• lemmyreader@lemmy.ml
    link
    fedilink
    English
    arrow-up
    14
    arrow-down
    4
    ·
    6 months ago

    You didn’t follow the XZ-utils story ? The malicious actor worked for years on that XZ backdoor that targeted the fact that some Linux distributions were modifying their openssh package to enable systemd notifications.

    • boredsquirrel@slrpnk.net
      link
      fedilink
      arrow-up
      7
      arrow-down
      7
      ·
      6 months ago

      Ok true, it was a systemd dependent issue. But it only makes sense to have those notifications. The problem is dependency on small hardly maintained products, which systemd will improve by centralizing it.

      • Macros@feddit.de
        link
        fedilink
        arrow-up
        4
        arrow-down
        1
        ·
        6 months ago

        And where do maintainers for the new parts of systemd come from? The larger systemd grows the more parts of it will be neglected. Also in regard to people checking commits, opening up doors for exploits like the one in xz.

      • lemmyreader@lemmy.ml
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        6 months ago

        But it only makes sense to have those notifications.

        Maybe in your mind it makes sense. Going for ease of use rather than security is not something that OpenBSD would quickly do. If you read some more about what “jwz” has to say about all the screensaver bugs in Linux, like here : https://www.jwz.org/blog/2021/01/i-told-you-so-2021-edition and realize what a mess that Linux maintainers are making again and again, and then have a look at Debian and their packaging of xscreensaver. Guess what ? Debian added some systemd thingie to xscreensaver. 🤯

        I like Debian since a long time and I use it. But the tinkering of Debian package maintainers and always wanting to do things the Debian way is not something I am always very pleased with. Remember the OpenSSL Debian fiasco ? That shows a problem with Debian which may still exist. Too many packages, not enough maintainers with enough spare time, and no coherent team work of a security team.

        • boredsquirrel@slrpnk.net
          link
          fedilink
          arrow-up
          1
          ·
          6 months ago

          You are talking about Debian holding back random packages for stability. This is of course not very cool but it needs to be tested.

          I am very much in favor of isolate app environments controlled by upstream devs, containerized and with a permission system. The system is made by the distro, and can be stable and very tested, and the apps are simply isolated and made by upstream.

          There is no xscreensaver on Wayland and I think this will not come back?