[Discuss] sudo

[bctill]

On 2023-04-04 23:27, BCLUG wrote:
> bctill wrote on 2023-04-04 13:08:
> 
>>> "(systemd) is at the centre of the FOSS universe now and has many 
>>> dev's eyes on it"
>> 
>> True, but what worries me is the culture of the core development team. 
>> They're all paid by Red Hat, and that alone should make the rest of us 
>> suspicious.
> 
> I see 1,906 contributors to systemd at
> https://github.com/systemd/systemd. Seems unlikely "they're all paid by
> Red Hat".
> 
I was referring to the *core* dev team: Lennart Poettering, Kay Sievers, 
Harald Hoyer, Daniel Mack, Tom Gundersen, David Herrmann.  They set the 
direction of the project, and they're all paid by Red Hat.  The 
remaining 1,900 just implement the architecture laid down by the core 
team.
> 
>> And, further, that forced updates and always-on telemetry are not 
>> invasions of privacy. Companies like Red Hat and Canonical seem 
>> hell-bent on bringing that culture to Linux.
> 
> I think forced updates are more about lazy users not updating software, 
> allowing for massive malware outbreaks that affect the internet as a 
> whole, which has emphasized the urgency of getting people to update 
> their (often free!) software with the latest (often free!) patches.
> 
> Also, telemetry is invaluable to developers. It's not necessarily about 
> collecting the URLs that users click on for vicarious thrills, but to 
> know how users actually use the software so the devs can determine 
> where to best spend their time.
> 
> Of course, it ought to be very clearly outlined what's collected and 
> how to opt in / out.
> 
Those are the good intentions that pave the road to hell.  
Unfortunately, unscrupulous organizations abuse such arguments to 
violate the autonomy and invade the privacy of computer owners.
> 
> I've opted in to full telemetry for KDE and Nextcloud, for example, as 
> I appreciate their work and if it helps those projects focus on issues, 
> great.
> 
That's a perfectly valid choice for you to make, and I would never 
interfere with your right to make it.  I do want to defend myself 
against are those who seek to make it impossible (eg, Apple, Microsoft) 
or impractical (eg, Red Hat, Canonical) to make the opposite choice.
> 
>> "If security is a concern (it should be), you'd want to be more 
>> up-to-date than "every few years"."
>> 
>> Yes of course, but surely I don't have to recompile the whole system 
>> every time a security patch comes along?
> 
> You're probably 100% correct there.
> 
>> When updates and patches come along, would I not be in a position to 
>> decide for myself which ones to reject, which ones to apply, and which 
>> ones warrant a recompile?
> 
> I suspect so. But, are you capable of analyzing the code to come to a 
> place of "informed consent"?  How much time does it take to review 
> these updates?
> 
That depends on the size of the code.  For something the size of 
systemd, at 1.3 million lines of code, obviously not.  And therein lies 
the problem.  OpenRC, for example, is only 16 thousand lines of code.

I'm not arguing for OpenRC, because I currently don't know enough to 
argue the technical merits.  I am arguing against the whole paradigm of 
making packages so big and monolithic that retaining privacy and 
autonomy becomes a practical impossibility, no matter how able and 
willing the computer owner.
> 
> I'm *not* arguing against reviewing change logs at minimum, and admire 
> your eagerness to take on the task of reviewing all these updates!
> 
> Just trying to flesh out a bit of an opposing viewpoint (i.e. my time 
> is valuable, I trust the distro, I apply the updates they deem 
> necessary).
> 
Individuals can earn my trust, after I've known them well enough for 
long enough.  But organizations run by bureaucracies are NEVER 
trustworthy.  Never have been, never will be.  The bigger they are, the 
worse they treat people, no matter how benign they may appear.
> 
> Definitely wishing you success with your project.
> 
Thank you!  The more I dig into it, the bigger and more daunting it 
looks... I will be depending on the community a lot for quite some time, 
before I get my sea legs under me.
> 
> rb
> 
> _______________________________________________
> Discuss mailing list
> Discuss at vlug.org
> http://vlug.org/mailman/listinfo/discuss_vlug.org

Hi rb --

The above discussion has brought a very important issue into focus for 
me, thank you.

I think it contains the anwswer to a question I asked recently in a 
thread about sudo.

There, I remarked that I had run Windows XP with full admin privileges 
granted to my default user for quarter of a century without any security 
problems, and I asked why this is so much more dangerous in Linux.

I think the answer may be related to the size of the kernels.  The 
Windows XP kernel weighs in at about 1.7 million lines of code (which is 
bad enough), but the Linux kernel breaks the scale at nearly 30 million 
lines of code.

Jumping Jehosaphat!  No wonder Linux users have to be so careful!

Even worse, everything I said above about how the sheer size of systemd 
makes it effectively impossible to retain privacy and autonomy, even for 
very capable computer owners, is at least 20 worse for the kernel.

No wonder people don't worry much about the size of systemd!

Regards,
-- Bernie.