Hacker News Reader

Comment by mwambua | Hacker News Reader

I'm pretty excited about this! I started using f22 after using Ubuntu for a number of years, and I was particularly impressed by its package management. I personally find yum/dnf easier to use than apt and slightly more transparent. F24 has been an exceptional release and I look forward to running 25 on a pi.

Hopefully we'll have a Pi with better IO by the time it releases. :)

View on HN

It's nice that it's a unified command (yum vs. apt-get, apt-cache, etc.) and the commands do seem less obtuse. I've been using Fedora since the first cut, and by and large it's always been pretty great.

The one thing I'd like to see ported over is ufw, as that's one thing about Ubuntu to envy. firewall-cmd is downright annoying and bizarrely designed.

I'll agree with you on firewall-cmd. One major problem is its documentation. They should initially provide really simple instructions on getting a base firewall (22,443,80) going... And then provide instructions on how to do zoning and what-not on the side.

I like the idea of firewalld, but what I don't like is the way you have to do things like --list--all-zones and other nonsense. The end results are good, it's just how you have to implement them that's ridiculous.

At least Ansible provides a tidy wrapper for it.

git has a reputation for being annoyingly quirky, but firewalld is leaps ahead in terms of marching to the beat of its own drum.

You should give some of the BSD package tools a try for less obtuse package commands.

Yeah, but then I'd have to go BSD, which at this point is really going to be an obstacle.

IMO just learn the real iptables commands. They're seriously one-liners with just a few args, and then you'll know how to set up a basic firewall on most distros. https://fedoraproject.org/wiki/How_to_edit_iptables_rules is the fedora guide. There are others. Here's how to disable firewalld: https://fedoraproject.org/wiki/FirewallD#Using_static_firewa...

Note here that if everyone just spent the 5 minutes it takes to learn the few basic iptables commands, we wouldn't have ufw and firewalld and firehol and vuurmuur and Crazy Bob's Super Simple VBA-to-XML iptables rule generator. Every attempt at making iptables "easy", I consider harmful, as it's a basic systems administration skill that people continually hurt themselves by not learning. iptables is not hard, but all of these wrappers make it hard by introducing their own dumb syntax while adding complexity and quashing any hope of a standard interface between distros to control networking rules, which iptables already was before they tried to "fix" it.

iptables is obsolete btw, Linux kernel developers replaced it with nftables.

From their docs, nftables is "available upstream since Linux kernel 3.13. It supports 3/4 of the existing iptables features" - 3/4 is still a long way to obsoleting iptables.

I used to hold the same opinion as you, but I've recently changed my opinion of firehol; it's a little higher level than ufw and friends, and highly encourages good practices which are easy to forget or get wrong if you iptables all the way.

I've realised that when I noticed that the comments I wrote for others on my iptable configs were comparable in length and content to firehol (but not verifiable or executable). Unlike ufw, firehol actually saved me significant time and effort even though I know (and use) iptables directly.

nice you like firehol. iptables is still very hard in certain context. Try for example to setup a load balancer for non-sibling IPs, with client affinity, or use SYNPROXY together with NAT. I have spent 3 weeks in fulltime to handle all these cases properly in firehol.

Thank you very much for firehol, it is great! Haven't had time to use netdata, but it looks great as well!

"apt" is the unified command for apt-get etc, since a year or two ago.

"apt" already combines all those apt-* in one command.

> Hopefully we'll have a Pi with better IO by the time it releases. :)

Are there any official plans to release a new model with, say, an on-board SSD connector or SATA port? Or is this just "Hopefully" as in "Hopefully it stops raining before I have to walk to the train station"?

Very likely the latter. All the "innovation" happens in the mobile phone SoC space. My two years old phone is already good enough. Any improvement beyond it is a nice bonus but I could easily live without. Yet the ARM SBCs are so far behind.

I'm betting at some point in the future phones have progressed so fast that it's better to just dump them into a server rack with ethernet over USB 2.0 than to actually buy ARM servers.

Yeah, it's a little sad. ARM based servers have been on the horizon for a couple of years now, but they seem to be forever out of reach. :-/

Reply on news.ycombinator.com