7 ms·

Somehow you think I'm talking about systemd and init scripts and the things they do. I'm not. The original question I replied to was about why pipes (or any O

by jude- 12y ago

Somehow you think I'm talking about systemd and init scripts and the things they do. I'm not. The original question I replied to was about why pipes (or any OS-level IPC) shouldn't try to solve application-level problems. My arguments are that the OS's IPC should not enforce an IPC record structure, but should enforce a consistent set of IPC access methods (i.e. pipes, sockets, shared memory, message queues, etc.) defined independently of applications. I think we're in agreement about the latter--if the OS were to let each application have it's own IPC access methods, then there would be as many access methods as there are applications (leading to tightly-coupled "truly monolithic mess"). I don't think we've reached agreement on the former. I claimed that there is no "best record structure" for all applications, so the OS shouldn't try to enforce one. I also mentioned that human-readable text is the universal data format, which is both a manifestation of this principle (i.e. the OS imposes no constraints on the structure of bytes passed between programs) and a desirable outcome since parsing text is super-simple to implement (by contrast, take a look at the examples in dbus-send(1) to see how painful the alternative can be). You disagree--you think the IPC system should also handle things like serialization and validation. The problem is that serialization and validation are both application-specific (and even context-specific) concerns, and for the IPC system to address them, it has to gain knowledge from the application. But this lets the application set IPC access methods, which we've already agreed is a bad idea! My (extreme) example to prove this point was that pushing validation responsibility from the application into the IPC system would require it to handle ridiculous application-specific corner cases, like defining a socket class that makes sure that your bank account password won't be sent to the wrong host (still not sure how you concluded that that remark was about systemd). The point is, if you want your IPC system to handle validation for you, you're just asking for trouble. The same type of problem occurs when you put serialization into the IPC system. The serializer has to know whether or not a string of bytes represents a valid application-defined record. If you make serialization the IPC system's responsibility, it needs application-level knowledge on whether or not an inbound message represents a valid message (which also leads to ridiculous corner cases). DBus not only enforces structured records (bad), but also lets applications define their own IPC access methods (worse). The RPC-like nature of DBus means that both peers must not only agree on the interpretation of bytes in advance, but also agree on the semantics of accessing them. Unlike reading from a pipe, accessing the value of a DBus object by name can have arbitrary side-effects which the requester must be aware of. In the limit, this puts us into the undesirable situation of having each application-to-application pair agree on an IPC access method, leading to the tight coupling nightmare. Don't get me wrong--DBus has its use-cases. OS-level IPC isn't one of them. I wish systemd folks took some time to think about this, but they're too busy trying to make DBus into OS-level IPC with no regards to the consequences. See kdbus and the SOCK_BUS socket class it exports. Now, nitpicks: > But you know what? DBus is basically human readible with a bit more imposed structure than generic streams /me falls out of chair too. Now you're just being daft :) The more structure you impose on bytes, the less human-readable it gets. For example, I don't think I have to explain to you why this comment is more legible as rendered in your browser (unstructured text) than as raw HTML (structured records). > DBus isn't the new shiny. It's the old shiny CORBA is the old shiny ;) See also: https://en.wikipedia.org/wiki/Remote_procedure_call#Other_RPC_analogues https://en.wikipedia.org/wiki/Remote_procedure_call#Other_RP... > The one bit of additional coolness it brings to the table is the support for socket activation Not the IPC system's responsibility. See also: https://en.wikipedia.org/wiki/Xinetd https://en.wikipedia.org/wiki/Xinetd > You don't benefit from having to reimplement an entire security apparatus with each component Of course--you use a library and an RPC stub generator for this. Not really part of the "design principles of IPC" discussion we've got going, though.

cbsmith 12y ago
> The original question I replied to was about why pipes (or any OS-level IPC) shouldn't try to solve application-level problems. That maybe what you read, but the context of drdaemon's statement was specifically in response to a question about communications with the init daemon, and of course everything I said after was as well... Glad we got that settled. > Not the IPC system's responsibility. Hmm... IPC systems need to have ways of matching up the parties in a conversation, and having one where you don't have to enforce who calls whom first and parties don't have to mutually agree upon the specific endpoints in advance sure seems like something an IPC system might want to have... particularly one employed in an init system... > See also: https://en.wikipedia.org/wiki/Xinetd https://en.wikipedia.org/wiki/Xinetd As discussed here: http://0pointer.de/blog/projects/systemd.html http://0pointer.de/blog/projects/systemd.html There absolutely is a ton of overlap between what systemd does with socket activation and what Xinetd has evolved to... but as with evenone else doing OS design, there comes a point where you leave Xinetd behind and let the full potential of that trick work in your favour. > Now you're just being daft :) Me and the folks at Wikipedia: http://en.wikipedia.org/wiki/Comparison_of_data_serialization_formats http://en.wikipedia.org/wiki/Comparison_of_data_serializatio... Don't get me wrong, I think a lot of the Wikipedians are pretty daft, but they are as reasonable a judge of human readability as I can imagine, given what they do. > CORBA is the old shiny ;) CORBA is the old shiny-my-god-we-dont-need-nearly-all-of-that-and-it-really-benefits-a-bootstrapped-systems-so-there-is-a-chicken-and-egg-prolem-here. But yeah, close. I don't think anyone has seriously considered that since the OS/2 & Workplace OS days... and even then. That said, I would say that THESE DAYS (unlike in its heyday), CORBA is a pretty awesome robust, feature rich _general purpose_ distributed IPC system. > Of course--you use a library and an RPC stub generator for this. Ah, so it is much more modularized if it runs as an executable piece of code in process than a piece of executable code out of process. Got it. ;-) > Not really part of the "design principles of IPC" discussion we've got going, though. Well, that's the discussion you're having. I'm trying to talk about the design constraints and appropriate solutions for the problem domain...
- jude- 12y ago
  > As discussed here: http://0pointer.de/blog/projects/systemd.html http://0pointer.de/blog/projects/systemd.html Lennart Poetterring claims that you should use his software instead of someone else's software! I'm SHOCKED! Full story at 11. Seriously now, did you honestly think that he would say to use xinetd over systemd? Do you honestly believe a developer will advocate the use of a competing piece of software over something (s)he produced? > There absolutely is a ton of overlap between what systemd does with socket activation and what Xinetd has evolved to... but as with evenone else doing OS design, there comes a point where you leave Xinetd behind and let the full potential of that trick work in your favour. Unless you don't feel like replacing small, simple, easy-to-use, well-tested xinetd with the 200K-line pile of C code that is systemd. Besides, I've got your socket activation right here: Start the daemon, have the daemon open a port, and let the kernel swap it to disk. The kernel will swap it back in when it receives a connection for it. Benefits: * the daemon preserves state between "activations" for free * the kernel gives you this feature for free Security: * the daemon doesn't have to trust another userspace program with anything * the daemon can use mlock() to prevent sensitive pages from getting swapped * if this isn't enough, you can encrypt the swap partition to resist offline attacks Resources: * If disk is too expensive, disk is read-only, you have no swap, you have no CAP_IPC_LOCK, the daemon would need to mlock() too much RAM, and you can't encrypt your swap, there's xinetd. * Need to apply filters or QoS controls on connections before waking up the daemon? That's what the firewall is for. Trivia: * You can have xinetd trigger whatever event you want, since all it does is fire up a program and run it. This includes alerting other programs, like a service manager, that it got a connection, and maybe even sending along the message (or the file descriptor) if you want. There is no need for systemd to subsume this responsibility. As you can see, "socket activation" is by and large a marketing gimmick. > Me and the folks at Wikipedia:... You think an article that compares data serialization protocols somehow proves your ludicrous claim that human readable text is less readable than marked-up text? Maybe daft was too nice a word... > Ah, so it is much more modularized if it runs as an executable piece of code in process than a piece of executable code out of process. Got it. ;-) Sir/madam, have you ever written an Internet-facing daemon? Obviously the bulk of the RPC logic lives in a shared library. You know, a logically distinct module that can be independently installed, loaded once, and independently maintained. Besides, procedurally-generated RPC-handling code adds no technical debt to your project, anymore than the compiler's generated assembler output does. You seem to want to replace the RPC shared library with a separate process. Not only will this make create a performance bottleneck, but also it makes it a single point of failure. If it crashes, all your daemons lose their connections. This is obviously highly undesirable, especially on servers. > Well, that's the discussion you're having. I'm trying to talk about the design constraints and appropriate solutions for the problem domain... I think I'm done with you. You deserve everything systemd will ever do for you.

by jude- 12y ago

cbsmith 12y ago

> The original question I replied to was about why pipes (or any OS-level IPC) shouldn't try to solve application-level problems. That maybe what you read, but the context of drdaemon's statement was specifically in response to a question about communications with the init daemon, and of course everything I said after was as well... Glad we got that settled. > Not the IPC system's responsibility. Hmm... IPC systems need to have ways of matching up the parties in a conversation, and having one where you don't have to enforce who calls whom first and parties don't have to mutually agree upon the specific endpoints in advance sure seems like something an IPC system might want to have... particularly one employed in an init system... > See also: https://en.wikipedia.org/wiki/Xinetd https://en.wikipedia.org/wiki/Xinetd As discussed here: http://0pointer.de/blog/projects/systemd.html http://0pointer.de/blog/projects/systemd.html There absolutely is a ton of overlap between what systemd does with socket activation and what Xinetd has evolved to... but as with evenone else doing OS design, there comes a point where you leave Xinetd behind and let the full potential of that trick work in your favour. > Now you're just being daft :) Me and the folks at Wikipedia: http://en.wikipedia.org/wiki/Comparison_of_data_serialization_formats http://en.wikipedia.org/wiki/Comparison_of_data_serializatio... Don't get me wrong, I think a lot of the Wikipedians are pretty daft, but they are as reasonable a judge of human readability as I can imagine, given what they do. > CORBA is the old shiny ;) CORBA is the old shiny-my-god-we-dont-need-nearly-all-of-that-and-it-really-benefits-a-bootstrapped-systems-so-there-is-a-chicken-and-egg-prolem-here. But yeah, close. I don't think anyone has seriously considered that since the OS/2 & Workplace OS days... and even then. That said, I would say that THESE DAYS (unlike in its heyday), CORBA is a pretty awesome robust, feature rich _general purpose_ distributed IPC system. > Of course--you use a library and an RPC stub generator for this. Ah, so it is much more modularized if it runs as an executable piece of code in process than a piece of executable code out of process. Got it. ;-) > Not really part of the "design principles of IPC" discussion we've got going, though. Well, that's the discussion you're having. I'm trying to talk about the design constraints and appropriate solutions for the problem domain...

jude- 12y ago
> As discussed here: http://0pointer.de/blog/projects/systemd.html http://0pointer.de/blog/projects/systemd.html Lennart Poetterring claims that you should use his software instead of someone else's software! I'm SHOCKED! Full story at 11. Seriously now, did you honestly think that he would say to use xinetd over systemd? Do you honestly believe a developer will advocate the use of a competing piece of software over something (s)he produced? > There absolutely is a ton of overlap between what systemd does with socket activation and what Xinetd has evolved to... but as with evenone else doing OS design, there comes a point where you leave Xinetd behind and let the full potential of that trick work in your favour. Unless you don't feel like replacing small, simple, easy-to-use, well-tested xinetd with the 200K-line pile of C code that is systemd. Besides, I've got your socket activation right here: Start the daemon, have the daemon open a port, and let the kernel swap it to disk. The kernel will swap it back in when it receives a connection for it. Benefits: * the daemon preserves state between "activations" for free * the kernel gives you this feature for free Security: * the daemon doesn't have to trust another userspace program with anything * the daemon can use mlock() to prevent sensitive pages from getting swapped * if this isn't enough, you can encrypt the swap partition to resist offline attacks Resources: * If disk is too expensive, disk is read-only, you have no swap, you have no CAP_IPC_LOCK, the daemon would need to mlock() too much RAM, and you can't encrypt your swap, there's xinetd. * Need to apply filters or QoS controls on connections before waking up the daemon? That's what the firewall is for. Trivia: * You can have xinetd trigger whatever event you want, since all it does is fire up a program and run it. This includes alerting other programs, like a service manager, that it got a connection, and maybe even sending along the message (or the file descriptor) if you want. There is no need for systemd to subsume this responsibility. As you can see, "socket activation" is by and large a marketing gimmick. > Me and the folks at Wikipedia:... You think an article that compares data serialization protocols somehow proves your ludicrous claim that human readable text is less readable than marked-up text? Maybe daft was too nice a word... > Ah, so it is much more modularized if it runs as an executable piece of code in process than a piece of executable code out of process. Got it. ;-) Sir/madam, have you ever written an Internet-facing daemon? Obviously the bulk of the RPC logic lives in a shared library. You know, a logically distinct module that can be independently installed, loaded once, and independently maintained. Besides, procedurally-generated RPC-handling code adds no technical debt to your project, anymore than the compiler's generated assembler output does. You seem to want to replace the RPC shared library with a separate process. Not only will this make create a performance bottleneck, but also it makes it a single point of failure. If it crashes, all your daemons lose their connections. This is obviously highly undesirable, especially on servers. > Well, that's the discussion you're having. I'm trying to talk about the design constraints and appropriate solutions for the problem domain... I think I'm done with you. You deserve everything systemd will ever do for you.