razighter777

5 ms·

31.
by razighter777 10mo ago
Hi, I listened to the podcast it was interesting. Gonna throw some questions you may or may not have gotten. Are special devices like metadata or write-ahead log devices on the roadmap? Or distributed raid / other exotic raid types? It
32.
by razighter777 10mo ago
I am into nix! it's me and my gf's daily driver. thank you.
33.
by razighter777 10mo ago
Both are great tech but solve the problem of safety differently. I would say Fil-c is great for non-performance-critical (think like somewhere between c and go/java, still very fast) existing C programs where compatibility with the exi
34.
by razighter777 10mo ago
I hope this project gets more traction. I would love to see a memory safe battle tested sudo or polkit in my package manager without having to install a potentially workflow breaking replacement.
35.
by razighter777 11mo ago
Valid concern. Maybe this can be addressed with a patch... Seems solvable by perhaps storing paths that don't exist yet on the filesystem in landlock's red black tree. Workaround might be creating .ssh ahead of time
36.
by razighter777 11mo ago
There's always a lot of caution and review that goes into a new syscall feature, because once you add a feature, there's no takebacks. All the libraries downstream from landlock rely on the kernel API being good. There is an ongoi
37.
by razighter777 11mo ago
Landlock isn't really an alternative to containers. You can use it as another layer of security, within or outside a container. It could even be paired with a chroot to make a container runtime. It's more like a building block for
38.
by razighter777 11mo ago
whoops it got added by the post creation form. I thought it would appear as a subtitle not a comment lol
39.
by razighter777 11mo ago
Systemd's exec capabilities are great, but don't allow the application developer to dynamically restrict access rights to resources. So you could restrict a text editor for instance to the file it was launched to edit, instead o
40.
by razighter777 11mo ago
You can restrict the landlock syscalls with seccomp. I also don't think doing so is extraordinarily useful. If you allow something in landlock, it's still subject to traditional DAC and other restrictions because its a stackable L
41.
by razighter777 11mo ago
The kernel enforces that once the policy gets added it can't be removed. So the restrictions are permanent for the life of the program. Even root can't undo them.
42.
by razighter777 11mo ago
Yup. In the application code itself is where landlock shines at the moment. It's becoming increasingly usable as a wrapper for untrusted applications as well.
43.
by razighter777 11mo ago
Comparing landlock to containers isn't really an apples to apples comparison. Containers use a bunch of linux security mechanisms together like chroot seccomp and user namespaces to accomplish their goals. Landlock is just another buil
44.
by razighter777 11mo ago
Yup. There are tools that use landlock to accomplish just that. https://github.com/Zouuup/landrun All you gotta do is apply a policy and do a fork() exec(). There is also support in firejail.
45.
Landlock-Ing Linux(blog.prizrak.me)
291 points by razighter777 11mo ago|120 comments
46.
by razighter777 11mo ago
Most of us sane people tend to be more quiet unfortunately. I enjoy rust, but I enjoy not breaking things for users and making lives harder for other devs even more.
47.
by razighter777 11mo ago
> I'd rather see over-the-top evangelism than the lack of it, because the latter implies that things aren't going to change very fast. No new technology should be an excuse to engage in unprofessional conduct. When you propose
48.
by razighter777 11mo ago
Agreed. I think that announcement was unprofessional. This was a unilateral decision affecting other's hard work, and the author didn't provide them the opportunity to provide feedback on the change. It disregards the importance o
49.
by razighter777 11mo ago
I was diagnosed ADD as well. This is my exact experience. Usually my focus being too strong on things I like, and an inability to direct it elsewhere towards uninteresting tasks. (picking up, making bed, dishes)
50.
by razighter777 11mo ago
So glad I bought 128gb ddr5 for my desktop a year ago... I usually don't need it all but it was cheap at the time. Most I use it for is cpu offloading for LLMs too big for my 3090 and for running 10 or so small VMs for my projects.
51.
by razighter777 11mo ago
No good answer to which is better for the money. I say bring it all. Diversity in renewable energy sources is important for grid resilience. Some areas are gonna be terrible for solar and good for wind. Some areas might not have proper wate
52.
DevOps-ifying my blog: Hugo on K8s with Git-sync and fluxcd(blog.prizrak.me)
1 points by razighter777 11mo ago|2 comments
53.
by razighter777 11mo ago
How I deployed hugo on k8s with k8s,tailwind, fluxcd, and git-sync.
54.
by razighter777 11mo ago
I think the focus should be on tools with high surface area that enforce security bounadaries. Especially those where performance is not so important. Like sudo, openssh, polkit, PAM modules. It would be make a lot more sense than these hal
55.
by razighter777 1y ago
They can be revealed volunarily by the author, but FULU can't require or condone it. Because of the DMCA section 1201, trafficking in circumvention tools to violate digital locks is a felony punishable by 3-5 years in federal prison.
56.
Show HN: Pinpam, TPM2-backed pin authentication for Linux(github.com)
4 points by razighter777 1y ago|0 comments
57.
by razighter777 1y ago
Great work from the OpenBSD team. Happily suprised to the continued commitment to support new hardware.
58.
by razighter777 1y ago
Shame this fantastic, carefully engineered and unique technology is locked behind closed source drivers, non-upgradable hardware and tamper resistent boot processes. I love apple silicon... if only they would launch some sort of product or
59.
by razighter777 1y ago
When a government feels the need to implement technical control measures against ordinary citizens, the tight leash that the people had on their government's authority is broken. Mass censorship, surviellence, and erosion of privacy a
60.
by razighter777 1y ago
What about making side loading require some moderate level of technical sophistication? Like connecting to the phone over usb and having to manually type some long shell commands, or exit vim, or write a compiling c program, or some other l

More ›