SEL4 and derivatives.
For starters.
And if you want to simply go by vulnerability counts, as though that meant something, let's throw in MenuetOS and TempleOS.
296 karma · joined March 11, 2024
Account abandoned due to Daddy Dang personally disliking my sarcasm or tone, not because guidelines were being broken.
Enforce consistently or not at all.
For starters.
And if you want to simply go by vulnerability counts, as though that meant something, let's throw in MenuetOS and TempleOS.
Sure, see any of the previous exploits for sshd, or any other software shipped in the OpenBSD default install.
> I keep asking this as a long-time OpenBSD user who is genuinely interested in seeing it done, but so far everyone who has said "it's flawed" also reserved themselves the convenience of not having to prove their point in a practical sense.
The point is they have very little in the way of containing attackers and restricting what they can. Until pledge and unveil, almost all their focus in on eliminating bugs which hey, great, but let's have a little more in case you miss a bug and someone breaks in, eh?
An insecure dockerized webserver protected with SELinux is safer than Apache on a default OpenBSD install.
But, sure, in that case fail2ban won't mitigate, but that's pretty damn obviously implied. For 99% of people and situations, it will.
It's not security theater but it's kind of outdated. Single Packet Authentication[0] is a significant improvement.
> How many exploits rendered cold dead in their tracks by port-knocking shall we need before people stop saying port-knocking is security theater?
Port knocking is one layer, but it shouldn't be the only one, or even a heavily relied upon one. Plenty of people might be in a position to see the sequence of ports you knock, for example.
Personally, I think if more people bothered to learn tools like SELinux instead of disabling it due to laziness or fear, that is what would stop most exploits dead. Containers are the middleground everyone attached to instead, though.
Looks like you have some reading to do :)
Because it's probably buggy and not tested with commits past a certain file size.
Better question, why no use a more appropriate, instead of convenient, tool for the job?
How are you sure other distros don't do that? I'm also not convinced that building in a vm instead of a chroot is any kind of advantage.
> Sorry, it was years ago
So isn't it possible they've changed things now?
> Those VMs are accompanied with screen scrapers that perform OCR in order to automatically test the pre-boot environment, before a display server comes up.
So to me, all that sounds is nifty, but not especially impressive. Any devops team could write something to do the same in a couple of hours. If other distros don't have that, it could simply be because they don't need it.
> It is possible that other distros are catching up here
This is the crux of your position, though, that all these other distros are that much more behind openSUSE. You start your reply with "yes and yes", very confident, but now here in the meat of the discussion you say you don't actually know.
I'm not trying to be combative or adversarial here, but it really seems like a lot of assumptions are being made.
> With Debian, package sources are uploaded as binary artifacts by maintainers who can all have their own standards for style/conventions, testing, and other policies.
I mean, Debian as a system has a standard for its packages, standardizing what they felt they needed to, and all packages adhere to that and the system has been working well, possibly longer than suse has even existed.
> but I hope it makes clear how it might be plausible for a smaller distro to have more mature centralized, automated testing
Well, I never doubted that was possible. I'm just skeptical OpenSuse's testing setup is/has leading/led to a system that is more stable or whatever other supposed advantages it has over say Debian and Red Hat.
> But there's some social and technical cruft there that leaves room for some competition, isn't there?
Is that cruft not just project preferences, of which each distro has it's own version?
> But do dig into OBS to get a sense of how SUSE is built. It may even be useful to you
My days of installing a distro for fun have been over for a long, long time. Now I only really like Alpine, Devuan if I need something chunkier. I appreciate the suggestions and conversation though, thanks!
Really.
I think it's hostile in nature. The core kernel devs have a horrible attitude toward security vulnerabilities.
Than which distros, though?
More so than Debian? Debian's seems pretty thorough. More so than Red Hat's, with the amount of important customers that depend on their distro? I'm skeptical. The rest are generally offshoots or geared towards a specific purpose or audience.
> It's true that nowadays all distros are pretty good, but there are real technical differences between openSUSE and other distros which matter.
So let's get into some details and examples! I'm interested and prepared to learn something here, hoping I might be enlightened - I haven't had a moment like that in a real long time, if that makes sense.
> The only distro with a distinct lineage that has a package manager much like openSUSE's is Fedora,
So, what makes the openSUSE package manager so much better than apk, apt or xbps?
Hoping I'm not coming off as too combative, just interested in the convo.
Isn't Fedora the 'testing' or bleeding edge distro/project for Red Hat? Did you on RHEL Desktop? That's the only RHAT based product that should have defaults that work with those tablets, IMO.
Don't you think it's likely there is some hardware out there where an OpenSUSE default causes an issue that doesn't happen in other distros?
> I don't know the reason, but I've had a better time with this distribution. I just wanted to share that it is a good one.
That's more than fair. I'm just so skeptical when people say $distro is so much better or more stable than all the others. Most of the time someone just had a better experience with it, rather than it being objectively better in some way. All the main distros are pretty damn stable and solved all the frustration causing issues a long, long time ago IMO.
There is no lapse, egregious or otherwise. This kid is playing in a game he doesn't fully understand, and likely just annoying people who have been playing the game a lot longer and at a deeper level than he is.
He thinks being able to DDoS chokepoint routers with $5000 worth of VMs to spam traffic is an amazing discovery. It isn't. That's why no one cares.
Besides all that though, my point was non europeneans runnin it outside of europe are doing so liekly because it's niche.
You've given some good points about OpenSUSE, but my point is there is nothing special about those points and OpenSUSE.
All the main distros are stable and handle whatever issues you think they might not. Dependency hells are no longer a thing, hardware not working, software not being available or being buggy etc. These are all solved issues on every main distro.
> but somehow openSUSE always has my back
This has to be nothing more than confirmation bias.
There's nothing really different about OpenSUSE over Ubuntu or Debian except preference. There is certainly no objective advantage outside of happiness that comes from a user using something they are familiar with.
> but the former is quite opinionated, and the latter's community version is a bit too flaky for my taste given it runs the latest and "greatest" of everything.
Just like openSUSE has variants so do these, and you can certainly find one that matches your preferences for stability and bleeding edge, or whatever else balance.
Well, no, I specifically mean niche.
> openSUSE is neither unconventional nor obscure.
Outside of Europe it sure is.
The amount of six figure websites I've seen launched as business with very few staff and the site looking like nothing more than a basic django app has always been puzzling to me.
They're all just using the same MS signed loader are they not? And even if not, you certainly can on any distro. Secure boot and linux isn't a problem that ties you to a specific distro.
> Not at all. First, OpenSuse is not really niche.
It sure is, especially if you're not German or even European.
> It just is solid and works well.
Right, but so do most distros. Computing has advanced a lot so stability is the norm, there isn't anything special about OpenSuse.
This is true for most distros though, so when I people see that as the reasoning for using a niche distro, I always think the reason is more because they like using a niche distro.
Common military in practice, common currency, common laws, common courts and highest authority, common passport rules, etc.
Doesn't Hawking radiation, since it exits a black hole, violate the idea that nothing escapes a black hole?
Leave the GID for the wheel group at 10.