do it. I know better. They are so stupid." I'm not

by akulbe 10y ago

My apologies, but your entire comment reads like this: "They are dumb, because they don't do it how I would do it. I know better. They are so stupid." I'm not a security professional by any means, but I'm interested in learning how to do stuff better. Can you please reframe your response with solutions, and not snark?

Annatar 10y ago
> Can you please reframe your response with solutions, and not snark? Hardly, as it would require writing a book. But, what I can do is give you some starting points: https://wiki.smartos.org/display/DOC/Home https://wiki.smartos.org/display/DOC/Home Set up a TFTP server, a DHCP server, and use PXEGrub (ipxe is flaky). Boot the system off of the network. As soon as you log in, read the manual pages for imgadm(1M), and vmadm(1M), then pull down the "base64" image. Also read up on Solaris zones. Oracle documentation will do, as SmartOS and Solaris 10 are similar to a good degree. Next, read up on pkgsrc, and make a simple "helloworld" package. After you get all that working, get Gemalto SmartCard code working on SmartOS (as Solaris was a big market for SmartCards, the code should still work on SmartOS). > "They are dumb, because they don't do it how I would do it. I know better. To summarize: if you want security, you have no business running Linux-anything, not now, not ever: the choices are either OpenBSD or SmartOS, and rejoice that we do have alternatives.
- acdha 10y ago
  > if you want security, you have no business running Linux-anything, not now, not ever: the choices are either OpenBSD or SmartOS, and rejoice that we do have alternatives. That's a very bold assertion and you haven't even tried to back it up. Who do you think is going to read that and say “some random Internet commenter is right and Google/Facebook/the NSA/etc. must all be incompetent”? You really need to back that claim up and do so comprehensively across the entire security landscape from basic design to operational concerns like patch management. (As an example: I've never logged into a Solaris / Illumos machine which was current on security updates because the admins didn't have the confidence which Debian admins have had since the 90s that updates won't break things. I'm open to the argument that they're all paranoid or incompetent but that's probably the most important real world security task and it at least merits discussion)
  - Annatar 10y ago
    > Who do you think is going to read that and say “some random Internet commenter is right and Google/Facebook/the NSA/etc. must all be incompetent”? That depends on one's experience level, to have the requisite experience to recognize a solution which one should do one's homework on, when someone mentions it, and so will anyone else who has been doing this kind of work long enough. For example, the NSA has been both using and modifying (Open)Solaris for decades now; you can find their papers on securing it with IPsec and locking the OS down, as they've been released to the public. They are still relevant, both in illumos / SmartOS and security context today. Now with virtualization, cloud and containers, moreso than ever. NSA was prescient, or at the very least had common sense. Apropos Google, Facebook, trendy... two things: "if a hundred million flies all eat shit, surely they can't be wrong?" I've been doing this container, virtualization and UNIX long before Facebook and Google even got the idea, even before those companies existed (;-) When you dedicate every waking moment of your life to studying and mastering UNIX, not only professionally but privately, in time you obtain the insights needed to understand and evaluate what is and isn't good technology. Put enough priority 1 incidents and sleepless nights behind you, and you will know what works, and what doesn't. As Paul Graham so aptly put it, "When you choose technology, you have to ignore what other people are doing, and consider only what will work the best." http://www.paulgraham.com/avg.html http://www.paulgraham.com/avg.html
  - Annatar 10y ago
    > As an example: I've never logged into a Solaris / Illumos machine which was current on security updates because the admins didn't have the confidence which Debian admins have had since the 90s that updates won't break things. I want to adress this separately: UNIX and Solaris, from which SmartOS stems, practically invented the concept of backwards compatibility, the guaranteed not to break application binary interface, and paranoia about end to end data integrity. The system administrators' concerns are themselves disconcerting: imagine you need to have a brain tumor removed, and the surgeon who is to remove it is not specialized in neurosurgery? You write about sysadmins who are unfamiliar with the subject matter... and as professional system administrators, they well should be. With this in mind, would you trust them to know what they are doing?

by akulbe 10y ago

Annatar 10y ago

> Can you please reframe your response with solutions, and not snark? Hardly, as it would require writing a book. But, what I can do is give you some starting points: https://wiki.smartos.org/display/DOC/Home https://wiki.smartos.org/display/DOC/Home Set up a TFTP server, a DHCP server, and use PXEGrub (ipxe is flaky). Boot the system off of the network. As soon as you log in, read the manual pages for imgadm(1M), and vmadm(1M), then pull down the "base64" image. Also read up on Solaris zones. Oracle documentation will do, as SmartOS and Solaris 10 are similar to a good degree. Next, read up on pkgsrc, and make a simple "helloworld" package. After you get all that working, get Gemalto SmartCard code working on SmartOS (as Solaris was a big market for SmartCards, the code should still work on SmartOS). > "They are dumb, because they don't do it how I would do it. I know better. To summarize: if you want security, you have no business running Linux-anything, not now, not ever: the choices are either OpenBSD or SmartOS, and rejoice that we do have alternatives.

acdha 10y ago
> if you want security, you have no business running Linux-anything, not now, not ever: the choices are either OpenBSD or SmartOS, and rejoice that we do have alternatives. That's a very bold assertion and you haven't even tried to back it up. Who do you think is going to read that and say “some random Internet commenter is right and Google/Facebook/the NSA/etc. must all be incompetent”? You really need to back that claim up and do so comprehensively across the entire security landscape from basic design to operational concerns like patch management. (As an example: I've never logged into a Solaris / Illumos machine which was current on security updates because the admins didn't have the confidence which Debian admins have had since the 90s that updates won't break things. I'm open to the argument that they're all paranoid or incompetent but that's probably the most important real world security task and it at least merits discussion)
- Annatar 10y ago
  > Who do you think is going to read that and say “some random Internet commenter is right and Google/Facebook/the NSA/etc. must all be incompetent”? That depends on one's experience level, to have the requisite experience to recognize a solution which one should do one's homework on, when someone mentions it, and so will anyone else who has been doing this kind of work long enough. For example, the NSA has been both using and modifying (Open)Solaris for decades now; you can find their papers on securing it with IPsec and locking the OS down, as they've been released to the public. They are still relevant, both in illumos / SmartOS and security context today. Now with virtualization, cloud and containers, moreso than ever. NSA was prescient, or at the very least had common sense. Apropos Google, Facebook, trendy... two things: "if a hundred million flies all eat shit, surely they can't be wrong?" I've been doing this container, virtualization and UNIX long before Facebook and Google even got the idea, even before those companies existed (;-) When you dedicate every waking moment of your life to studying and mastering UNIX, not only professionally but privately, in time you obtain the insights needed to understand and evaluate what is and isn't good technology. Put enough priority 1 incidents and sleepless nights behind you, and you will know what works, and what doesn't. As Paul Graham so aptly put it, "When you choose technology, you have to ignore what other people are doing, and consider only what will work the best." http://www.paulgraham.com/avg.html http://www.paulgraham.com/avg.html
- Annatar 10y ago
  > As an example: I've never logged into a Solaris / Illumos machine which was current on security updates because the admins didn't have the confidence which Debian admins have had since the 90s that updates won't break things. I want to adress this separately: UNIX and Solaris, from which SmartOS stems, practically invented the concept of backwards compatibility, the guaranteed not to break application binary interface, and paranoia about end to end data integrity. The system administrators' concerns are themselves disconcerting: imagine you need to have a brain tumor removed, and the surgeon who is to remove it is not specialized in neurosurgery? You write about sysadmins who are unfamiliar with the subject matter... and as professional system administrators, they well should be. With this in mind, would you trust them to know what they are doing?