4 ms·

The dependency is attributable, in the largest part, to systemd's neoplastic aggrandizement of userland infrastructure and associated plumbing, making this a di

The dependency is attributable, in the largest part, to systemd's neoplastic aggrandizement of userland infrastructure and associated plumbing, making this a distinction without much of a difference.

XorNot 3y ago
"everyone should just reimplement LZMA!" What could possibly go wrong. I'm sure there's no history of compression tools having serious vulnerabilities due to implementation errors...
- inopinatus 3y ago
  This is another furphy, because OpenSSH proper neither requires nor uses xz/lzma. It's made clear in Andres Freund's original report¹ that the libsystemd dependency dragging it along arises from distros patching openssh to support systemd notifications. The sad part is that systemd notifications are just a datagram on a socket, so using libsystemd for this is reminiscent of Joe Armstrong's banana. [1] https://seclists.org/oss-sec/2024/q1/268 https://seclists.org/oss-sec/2024/q1/268
  - LtWorf 3y ago
    As many have already pointed out, the library can also be linked to sshd via selinux.
    - inopinatus 3y ago
      I've seen that ambit claim too, but I'm not even sure what distro(s) it is referring to since I'm unable to confirm it on any host where I have ldd casually to hand. Ref however https://seclists.org/oss-sec/2024/q1/356 https://seclists.org/oss-sec/2024/q1/356
      - deleted 3y ago
        [deleted]
      - usr1106 3y ago
        That packaging error makes liblzma being pulled in at installation (well, it's probably already there if pid 1 requires it). But it will not make the sshd binary use it. So I think the original claim stands: Without patching sshd for the notification it will not use liblzma. Disclaimer: I did not search for all possible occurrences of dlopen().
    - himinlomax 3y ago
      https://github.com/proposal-signals/proposal-signals https://github.com/proposal-signals/proposal-signals > libselinux does not link to liblzma. It turns out the confusion was because of an old downstream-only patch in Fedora and a stale dependency in the RPM spec which persisted long-beyond its removal.
- xxs 3y ago
  I get the sentiment. zstd is just better, though! Other than that I did try a manual port (of zstd) to Java but I was not pleased with the results. The other part is that systemd uses plain unix sockets with the most basic of protocols (that part along with docker forwarder was doable)

The dependency is attributable, in the largest part, to systemd's neoplastic aggrandizement of userland infrastructure and associated plumbing, making this a distinction without much of a difference.

XorNot 3y ago

"everyone should just reimplement LZMA!" What could possibly go wrong. I'm sure there's no history of compression tools having serious vulnerabilities due to implementation errors...

inopinatus 3y ago
This is another furphy, because OpenSSH proper neither requires nor uses xz/lzma. It's made clear in Andres Freund's original report¹ that the libsystemd dependency dragging it along arises from distros patching openssh to support systemd notifications. The sad part is that systemd notifications are just a datagram on a socket, so using libsystemd for this is reminiscent of Joe Armstrong's banana. [1] https://seclists.org/oss-sec/2024/q1/268 https://seclists.org/oss-sec/2024/q1/268
- LtWorf 3y ago
  As many have already pointed out, the library can also be linked to sshd via selinux.
  - inopinatus 3y ago
    I've seen that ambit claim too, but I'm not even sure what distro(s) it is referring to since I'm unable to confirm it on any host where I have ldd casually to hand. Ref however https://seclists.org/oss-sec/2024/q1/356 https://seclists.org/oss-sec/2024/q1/356
    - deleted 3y ago
      [deleted]
    - usr1106 3y ago
      That packaging error makes liblzma being pulled in at installation (well, it's probably already there if pid 1 requires it). But it will not make the sshd binary use it. So I think the original claim stands: Without patching sshd for the notification it will not use liblzma. Disclaimer: I did not search for all possible occurrences of dlopen().
  - himinlomax 3y ago
    https://github.com/proposal-signals/proposal-signals https://github.com/proposal-signals/proposal-signals > libselinux does not link to liblzma. It turns out the confusion was because of an old downstream-only patch in Fedora and a stale dependency in the RPM spec which persisted long-beyond its removal.
xxs 3y ago
I get the sentiment. zstd is just better, though! Other than that I did try a manual port (of zstd) to Java but I was not pleased with the results. The other part is that systemd uses plain unix sockets with the most basic of protocols (that part along with docker forwarder was doable)