3 ms·

I feel like there is a huge upcoming market for well designed developer-centric tools that allow developers to use stuff like SELinux without also becoming a sy

I feel like there is a huge upcoming market for well designed developer-centric tools that allow developers to use stuff like SELinux without also becoming a sysadmin. SELinux feels like a tool only a system admin could love. Puppet (or Chef, Ansible etc) feel like only a tool a release automation engineer could love. Startups and small companies rarely spend enough on operations and I feel as if there is bit of a death by a thousand paper cuts across the board for productivity and security due to tools written for sysadmins, and "devops" engineers.

pjmlp 10y ago
Any good developer should be able to have a good grasp of basic sysadmin activities.
vacri 10y ago
> Puppet (or Chef, Ansible etc) feel like only a tool a release automation engineer could love. The devil is in the details. Things like logs, packaging, and email sound dead easy, but they get complex fast. Trivial implementations ('just on my own workstation') are always dead easy, but making actual environments that scale sensibly is difficult and rapidly run into all sorts of edge cases. Configuration management tools are complex because configuration management is complex. You can always move with the herd and go Docker instead... but now instead of managing the configuration management tool... you're managing Docker, which is just as much overhead and has more edge cases you need to cater to. If you want simple tools, then constrain yourself and run in a managed environment (eg AWS's Beanstalk). As soon as you want environmental flexibility, you open a can of worms that can only be dealt with using a complex tool.
stoic 10y ago
We sysadmins don't exactly love it, either...
apurvadave 10y ago
The feeling you describe here is part of what led to the design of Sysdig Falco (http://www.sysdig.org/falco http://www.sysdig.org/falco). While certainly not a 1:1 SELinux replacement, our goal was to use a much simpler, understandable model for describing & monitoring security policies for linux hosts.

pjmlp 10y ago

Any good developer should be able to have a good grasp of basic sysadmin activities.

vacri 10y ago

> Puppet (or Chef, Ansible etc) feel like only a tool a release automation engineer could love. The devil is in the details. Things like logs, packaging, and email sound dead easy, but they get complex fast. Trivial implementations ('just on my own workstation') are always dead easy, but making actual environments that scale sensibly is difficult and rapidly run into all sorts of edge cases. Configuration management tools are complex because configuration management is complex. You can always move with the herd and go Docker instead... but now instead of managing the configuration management tool... you're managing Docker, which is just as much overhead and has more edge cases you need to cater to. If you want simple tools, then constrain yourself and run in a managed environment (eg AWS's Beanstalk). As soon as you want environmental flexibility, you open a can of worms that can only be dealt with using a complex tool.

stoic 10y ago

We sysadmins don't exactly love it, either...

apurvadave 10y ago

The feeling you describe here is part of what led to the design of Sysdig Falco (http://www.sysdig.org/falco http://www.sysdig.org/falco). While certainly not a 1:1 SELinux replacement, our goal was to use a much simpler, understandable model for describing & monitoring security policies for linux hosts.