3 ms·

Most of this can be done with Ansible. So why should I download images from a 3rd party outside of the Fedora project? If you really want to harden an OS with

Most of this can be done with Ansible. So why should I download images from a 3rd party outside of the Fedora project? If you really want to harden an OS with a good SElinux implementation you should try enabling user roles. Last time I tried that was maybe Fedora 20 something and it broke a lot.

secureblue 3y ago
Most of this can be done with Ansible. All of this can be done in several ways. Ansible, manually, a script, etc. Building it into an image just makes it more convenient. So why should I download images from a 3rd party outside of the Fedora project? All of the CICD is completely open and transparent. You can read through the github actions logs and build config to verify everything for yourself if you want. If you really want to harden an OS with a good SElinux implementation you should try enabling user roles. Agreed, that would be a massive improvement. There's a SIG upstream working on it.
- INTPenis 3y ago
  The ublue images are useful to people, so I'm sure your images will be useful to someone. I'm just making a judgement call for myself. Any other project ontop of Fedora increases the attack vector with its own maintainers. If I can choose between legible Ansible yaml, and an ISO, I find the yaml much easier to grasp and understand. Bundling things you could easily do with yaml into an ISO is almost obfuscation. Because most people are not going to read or understand your build config and logs. While Ansible yaml is clearly labeled and tagged for each action.
  - secureblue 3y ago
    I'm just making a judgement call for myself. Any other project ontop of Fedora increases the attack vector with its own maintainers. Totally understandable. an ISO Small point of correction: we're not publishing ISOs.
Garcia98 3y ago
I see this (and other ublue images) as an alternative to Ansible, rather than just an image. I could fork this repo, automate PRs from upstream with a GH action while making my own changes to it and keep an automated CI/CD pipeline. This painless extensibility is a big advantage imo over traditional distributions.
bravetraveler 3y ago
Heck, all of this can be done with the installer - Anaconda, with kickstart. I don't understand these spins/release patterns Most of these several gig ISOs amount to two dozen lines of scripting in the kickstarts
- bravetraveler 3y ago
  note: I realize this release takes advantage of OSTree - that's pretty solid. Flipping an installation to another is clever. I can't edit now but thought this deserved mention

secureblue 3y ago

Most of this can be done with Ansible. All of this can be done in several ways. Ansible, manually, a script, etc. Building it into an image just makes it more convenient. So why should I download images from a 3rd party outside of the Fedora project? All of the CICD is completely open and transparent. You can read through the github actions logs and build config to verify everything for yourself if you want. If you really want to harden an OS with a good SElinux implementation you should try enabling user roles. Agreed, that would be a massive improvement. There's a SIG upstream working on it.

INTPenis 3y ago
The ublue images are useful to people, so I'm sure your images will be useful to someone. I'm just making a judgement call for myself. Any other project ontop of Fedora increases the attack vector with its own maintainers. If I can choose between legible Ansible yaml, and an ISO, I find the yaml much easier to grasp and understand. Bundling things you could easily do with yaml into an ISO is almost obfuscation. Because most people are not going to read or understand your build config and logs. While Ansible yaml is clearly labeled and tagged for each action.
- secureblue 3y ago
  I'm just making a judgement call for myself. Any other project ontop of Fedora increases the attack vector with its own maintainers. Totally understandable. an ISO Small point of correction: we're not publishing ISOs.

Garcia98 3y ago

I see this (and other ublue images) as an alternative to Ansible, rather than just an image. I could fork this repo, automate PRs from upstream with a GH action while making my own changes to it and keep an automated CI/CD pipeline. This painless extensibility is a big advantage imo over traditional distributions.

bravetraveler 3y ago

Heck, all of this can be done with the installer - Anaconda, with kickstart. I don't understand these spins/release patterns Most of these several gig ISOs amount to two dozen lines of scripting in the kickstarts

bravetraveler 3y ago
note: I realize this release takes advantage of OSTree - that's pretty solid. Flipping an installation to another is clever. I can't edit now but thought this deserved mention