4 ms·

> your question about grsecurity+pax is nonsensical in the context of SmartOS ... no? Because many of the grsecurity+pax improvements apply to any kernel that

by cyphar 10y ago

> your question about grsecurity+pax is nonsensical in the context of SmartOS ... no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. Unless you're claiming the illumos cannot ever have a security bug. > pkgsrc, and by extension SmartOS, fully supports installing binary packages. Apologies, I was thinking of a different packaging system in FreeBSD. However, from my reading of the blog you linked pkgsrc only had support for signatures of packages in 2014. GNU/Linux has had this for a very long time. My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers. > and here is another document pointing out how SmartOs has a nearly 14,000 package library of the latest version of software which normally runs on Linux; versions of which are usually newer than on Linux, Only 14000? Also, what distribution of GNU/Linux, what version of the distribution, how much automated QA happens before releases, etc? > I'd argue that you haven't seen or used anything but Linux. Untrue. > but it's really not my fault you haven't read SmartOS and Solaris documentation. It's not my fault that you haven't read the source code of runC without stating an ignorant opinon about how it works, based on a mix of outdated information and pure fabrication. > That would be akin to me claiming that [...] SmartOS is better than GNU/Linux without knowing about the Linux technology you're arguing about? > I'm surprised that you don't know that Docker had to re-invent a kludgy copy of init precisely because of this problem, or else you would not have asked me that. This is all not true, and you should know better. Docker/runC doesn't have an init process in containers. You _can_ run an init process, but it isn't necessary. In addition, the zombie problem doesn't exist because of sub-reapers which are a Linux kernel feature. You might not accept the existence of such features, but that's your perogative. I asked you because I guessed that you didn't know about the GNU/Linux side of things. Thanks for not letting me down on that one. > As for insisting on Docker because it's popular, it's flawed picking something based on popularity; I answered your question of why Docker was popular, now you're complaining that I am talking about Docker because it's popular? What. In addition, I am a maintainer of runC and actually care much more about the OCI than Docker. There are some cool things coming from the Solaris and illumos folks, too bad that you're stuck in your ways and won't even consider the possibility that any GNU/Linux technology is good. That's just insane*. > To claim that SmartOS has no development tools, ... when did I claim that? I claimed that it doesn't have anything like Linux when it comes to security frameworks like grsecurity+pax, UEFI support, hardware and driver support. You haven't addressed those arguments (claiming that grsecurity+pax isn't useful for SmartOS is showing that you don't know what it is or how it works).

Annatar 10y ago
.. no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. grsecurity is a set of patches for the GNU/Linux kernel. illumos is based on Solaris, so the entire argument about grsecurity is nonsense. illumos uses red zones to prevent buffer overflows, which grsecurity is attempting to address. grsecurity is a commercial product by the way. A single license costs $19,000 USD. Enhanced auditing and process control which grsecurity provides have been part of Solaris, and therefore illumos, since Solaris 10, some even earlier. GNU/Linux is still playing catch-up, and as long as people like myself, Bryan Cantrill, Adam Leventhal and the rest of the former Sun kernel engineers live, it will be playing catch-up forever. My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers. In order for that opinion of yours to actually mean anything, the question is: how many packaging formats do you know to produce packages for? Only then will you be in a position where you would actually be competent to make such a statement, and where your opinion would actually make a difference. I myself have packaged for HP-UX, IRIX, Solaris, GNU/Linux (RPM), GNU/Linux (DPKG), and SmartOS (pkgsrc), so I'm in a position to make such statements, and yet I didn't. You, on the other hand, apparently have no such inhibitions. Only 14000? "Only". If you had packaged, you would have known that the same body of software could be delivered by an arbitrary number of packages, since that depends on the packager(s), respectively on the architecture. Also, what distribution of GNU/Linux, what version of the distribution, how much automated QA happens before releases, etc? The same thing which happens on GNU/Linux; if you think that packages on GNU/Linux get tested like a classic UNIX vendor would test it, you're naive. This is all not true, and you should know better. Docker/runC doesn't have an init process in containers. You _can_ run an init process, but it isn't necessary. Is that right? https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/ https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zomb... In addition, the zombie problem doesn't exist because of sub-reapers which are a Linux kernel feature. As it stands, I've worked with Linux extensively and I've never heard of such a thing. Please show me that code, for if you actually manage to show me that, I will have learned something new. In addition, I am a maintainer of runC and actually care much more about the OCI than Docker. Aaahhh, so that's why you keep on blindly lobbying for Docker. Now we finally get to the bottom of the thing. Couldn't you just be honest from the onset like I was on what your motivation is, so everybody knows where everybody stands? So basically, you're trying to re-invent project Kevlar, Solaris zones, in a completely generic way so as to be everything and not be anything in particular to anyone. Did you not study UNIX, and the old Henry Spencer's saying those who do not understand UNIX are condemned to re-invent it -- badly? You could just bite the bullet and benefit from a complete, enterprise, battle tested solution with a decade of use behind it, and use Solaris zones by using vmadm(1M) in SmartOS, you know. No need to re-invent the wheel. Again. How many more solutions does GNU/Linux need in order to be able to run lightweight virtual machines? Can't you people engineer one solution which actually works properly, like we have it in illumos? Apparently that's too much to ask. Or you could just use zones, which have been working for a decade, and actually let one run lightweight virtual servers running at the speed of bare metal in production, today: https://smartos.org/man/1m/vmadm https://smartos.org/man/1m/vmadm https://smartos.org/man/1m/zoneadm https://smartos.org/man/1m/zoneadm https://www.youtube.com/watch?v=hgN8pCMLI2U https://www.youtube.com/watch?v=hgN8pCMLI2U As for "OCI", I have no idea what you're writing about. To me, an oldschool UNIX guy, "OCI" stands for "Oracle Call Interface": http://www.oracle.com/technetwork/database/features/oci/index.html http://www.oracle.com/technetwork/database/features/oci/inde... Finally, a word on your question about setting up Manta. Apparently it's open source: https://github.com/joyent/manta https://github.com/joyent/manta ...which means you can set it up seven ways 'till Sunday, and do with it whatever you please, however you please. I myself don't use it, because I design my availability into the application I write, and my interest is in the infrastructure layer anyway, where things like DNS are designed to be highly available from the onset (again availability in the application, and not the OS layer). http://dtrace.org/blogs/dap/2013/07/03/fault-tolerance-in-manta/ http://dtrace.org/blogs/dap/2013/07/03/fault-tolerance-in-ma...

by cyphar 10y ago

Annatar 10y ago

.. no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. grsecurity is a set of patches for the GNU/Linux kernel. illumos is based on Solaris, so the entire argument about grsecurity is nonsense. illumos uses red zones to prevent buffer overflows, which grsecurity is attempting to address. grsecurity is a commercial product by the way. A single license costs $19,000 USD. Enhanced auditing and process control which grsecurity provides have been part of Solaris, and therefore illumos, since Solaris 10, some even earlier. GNU/Linux is still playing catch-up, and as long as people like myself, Bryan Cantrill, Adam Leventhal and the rest of the former Sun kernel engineers live, it will be playing catch-up forever. My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers. In order for that opinion of yours to actually mean anything, the question is: how many packaging formats do you know to produce packages for? Only then will you be in a position where you would actually be competent to make such a statement, and where your opinion would actually make a difference. I myself have packaged for HP-UX, IRIX, Solaris, GNU/Linux (RPM), GNU/Linux (DPKG), and SmartOS (pkgsrc), so I'm in a position to make such statements, and yet I didn't. You, on the other hand, apparently have no such inhibitions. Only 14000? "Only". If you had packaged, you would have known that the same body of software could be delivered by an arbitrary number of packages, since that depends on the packager(s), respectively on the architecture. Also, what distribution of GNU/Linux, what version of the distribution, how much automated QA happens before releases, etc? The same thing which happens on GNU/Linux; if you think that packages on GNU/Linux get tested like a classic UNIX vendor would test it, you're naive. This is all not true, and you should know better. Docker/runC doesn't have an init process in containers. You _can_ run an init process, but it isn't necessary. Is that right? https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/ https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zomb... In addition, the zombie problem doesn't exist because of sub-reapers which are a Linux kernel feature. As it stands, I've worked with Linux extensively and I've never heard of such a thing. Please show me that code, for if you actually manage to show me that, I will have learned something new. In addition, I am a maintainer of runC and actually care much more about the OCI than Docker. Aaahhh, so that's why you keep on blindly lobbying for Docker. Now we finally get to the bottom of the thing. Couldn't you just be honest from the onset like I was on what your motivation is, so everybody knows where everybody stands? So basically, you're trying to re-invent project Kevlar, Solaris zones, in a completely generic way so as to be everything and not be anything in particular to anyone. Did you not study UNIX, and the old Henry Spencer's saying those who do not understand UNIX are condemned to re-invent it -- badly? You could just bite the bullet and benefit from a complete, enterprise, battle tested solution with a decade of use behind it, and use Solaris zones by using vmadm(1M) in SmartOS, you know. No need to re-invent the wheel. Again. How many more solutions does GNU/Linux need in order to be able to run lightweight virtual machines? Can't you people engineer one solution which actually works properly, like we have it in illumos? Apparently that's too much to ask. Or you could just use zones, which have been working for a decade, and actually let one run lightweight virtual servers running at the speed of bare metal in production, today: https://smartos.org/man/1m/vmadm https://smartos.org/man/1m/vmadm https://smartos.org/man/1m/zoneadm https://smartos.org/man/1m/zoneadm https://www.youtube.com/watch?v=hgN8pCMLI2U https://www.youtube.com/watch?v=hgN8pCMLI2U As for "OCI", I have no idea what you're writing about. To me, an oldschool UNIX guy, "OCI" stands for "Oracle Call Interface": http://www.oracle.com/technetwork/database/features/oci/index.html http://www.oracle.com/technetwork/database/features/oci/inde... Finally, a word on your question about setting up Manta. Apparently it's open source: https://github.com/joyent/manta https://github.com/joyent/manta ...which means you can set it up seven ways 'till Sunday, and do with it whatever you please, however you please. I myself don't use it, because I design my availability into the application I write, and my interest is in the infrastructure layer anyway, where things like DNS are designed to be highly available from the onset (again availability in the application, and not the OS layer). http://dtrace.org/blogs/dap/2013/07/03/fault-tolerance-in-manta/ http://dtrace.org/blogs/dap/2013/07/03/fault-tolerance-in-ma...