So it's true what some-of-you'all been saying all along about systemd!
;-D
One question: any smell of intentional obfuscation for this vulnerability, or is it impossible to tell?
;-D
One question: any smell of intentional obfuscation for this vulnerability, or is it impossible to tell?
If this were not buried in systemd, but was part of a standalone dhcpd package, would it have been done better or caught earlier?
One of the major criticisms of systemd is that it wants to take over all system management functions. In order to do that it needs to offer at least minimally functional versions of all the services it pushes out. It should not be news to anyone that trying to do everything instead of integrating with existing projects leads to sloppiness.
This incident is evidence suggesting that other serious issues are lurking in systemd as a result of the actions naturally arising from their policy.
Centralized management/monitoring in general sucks. People don't seem to understand the problem and keep reinventing new centralized architectures suitable for their own special cases, instead of addressing that on architecture level.
Systemd didn't invent a DSL. It uses the existing config language from D-Bus (whether or not you think that's a good language is another matter).
> uses proper architecture with clearly defined boundaries
What boundaries in systemd aren't clearly defined?
> allowing custom application-specific management
What do you mean by this?
If one is going to rewrite all of these things, I would expect one to learn from the history and not make the same mistakes over again.
One of the more popular DHCP clients is 'dhcpcd', which was created and is maintained by Roy Marples, the creator of OpenRC. It's fine when someone wants to work on DHCP clients and init systems, unless that init system is systemd?
(And for the record, systemd integrates wonderfully with dhcpcd.)
I always think that anytime there's an interesting bug in ANYTHING. I'm not an expert, but I would think it would be nearly impossible to tell the difference between "someone made a mistake" and "someone made this look like a mistake". I would think any decent programmer with malicious intent could do that anytime they wanted.