4 ms·

My fingers still type ifconfig, netstat, and route, and then I correct myself usually before hitting enter (though that took at least a couple of years). The ne

My fingers still type ifconfig, netstat, and route, and then I correct myself usually before hitting enter (though that took at least a couple of years). The new commands are more consistent, and more logically laid out so I can't argue against switching...but, my muscle memory doesn't know them yet (despite having started switching years ago). It seems pretty clear unlearning the old and learning the new is more work than learning it for the first time, which may be why so many old-timers are so disagreeable to changes like this, even if the new is clearly superior (and for the average user, these may not be clearly superior enough to justify extra effort). Hell, I caught myself typing an ipchains command a week or so ago (while I'm busy learning about nftables which replaces iptables/ip6tables!), and I haven't had a system that had ipchains in more than a decade.

bittermang 9y ago
Now if we can just teach the Internet how to unlearn. Go ahead, search with your favorite web crawler. Something simple like "command line ip address". It will tell you to use ifconfig -a.
sandGorgon 9y ago
is nftables production ready ? or is everyone still at iptables/ipchains ?
- SwellJoe 9y ago
  You're fine sticking with iptables for now, if you don't experience any pain from it. ipchains has been compltely dead for well over a decade (which is why it's so ridiculous that I'd start typing an ipchains command); iptables arrived in 2001 and was on everything by the mid-2000s. The difference with that transition was that you couldn't keep using ipchains, because it was replaced by iptables. nftables co-exists with iptables. nftables works well and has been available in mainline Linux for a few years, but there's little support for it at the distribution and tools and documentation level. AFAIK, things like firewalld and other firewall management tools don't support it yet (though firewalld will support it transparently when it does arrive, so if you use firewalld to manage your iptables firewalls, it'll probably Just Work when switching to nftables). We don't yet support it in our products (while we do support firewalld, iptables, and some third party firewall management tools like CSF have modules for Webmin). iptables continues to be supported at all levels, so there is no urgency to switching, though nftables is clearly superior in nearly every way. It's an awesome tool, but adoption has been very, very slow. I think that's unfortunate, as it's an area where I'd be willing to learn new things. nft has really clean syntax with super powerful abstractions and hooks into the kernel. So, if you manage a lot of Linux firewalls, or a few very complex ones, maybe you want to switch already...I would, if I were in that situation. But, I just use firewalld, because my firewall needs are minimal these days.
  - sandGorgon 9y ago
    do you see a python 2 -> python 3 situation happening with nftables ? because that is a shame. I personally cant wait for pfsense quality products to come on Linux.
    - SwellJoe 9y ago
      I think Linux is just such a big ecosystem now, with such a huge variety of dependent parties, that nothing can change fast anymore, and nothing can ever die. So many products are built around iptables, so many docs assume iptables, etc. It's just cheaper for people to keep using iptables. Doing an ipchains->iptables style conversion where the next version of Linux just completely removed the old thing, wouldn't be feasible today. Linux is orders of magnitude bigger than it was from the transition 2.2 to 2.4 (I think that was when the iptables switch happened). It's "only" been four years since nftables made it to mainline kernel, so we're not quite into Python 3 territory, but I wouldn't be surprised if we're still having this conversation in five more years. There's just no movement toward nftables, at all, that I perceive. I think it's partly because firewalls matter less today than they once did. So much is in the cloud now, where the firewall is somebody else's problem. It might even end up being a Perl 5->6 situation, but we won't know for a few more years.
  - mwcampbell 9y ago
    What do you think of ufw? It's native to Ubuntu, but it's also in Debian and Fedora (just checked the latter with Docker). I chose it over firewalld for my simple firewall needs because I run Debian and Ubuntu rather than Fedora and CentOS, and there's no daemon in ufw, so IMO it's simpler.

bittermang 9y ago

Now if we can just teach the Internet how to unlearn. Go ahead, search with your favorite web crawler. Something simple like "command line ip address". It will tell you to use ifconfig -a.

sandGorgon 9y ago

is nftables production ready ? or is everyone still at iptables/ipchains ?

SwellJoe 9y ago
You're fine sticking with iptables for now, if you don't experience any pain from it. ipchains has been compltely dead for well over a decade (which is why it's so ridiculous that I'd start typing an ipchains command); iptables arrived in 2001 and was on everything by the mid-2000s. The difference with that transition was that you couldn't keep using ipchains, because it was replaced by iptables. nftables co-exists with iptables. nftables works well and has been available in mainline Linux for a few years, but there's little support for it at the distribution and tools and documentation level. AFAIK, things like firewalld and other firewall management tools don't support it yet (though firewalld will support it transparently when it does arrive, so if you use firewalld to manage your iptables firewalls, it'll probably Just Work when switching to nftables). We don't yet support it in our products (while we do support firewalld, iptables, and some third party firewall management tools like CSF have modules for Webmin). iptables continues to be supported at all levels, so there is no urgency to switching, though nftables is clearly superior in nearly every way. It's an awesome tool, but adoption has been very, very slow. I think that's unfortunate, as it's an area where I'd be willing to learn new things. nft has really clean syntax with super powerful abstractions and hooks into the kernel. So, if you manage a lot of Linux firewalls, or a few very complex ones, maybe you want to switch already...I would, if I were in that situation. But, I just use firewalld, because my firewall needs are minimal these days.
- sandGorgon 9y ago
  do you see a python 2 -> python 3 situation happening with nftables ? because that is a shame. I personally cant wait for pfsense quality products to come on Linux.
  - SwellJoe 9y ago
    I think Linux is just such a big ecosystem now, with such a huge variety of dependent parties, that nothing can change fast anymore, and nothing can ever die. So many products are built around iptables, so many docs assume iptables, etc. It's just cheaper for people to keep using iptables. Doing an ipchains->iptables style conversion where the next version of Linux just completely removed the old thing, wouldn't be feasible today. Linux is orders of magnitude bigger than it was from the transition 2.2 to 2.4 (I think that was when the iptables switch happened). It's "only" been four years since nftables made it to mainline kernel, so we're not quite into Python 3 territory, but I wouldn't be surprised if we're still having this conversation in five more years. There's just no movement toward nftables, at all, that I perceive. I think it's partly because firewalls matter less today than they once did. So much is in the cloud now, where the firewall is somebody else's problem. It might even end up being a Perl 5->6 situation, but we won't know for a few more years.
- mwcampbell 9y ago
  What do you think of ufw? It's native to Ubuntu, but it's also in Debian and Fedora (just checked the latter with Docker). I chose it over firewalld for my simple firewall needs because I run Debian and Ubuntu rather than Fedora and CentOS, and there's no daemon in ufw, so IMO it's simpler.