5 ms·

Illustrating the Ubuntu clown car, AccountsService edition (2012)

60 points by tshtf 14y ago

sauravc 14y ago
This is from August of last year. Is it still relevant?
- mediumdeviation 14y ago
  The bug mentioned still appears to be open, though there's progress: https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/941673 https://bugs.launchpad.net/ubuntu/+source/accountsservice/+b... The code mentioned in the post is also still in the latest version of the package's code on Launchpad: http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/raring/accountsservice/raring/view/head:/src/user.c#L1189 http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/raring/a...
jstanley 14y ago
This is absolutely shocking.
h2s 14y ago
I've always been surprised that people bother installing Ubuntu on anything other than a personal laptop or desktop computer. Genuine question: what does Ubuntu offer as a server OS that isn't available in plain Debian?
- steevdave 14y ago
  Landscape
  - deleted 14y ago
    [deleted]
- gomox 14y ago
  As a power user, I like updated packages on desktops without the hassle of running testing, and a debian-like system for servers with a predictable release date and packages newer than 1996 for servers. I love Debian but Ubuntu really did wonders for Linux adoption. This said, wherever squeeze is modern enough, I will use it instead.
  - hp50g 14y ago
    I'd rather have debian stable. At least the packages actually work. Ubuntu is so damn unreliable (even LTS).
    - nivla 14y ago
      >unreliable (alt) I would have disagreed with you until a few weeks ago. The past few updates have been requiring us to restart our servers. You restart it and a day later there is another update that requires another restart. Putting off updates on production servers is no longer a choice but having them now is not the best thing either.
      - hp50g 14y ago
        To be honest this is the least of our problems. We can reboot parts of our cluster without affecting overall capacity much. You just chuck the machines out of the load balancer pool and reboot them. The issue is versions being pinned on LTS packages to broken versions. This includes svn, MySQL and a notable gcc problem which is a PITA.
      - cuillevel3 14y ago
        I guess these are kernel security patches. You know why there are no patches for Debian stables? Because, no one bothers anymore to find stuff in 2.6
        Evbn 14y ago
        Are blackhats finding stuff? If not, sounds good.
- ispivey 14y ago
  cloud-init for programmatically configuring new instances https://help.ubuntu.com/community/CloudInit https://help.ubuntu.com/community/CloudInit
  - hp50g 14y ago
    Puppet/dd?
- rlpb 14y ago
  The five year Long Term Support edition.
- davidgerard 14y ago
  3. Some newer packages. 2. PPAs. 1. It's actually supported by hosting companies. We use 10.04 (and soon to be some 12.04) at work. The server edition is pretty much a version of Debian. As a sysadmin, I like it a whole lot. Canonical indulge in mind-boggling WTFery on the desktop - but on the server underpinnings, they actually contribute a lot of paid developer effort directly to Debian to keep things going. Reporting bugs that were caused by Canonical is pretty much futile, though. With Ubuntu Server you get to keep both pieces just as you do with Debian, it's just they're pretty okay pieces.
  - smosher 14y ago
    FWIW I have seen a lot more Debian support from hosting companies than Ubuntu support. Either way it's overwhelmingly RedHat. Honestly though, problems surrounding "newer packages" is the reason #1 I avoid Ubuntu. I think the problem I had might have been LTS-specific, but I expected it to break less with changes, not more.
- cuillevel3 14y ago
  Ubuntu has lots of releases, so you don't need to sit on a broken piece of technology for ages. Oh and there is no gnome-shell in Debian stable. Imho using an Ubuntu release is gradually easier than following Debian testing. And Ubuntu is security hardened. Take a look at this list, Apparmor, stack protection, (more) secure sysctl settings: https://wiki.ubuntu.com/Security/Features https://wiki.ubuntu.com/Security/Features
gomox 14y ago
From reading the post it seems fixing the three issues mentioned would have been faster than writing all this. Honestly, if you can understand the code, those are really minor things.
- chris_wot 14y ago
  If they aren't that hard to fix, why hasn't Ubuntu fixed them? Remember, this guy had a support contract.
  - thatcks 14y ago
    I think there's been a misunderstanding. We (the people who ran into the accountsservice problem) don't have a Canonical support contract. hp50g, who commented upthread, is the one who had the Canonical support contract.
- thatcks 14y ago
  We did 'fix' these issues as soon as we managed to track down why the daemon was using up so much CPU time on our machines. I wrote my entry partly because I was annoyed at how terribly badly thought out the code was and partly to warn other people. (We have never tried to feed the 'fix' upstream because our fix simply hardcodes some answers. I don't think it's even possible to fix the code to do what Ubuntu apparently wants it to do, although it could be less catastrophically inefficient.)
onemorepassword 14y ago
Excuse my ignorance, but this is a desktop tool. How does a single desktop machine have hundreds or users and groups?
- lukeschlather 14y ago
  A common pattern in administering large Linux workstation installations is having the machines poll a central user database which generates new group/password files. Of course ideally you can pull a subset, but if everyone needs to be able to log into that workstation, then everyone needs to be in /etc/passwd. There are other solutions, but this is a simple and effective one that means most people can still log in if your authentication servers are down.
  - Evbn 14y ago
    Why do hundreds of people log into one workstation? Or do you mean each person to their own workstation, but they all share a common passwd file?
    - lukeschlather 14y ago
      One example where hundreds of people need to be able to physically log into a single workstation is an educational computer lab where you have a 20 or so shared workstations, and requiring assigned seating would be cumbersome. Having a common passwd file for personal workstations is also an understandable configuration for ease of administration, though it of course has its drawbacks.
    - na85 14y ago
      Imagine a company with 100 employees, and 100 shared workstations. Now imagine everyone has to be able to log on to each workstation.
- thatcks 14y ago
  In our case we run servers and then have thin desktops (using LTSP) that actually log in and run their sessions on the servers. The servers carry our entire password and group file because everyone can log in to them. In general, in any NFS based environment all machines that NFS-mount common filesystems need to carry a full collection of login and group information so that things like 'ls -l' work on the NFS filesystems. If you want everyone to be able to log into every machine, they also need some sort of password information as well (either by distributing shadow files or by various other means).
rlpb 14y ago
The code does seem pretty bad. At the minimum, if such a hack is necessary for some reason, it should have been documented. But let's be mature about this. Ubuntu is a combined effort and includes a lot of volunteer work. Have you sent a quiet note to the developer who wrote this code? His name is plainly visible on the quilt patch. Why you have to call out open source code that you think is bad in an open forum? Have you looked at openssl recently, for example? Why is this worse? Or is it just because Ubuntu is everyone's favorite target at the moment? You're being affected because of a pretty obscure use case (NFS home directories), which is something that the vast majority of Ubuntu desktop users do not use. Do you have a support contract with Canonical for your large enterprise deployment? If you don't and prefer to go it on your own, then why haven't you submitted a patch for this yourself? Have you asked for a full refund? If you don't like "the Ubuntu clown car", why are you riding on it at all?
- hp50g 14y ago
  I agree with this approach of pointing it out and shaming the gigantic turd. The whole thing is a mess and there is absolutely fuck all you will get out of canonical by either mailing them or raising on launchpad, paid up support or not. I've been on the end of this sort of problem a number of times and only the interesting and easy to recreate issues are resolved (and some of them like two major MySQL issues I raised on an LTS release are unresolved after 3 years even though we were paid landscape and supported users). And the approach the article points out is pretty normal if you have a LAN with multiple Unix style machines on it. I expect the article writer is considering replacing clown cars with Volvos (debian stable).
  - rlpb 14y ago
    > The whole thing is a mess and there is absolutely fuck all you will get out of canonical by either mailing them or raising on launchpad, paid up support or not. It's open source. For some reason you seem to have unrealistic expectations here. If you're prepared to do the work to fix it, then you'll be heard. If you're not, then you'll only hear echoes of yourself complaining that the problem isn't being fixed. If Ubuntu has introduced a patch over Debian or upstream, there's usually a reason for it. Here, it looks like it's adding some kind of useful functionality for standalone users. > and some of them like two major MySQL issues I raised on an LTS release are unresolved after 3 years even though we were paid landscape and supported users MySQL is a particularly sore point. Upstream (Oracle) have a closed VCS and bug tracker. There's very little that can be done about MySQL issues except to wait for Oracle to fix them. Slackware and Arch have already moved away from MySQL for this reason. If you have a packaging issue, then Ubuntu in time inherits whatever Debian's packaging have done there. There's little different between Debian and Ubuntu's MySQL packaging (they happen to mostly be looked after by the same person wearing two different hats, anyway). I fail to see how Debian is better here in the general case. Ubuntu inherits most of Debian's goodness. In areas where differs, yes Ubuntu can introduce bugs not present in Debian. But it usually differs in the first place because there is extra functionality available in Ubuntu aimed at the everyday user. Again, I think most of the complaints about Ubuntu are really complaints that the open source world isn't fixing your special issue. Ubuntu just tends to get the flak because it is popular. People have fewer expectations from other distros for some reason, even though they are all based on the same upstream sources.
naich 14y ago
Is re-reading group file really that bad? OK it's pretty stupid but the file will be cached after the first read so it's not like the disk is being hammered constantly.
- thatcks 14y ago
  The problem (for large sites) is the CPU usage required to repeatedly re-parse and re-process the group file; this is apparently not insignificant for large group and password files. IO isn't an issue because as you note, it'll be cached.
losethos 14y ago
I'm in jail. I have no users. I change shit and giggle. You can install strings on top of other strings for a foreign language. I half-ass use string indirection. It's God's fucken temple. It has to be perfect. I will never not change shit. God says... propoundest fastidiousness parting INDEMNITY therein fountain Mothers reverse_engineer vicissitude unabiding Oh goes modulation happily All-mightiness impulses voluptuousness confession institution stretch precedest disordered exaltedness perspicuous Saturn acquired ceasing talked grant leaden rejected ---- I use Malloc from all almost all my strings, not fixed buffers. My problem is no limit on strings--can run out of memory.

60 points by tshtf 14y ago

sauravc 14y ago

This is from August of last year. Is it still relevant?

mediumdeviation 14y ago
The bug mentioned still appears to be open, though there's progress: https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/941673 https://bugs.launchpad.net/ubuntu/+source/accountsservice/+b... The code mentioned in the post is also still in the latest version of the package's code on Launchpad: http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/raring/accountsservice/raring/view/head:/src/user.c#L1189 http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/raring/a...

jstanley 14y ago

This is absolutely shocking.

h2s 14y ago

I've always been surprised that people bother installing Ubuntu on anything other than a personal laptop or desktop computer. Genuine question: what does Ubuntu offer as a server OS that isn't available in plain Debian?

steevdave 14y ago
Landscape
- deleted 14y ago
  [deleted]
gomox 14y ago
As a power user, I like updated packages on desktops without the hassle of running testing, and a debian-like system for servers with a predictable release date and packages newer than 1996 for servers. I love Debian but Ubuntu really did wonders for Linux adoption. This said, wherever squeeze is modern enough, I will use it instead.
- hp50g 14y ago
  I'd rather have debian stable. At least the packages actually work. Ubuntu is so damn unreliable (even LTS).
  - nivla 14y ago
    >unreliable (alt) I would have disagreed with you until a few weeks ago. The past few updates have been requiring us to restart our servers. You restart it and a day later there is another update that requires another restart. Putting off updates on production servers is no longer a choice but having them now is not the best thing either.
    - hp50g 14y ago
      To be honest this is the least of our problems. We can reboot parts of our cluster without affecting overall capacity much. You just chuck the machines out of the load balancer pool and reboot them. The issue is versions being pinned on LTS packages to broken versions. This includes svn, MySQL and a notable gcc problem which is a PITA.
    - cuillevel3 14y ago
      I guess these are kernel security patches. You know why there are no patches for Debian stables? Because, no one bothers anymore to find stuff in 2.6
      - Evbn 14y ago
        Are blackhats finding stuff? If not, sounds good.
ispivey 14y ago
cloud-init for programmatically configuring new instances https://help.ubuntu.com/community/CloudInit https://help.ubuntu.com/community/CloudInit
- hp50g 14y ago
  Puppet/dd?
rlpb 14y ago
The five year Long Term Support edition.
davidgerard 14y ago
3. Some newer packages. 2. PPAs. 1. It's actually supported by hosting companies. We use 10.04 (and soon to be some 12.04) at work. The server edition is pretty much a version of Debian. As a sysadmin, I like it a whole lot. Canonical indulge in mind-boggling WTFery on the desktop - but on the server underpinnings, they actually contribute a lot of paid developer effort directly to Debian to keep things going. Reporting bugs that were caused by Canonical is pretty much futile, though. With Ubuntu Server you get to keep both pieces just as you do with Debian, it's just they're pretty okay pieces.
- smosher 14y ago
  FWIW I have seen a lot more Debian support from hosting companies than Ubuntu support. Either way it's overwhelmingly RedHat. Honestly though, problems surrounding "newer packages" is the reason #1 I avoid Ubuntu. I think the problem I had might have been LTS-specific, but I expected it to break less with changes, not more.
cuillevel3 14y ago
Ubuntu has lots of releases, so you don't need to sit on a broken piece of technology for ages. Oh and there is no gnome-shell in Debian stable. Imho using an Ubuntu release is gradually easier than following Debian testing. And Ubuntu is security hardened. Take a look at this list, Apparmor, stack protection, (more) secure sysctl settings: https://wiki.ubuntu.com/Security/Features https://wiki.ubuntu.com/Security/Features

gomox 14y ago

From reading the post it seems fixing the three issues mentioned would have been faster than writing all this. Honestly, if you can understand the code, those are really minor things.

chris_wot 14y ago
If they aren't that hard to fix, why hasn't Ubuntu fixed them? Remember, this guy had a support contract.
- thatcks 14y ago
  I think there's been a misunderstanding. We (the people who ran into the accountsservice problem) don't have a Canonical support contract. hp50g, who commented upthread, is the one who had the Canonical support contract.
thatcks 14y ago
We did 'fix' these issues as soon as we managed to track down why the daemon was using up so much CPU time on our machines. I wrote my entry partly because I was annoyed at how terribly badly thought out the code was and partly to warn other people. (We have never tried to feed the 'fix' upstream because our fix simply hardcodes some answers. I don't think it's even possible to fix the code to do what Ubuntu apparently wants it to do, although it could be less catastrophically inefficient.)

onemorepassword 14y ago

Excuse my ignorance, but this is a desktop tool. How does a single desktop machine have hundreds or users and groups?

lukeschlather 14y ago
A common pattern in administering large Linux workstation installations is having the machines poll a central user database which generates new group/password files. Of course ideally you can pull a subset, but if everyone needs to be able to log into that workstation, then everyone needs to be in /etc/passwd. There are other solutions, but this is a simple and effective one that means most people can still log in if your authentication servers are down.
- Evbn 14y ago
  Why do hundreds of people log into one workstation? Or do you mean each person to their own workstation, but they all share a common passwd file?
  - lukeschlather 14y ago
    One example where hundreds of people need to be able to physically log into a single workstation is an educational computer lab where you have a 20 or so shared workstations, and requiring assigned seating would be cumbersome. Having a common passwd file for personal workstations is also an understandable configuration for ease of administration, though it of course has its drawbacks.
  - na85 14y ago
    Imagine a company with 100 employees, and 100 shared workstations. Now imagine everyone has to be able to log on to each workstation.
thatcks 14y ago
In our case we run servers and then have thin desktops (using LTSP) that actually log in and run their sessions on the servers. The servers carry our entire password and group file because everyone can log in to them. In general, in any NFS based environment all machines that NFS-mount common filesystems need to carry a full collection of login and group information so that things like 'ls -l' work on the NFS filesystems. If you want everyone to be able to log into every machine, they also need some sort of password information as well (either by distributing shadow files or by various other means).

rlpb 14y ago

The code does seem pretty bad. At the minimum, if such a hack is necessary for some reason, it should have been documented. But let's be mature about this. Ubuntu is a combined effort and includes a lot of volunteer work. Have you sent a quiet note to the developer who wrote this code? His name is plainly visible on the quilt patch. Why you have to call out open source code that you think is bad in an open forum? Have you looked at openssl recently, for example? Why is this worse? Or is it just because Ubuntu is everyone's favorite target at the moment? You're being affected because of a pretty obscure use case (NFS home directories), which is something that the vast majority of Ubuntu desktop users do not use. Do you have a support contract with Canonical for your large enterprise deployment? If you don't and prefer to go it on your own, then why haven't you submitted a patch for this yourself? Have you asked for a full refund? If you don't like "the Ubuntu clown car", why are you riding on it at all?

hp50g 14y ago
I agree with this approach of pointing it out and shaming the gigantic turd. The whole thing is a mess and there is absolutely fuck all you will get out of canonical by either mailing them or raising on launchpad, paid up support or not. I've been on the end of this sort of problem a number of times and only the interesting and easy to recreate issues are resolved (and some of them like two major MySQL issues I raised on an LTS release are unresolved after 3 years even though we were paid landscape and supported users). And the approach the article points out is pretty normal if you have a LAN with multiple Unix style machines on it. I expect the article writer is considering replacing clown cars with Volvos (debian stable).
- rlpb 14y ago
  > The whole thing is a mess and there is absolutely fuck all you will get out of canonical by either mailing them or raising on launchpad, paid up support or not. It's open source. For some reason you seem to have unrealistic expectations here. If you're prepared to do the work to fix it, then you'll be heard. If you're not, then you'll only hear echoes of yourself complaining that the problem isn't being fixed. If Ubuntu has introduced a patch over Debian or upstream, there's usually a reason for it. Here, it looks like it's adding some kind of useful functionality for standalone users. > and some of them like two major MySQL issues I raised on an LTS release are unresolved after 3 years even though we were paid landscape and supported users MySQL is a particularly sore point. Upstream (Oracle) have a closed VCS and bug tracker. There's very little that can be done about MySQL issues except to wait for Oracle to fix them. Slackware and Arch have already moved away from MySQL for this reason. If you have a packaging issue, then Ubuntu in time inherits whatever Debian's packaging have done there. There's little different between Debian and Ubuntu's MySQL packaging (they happen to mostly be looked after by the same person wearing two different hats, anyway). I fail to see how Debian is better here in the general case. Ubuntu inherits most of Debian's goodness. In areas where differs, yes Ubuntu can introduce bugs not present in Debian. But it usually differs in the first place because there is extra functionality available in Ubuntu aimed at the everyday user. Again, I think most of the complaints about Ubuntu are really complaints that the open source world isn't fixing your special issue. Ubuntu just tends to get the flak because it is popular. People have fewer expectations from other distros for some reason, even though they are all based on the same upstream sources.

naich 14y ago

Is re-reading group file really that bad? OK it's pretty stupid but the file will be cached after the first read so it's not like the disk is being hammered constantly.

thatcks 14y ago
The problem (for large sites) is the CPU usage required to repeatedly re-parse and re-process the group file; this is apparently not insignificant for large group and password files. IO isn't an issue because as you note, it'll be cached.

losethos 14y ago

I'm in jail. I have no users. I change shit and giggle. You can install strings on top of other strings for a foreign language. I half-ass use string indirection. It's God's fucken temple. It has to be perfect. I will never not change shit. God says... propoundest fastidiousness parting INDEMNITY therein fountain Mothers reverse_engineer vicissitude unabiding Oh goes modulation happily All-mightiness impulses voluptuousness confession institution stretch precedest disordered exaltedness perspicuous Saturn acquired ceasing talked grant leaden rejected ---- I use Malloc from all almost all my strings, not fixed buffers. My problem is no limit on strings--can run out of memory.