3 ms·
> The xz fiasco has shown how a dependence on unpaid volunteers can cause major problems. To be honest it has also shown that it wasn't all too wise at all to
by TacticalCoder 3y ago
> The xz fiasco has shown how a dependence on unpaid volunteers can cause major problems.
To be honest it has also shown that it wasn't all too wise at all to introduce a completely needless dependency on a rube-goldberg piece of software in what was otherwise something created by security-minded people.
openbsd -> openssh
vs:
systemd Linux distros -> openssh -> (lib)systemd -> endless potential venues for backdoors (oh, look, we just found one)
I'd give Theo de Raadt a thumb up and Poettering a thumb down here, again.
Seriousy, why the fuck did Linux have to be polluted with that gigantic squid that systemd is, throwing is tentacles about just everywhere. I know, I know, there are distros out there not using systemd but they're rare.
I find it very weird that so many people keep downplaying the role of libsystemd here (makes me wonder what their agenda is).
- sho_hn 3y ago> I'd give Theo de Raadt a thumb up and Poettering a thumb down here, again. Poettering didn't talk distros into patching openssh to call libsystemd's sd_notify(), and if you look at the PR for dropping libsystemd's linking of liblzma you can also see him take a stance against the dependency there.