4 ms·

The "sysvinit" binary package has had a total of 2 bug reports tagged "security" filed in Debian's bug tracker. That's over the entire history of the package th

by avian 10y ago

The "sysvinit" binary package has had a total of 2 bug reports tagged "security" filed in Debian's bug tracker. That's over the entire history of the package that goes back to at least 2004. If I extend the search to all packages built from the "sysvinit" source (which includes packages like initscripts and sysvinit-utils), the count increases to 8. (source: https://www.debian.org/Bugs https://www.debian.org/Bugs. I'm not linking to exact queries since they take quite some time and HN has a tendency of taking down Debian's bug tracker)

kuschku 10y ago
At the same time, the list of bug reports that the init scripts used with sysvinit had (because they all had to replicate the same code, in different ways, patched together from some stackoverflow post) is uncountable.
- qwertyuiop924 10y ago
  That's not an inherent problem: bsd's rc.subrs and similar systems exist, which fix this issue in a sysv/bsd style init system. They don't even technically require patching init itself. Systemd's problems are deeper in. One major one is most of its design, and its entire conception.
JdeBP 10y ago
van Smoorenburg init dates from 1992. Considering its bug history from age 12 to age 25 and comparing that to systemd's bug history from age 5 to age 6 is at the very best misleading. At age 4, van Smoorenburg init was panicking when /etc/inittab had blank lines. At age 6, van Smoorenburg init was having a buffer overflow in init.c fixed. Counting the CVE bugs is a silly approach. It is far better to look at the coding practices that are followed in a project. Are APIs designed and implemented consistently? When a functional change is made, is the doco always changed at the same time to match? Are the reasons for seemingly odd things properly recorded for maintenance programmers in the future to read? There are many, far better, questions to ask in place of how many CVE listings something has had in some arbitrary interval in its lifetime.
- cestith 10y ago
  Why is it misleading? Why if we had something safe and stable because of its age and refinement is that an excuse to stuff something less mature in its place? Personally I like unit files rather than bespoke Bash scripts, I like dependency-driven parallel startup, and I like getting a daemon watchdog for free. That's about where I'd have ended the feature requests, though. I'd also like it to be roughly as secure as what it's replacing.
  - qwertyuiop924 10y ago
    OpenRC (and to some extent, the BSDs), already have dep-driven startup, and OpenRC supports parallel startup. Also, with rc.subrs and whatever OpenRC calls it, the init files can be pretty damn descriptive, and very concise.
  - JdeBP 10y ago
    For the reasons given. Read again, properly. Pay particular attention to the statement that counting CVE listings is a silly approach. Then think, and consider that if that alone is silly, what must counting two sets of CVE listings from entirely different parts of two projects' lifetimes be. Then read on a find a whole lot of better questions to ask. For bonus points, try asking yourself them about various systems. (-:
- qwertyuiop924 10y ago
  so if Vsinit is stable and bug free right now, why switch to something that isn't? Also, systemd has had two bad exoploits over the course of about a year. The flaws in Vsinit you point out were two years apart, and the former of the two could only be triggered by someone who was already an admin, and gave no opportunity for privesc. Given, init panicking is never acceptable, but it's a heck of a lot better than what systemd did.
  - JdeBP 10y ago
    Anyone who erroneously thinks that van Smoorenburg rc is bug free hasn't spent time fixing the whole host of faulty, incomplete, and rickety van Smoorenburg rc scripts that exist. It is also erroneous to propound the old There Is Only System 5 init And systemd fallacy, which is just bunkum. * https://news.ycombinator.com/item?id=13477512 https://news.ycombinator.com/item?id=13477512

by avian 10y ago

kuschku 10y ago

At the same time, the list of bug reports that the init scripts used with sysvinit had (because they all had to replicate the same code, in different ways, patched together from some stackoverflow post) is uncountable.

qwertyuiop924 10y ago
That's not an inherent problem: bsd's rc.subrs and similar systems exist, which fix this issue in a sysv/bsd style init system. They don't even technically require patching init itself. Systemd's problems are deeper in. One major one is most of its design, and its entire conception.

JdeBP 10y ago

van Smoorenburg init dates from 1992. Considering its bug history from age 12 to age 25 and comparing that to systemd's bug history from age 5 to age 6 is at the very best misleading. At age 4, van Smoorenburg init was panicking when /etc/inittab had blank lines. At age 6, van Smoorenburg init was having a buffer overflow in init.c fixed. Counting the CVE bugs is a silly approach. It is far better to look at the coding practices that are followed in a project. Are APIs designed and implemented consistently? When a functional change is made, is the doco always changed at the same time to match? Are the reasons for seemingly odd things properly recorded for maintenance programmers in the future to read? There are many, far better, questions to ask in place of how many CVE listings something has had in some arbitrary interval in its lifetime.

cestith 10y ago
Why is it misleading? Why if we had something safe and stable because of its age and refinement is that an excuse to stuff something less mature in its place? Personally I like unit files rather than bespoke Bash scripts, I like dependency-driven parallel startup, and I like getting a daemon watchdog for free. That's about where I'd have ended the feature requests, though. I'd also like it to be roughly as secure as what it's replacing.
- qwertyuiop924 10y ago
  OpenRC (and to some extent, the BSDs), already have dep-driven startup, and OpenRC supports parallel startup. Also, with rc.subrs and whatever OpenRC calls it, the init files can be pretty damn descriptive, and very concise.
- JdeBP 10y ago
  For the reasons given. Read again, properly. Pay particular attention to the statement that counting CVE listings is a silly approach. Then think, and consider that if that alone is silly, what must counting two sets of CVE listings from entirely different parts of two projects' lifetimes be. Then read on a find a whole lot of better questions to ask. For bonus points, try asking yourself them about various systems. (-:
qwertyuiop924 10y ago
so if Vsinit is stable and bug free right now, why switch to something that isn't? Also, systemd has had two bad exoploits over the course of about a year. The flaws in Vsinit you point out were two years apart, and the former of the two could only be triggered by someone who was already an admin, and gave no opportunity for privesc. Given, init panicking is never acceptable, but it's a heck of a lot better than what systemd did.
- JdeBP 10y ago
  Anyone who erroneously thinks that van Smoorenburg rc is bug free hasn't spent time fixing the whole host of faulty, incomplete, and rickety van Smoorenburg rc scripts that exist. It is also erroneous to propound the old There Is Only System 5 init And systemd fallacy, which is just bunkum. * https://news.ycombinator.com/item?id=13477512 https://news.ycombinator.com/item?id=13477512