3 ms·
>But basically, I don't think "possible security bugs" is a valid argument against any new technology. NCD is not inherently more vulnerable than any other syst
by rjzzleep 13y ago
>But basically, I don't think "possible security bugs" is a valid argument against any new technology. NCD is not inherently more vulnerable than any other system for network configuration.
it wasn't so much a case against "new technology", but rather a case against: "here's a full scripting language that runs as root, oh and btw it can print and run arbitrary commands"
to me it seems like ncd is almost too capable for non hacking / network debugging purposes. a subset would be good i guess.
Also root sounds bad. At least in linux you can always restrict it to things like CAP_NET_ADMIN, but i'm not exactly a linux security wiz, so i'm sure there's better things.
- ambrop7 13y agoI was just saying that NCD is not particularly exposed to attacks in the first place. Yes, the DHCP needs to be moved outside, but everything else is pretty much a non-issue. The IPC that NCD can do (if you use it) is no more exposed than D-Bus is.
- ambrop7 13y ago> a subset would be good i guess No. NCD was designed with the goal that you can program whatever the heck you want. By design, the core NCD language does not have any knowledge of network things. Only some commands do.