HackerTrans
TopNewTrendsCommentsPastAskShowJobs

goombacloud

no profile record

Submissions

Flatcar: OS Innovation with Systemd-Sysext

flatcar.org
120 points·by goombacloud·قبل سنتين·18 comments

MNT Pocket Reform – A Technical Walkthrough

crowdsupply.com
1 points·by goombacloud·قبل 3 سنوات·0 comments

comments

goombacloud
·قبل 5 أشهر·discuss
They won't build software, they'll let some AI-based software do the execution of their instructions (which is inefficient, opaque, vendor-locked, not reproducible etc.)
goombacloud
·قبل سنتين·discuss
If you mean using Incus on Flatcar, there is a PR for adding Incus as systemd-sysext extension.

Flatcar inside Incus is a bit more difficult: for Flatcar being a container one can import https://stable.release.flatcar-linux.net/amd64-usr/current/f... and for it being a VM I don't know if the regular image works. A major hurdle is that one has to tweak the way VMs/containers are configured because normally Ubuntu's cloud-init is used but in Flatcar only coreos-cloudinit or Ignition is supported and there are differences in the way the user-data has to be set up and the contents as well. But in the end Incus would be one more "cloud" platform to support and one could make the Incus integration as nice as with other platforms where Flatcar runs on (OpenStack, VMware, etc.).
goombacloud
·قبل سنتين·discuss
With static binaries that is not needed (and you can use OS=_any in the extension release file to mark them compatible).

If you want to repackage distro binaries without recompilation, you can have a look here: https://github.com/flatcar/sysext-bakery/pull/74 There are two tools, one can bundle the needed libs in a separate folder, and the other one works more like Flatpak and uses a full chroot. Since you already know what files are needed at runtime I think you could try the first approach, otherwise the second might be easier.
goombacloud
·قبل سنتين·discuss
In https://archive.softwareheritage.org/browse/revision/e446ab7... one can open the patches and then click the "Changes" sub-tab. Stuff like this looks like a perf improvement but who knows if a tricky bug is introduced that was aimed to be exploited https://archive.softwareheritage.org/browse/revision/e446ab7... There are more patches to be vetted unless one would give up and say that 5.2 should be used as last "known-good".
goombacloud
·قبل سنتين·discuss
This might not be complete because this statement "More patches that seem (even in retrospect) to be fine follow." lacks some more backing facts. There were more patches before the SSH backdoor, e.g.: "Lasse Collin has already landed four of Jia Tan’s patches, marked by “Thanks to Jia Tan”" and the other stuff before and after the 5.4 release. So far I didn't see someone make a list of all patches and gather various opinions on whether the changes could be maliciously leveraged.
goombacloud
·قبل سنتين·discuss
When socat is around a simple server can also be constructed with it:

        tee /tmp/server > /dev/null <<'EOF'
        #!/bin/bash
        set -euo pipefail
        SERVE="$1"
        TYPE="$2"
        read -a WORDS
        if [ "${#WORDS[@]}" != 3 ] || [ "${WORDS[0]}" != "GET" ]; then
          echo -ne "HTTP/1.1 400 Bad request\r\n\r\n"; exit 0
        fi
        # Subfolders are not supported for security reasons as this avoids having to deal with ../../ attacks
        FILE="${SERVE}/$(basename -- "${WORDS[1]}")"
        if [ -d "${FILE}" ] || [ ! -e "${FILE}" ]; then
          echo -ne "HTTP/1.1 404 Not found\r\n\r\n" ; exit 0
        fi
        echo -ne "HTTP/1.1 200 OK\r\n"
        echo -ne "Content-Type: ${TYPE};\r\n"
        LEN=$(stat -L --printf='%s\n' "${FILE}")
        echo -ne "Content-Length: ${LEN}\r\n"
        echo -ne "\r\n"
        cat "${FILE}"
        EOF
        chmod +x /tmp/server
        # switch from "text/plain" to "application/octet-stream" for file downloads
        socat TCP-LISTEN:8000,reuseaddr,fork SYSTEM:'/tmp/server /tmp/ text-plain'
# test: curl -v http://localhost:8000/server
goombacloud
·قبل 3 سنوات·discuss
I really think we should have means of spawning wasm components from wasm components. How the runtime runs them should be up to the runtime - it could be directly backed by kernel primitives but it could also be in a browser. Leaking posix things into wasm… is something I'd rather never want to see. Let's come up with something better as wasm did aim for from the start.
goombacloud
·قبل 3 سنوات·discuss
To spot more common problems I recommend:

  alias shellcheck='shellcheck -o all -e SC2292 -e SC2250'
goombacloud
·قبل 3 سنوات·discuss
For regular Linux users you can do:

  sudo touch /etc/udisks2/tcrypt.conf
  sudo systemctl restart udisks2
and then any veracrypt volumes can be used in Nautilus or GNOME Disks similar to LUKS volumes.
goombacloud
·قبل 3 سنوات·discuss
Does this finally have UEFI by default?
goombacloud
·قبل 3 سنوات·discuss
The next logical step would be to only support wasm programs ;)
goombacloud
·قبل 3 سنوات·discuss
gzip uses LZ and Huffman coding and not arithmetic coding with a predictor, so yes, these are not similar.
goombacloud
·قبل 3 سنوات·discuss
Specially compression algos that use arithmetic coding with interval weights adjusted based on the prediction of what is likely coming next are very similar. They adjust the arithmetic coding (https://en.wikipedia.org/wiki/Arithmetic_coding) based on the context of the byte/bit to predict, so the more accurate the predicted continuation is, the more efficient is the encoding. The task is very similar to that of the transformers like GPT. A perfect prediction will almost have no additional storage cost because the arithmetic interval doesn't get smaller, and thus no bit gets stored - but anyway, you have to count the size of the decompressor to get a fair benchmark.
goombacloud
·قبل 3 سنوات·discuss
Audio is covered as well, as written in the article, I recommend reading it.
goombacloud
·قبل 3 سنوات·discuss
https://www.mojeek.com/ even has its own crawler
goombacloud
·قبل 3 سنوات·discuss
There are multiple ways to start containers, one of them is to define systemd units in Ignition. If that part needs to change, reprovisioning is needed but a new "flatcar-reset" tool (in Alpha) should make the barrier for reprovisioning lower by only requiring a reboot and being able to keep wanted local data. In the past Ansible was a common choice if neither Kubernetes, Nomad or even docker compose are used.
goombacloud
·قبل 3 سنوات·discuss
There is a changed version that includes drop-in config files, masking, and loading defaults from /usr/ instead of requiring full config files to live under /etc: https://uapi-group.org/specifications/specs/base_directory_s...
goombacloud
·قبل 3 سنوات·discuss
For most use cases you can configure autosuspend and always wrap your commands with systemd-inhibit or gnome-session-inhibit. E.g., for an SSH session when starting tmux, or when you start the music player (for GNOME I guess that many players already do register inhibitors only when they play). One could also write a server that registers inhibitors as long as it serves connections (one could also use systemd socket activation and wrap the server in systemd-inhibit and terminate the server when done).