3 ms·

Did you pay for an audit of sysvinit and every bash rc script it runs? I can't think of a single init system which has been audited.

• lousken 8y ago
  No I didn't but I can read bash so I can audit that myself and in fact over the years I did read most of those scripts. Also it's just a few lines of code compared to systemd so even one person can do it.
  • joelthelion 8y ago
    > I can read bash Lol. I'm sure you're the only person on earth who can think of all the corner conditions when reading a bash script. Auditing a shell script for security is near impossible to do.
    • lousken 8y ago
      I never said that, at the end of the day it's the same thing with audits, you can have 50 people auditing systemd and they won't find every single mistake either. What I'm saying is that simplicity limits room for mistakes and it gives more people chance to look at it and play with it. The concept is fairly straightforward.
  • josteink 8y ago
    > but I can read bash And all the source code for bash and all the other tools the init-scripts invokes?
  • zbentley 8y ago
    > I can read bash And I can read systemd unit files. That doesn't tell me anything about the security of the system in charge of running them. https://www.cvedetails.com/product/21050/GNU-Bash.html?vendor_id=72 https://www.cvedetails.com/product/21050/GNU-Bash.html?vendo...