HackerTrans
トップ新着トレンドコメント過去質問紹介求人

goombacloud

no profile record

投稿

Flatcar: OS Innovation with Systemd-Sysext

flatcar.org
120 ポイント·投稿者 goombacloud·2 年前·18 コメント

MNT Pocket Reform – A Technical Walkthrough

crowdsupply.com
1 ポイント·投稿者 goombacloud·3 年前·0 コメント

コメント

goombacloud
·5 か月前·議論
They won't build software, they'll let some AI-based software do the execution of their instructions (which is inefficient, opaque, vendor-locked, not reproducible etc.)
goombacloud
·2 年前·議論
If you mean using Incus on Flatcar, there is a PR for adding Incus as systemd-sysext extension.

Flatcar inside Incus is a bit more difficult: for Flatcar being a container one can import https://stable.release.flatcar-linux.net/amd64-usr/current/f... and for it being a VM I don't know if the regular image works. A major hurdle is that one has to tweak the way VMs/containers are configured because normally Ubuntu's cloud-init is used but in Flatcar only coreos-cloudinit or Ignition is supported and there are differences in the way the user-data has to be set up and the contents as well. But in the end Incus would be one more "cloud" platform to support and one could make the Incus integration as nice as with other platforms where Flatcar runs on (OpenStack, VMware, etc.).
goombacloud
·2 年前·議論
With static binaries that is not needed (and you can use OS=_any in the extension release file to mark them compatible).

If you want to repackage distro binaries without recompilation, you can have a look here: https://github.com/flatcar/sysext-bakery/pull/74 There are two tools, one can bundle the needed libs in a separate folder, and the other one works more like Flatpak and uses a full chroot. Since you already know what files are needed at runtime I think you could try the first approach, otherwise the second might be easier.
goombacloud
·2 年前·議論
In https://archive.softwareheritage.org/browse/revision/e446ab7... one can open the patches and then click the "Changes" sub-tab. Stuff like this looks like a perf improvement but who knows if a tricky bug is introduced that was aimed to be exploited https://archive.softwareheritage.org/browse/revision/e446ab7... There are more patches to be vetted unless one would give up and say that 5.2 should be used as last "known-good".
goombacloud
·2 年前·議論
This might not be complete because this statement "More patches that seem (even in retrospect) to be fine follow." lacks some more backing facts. There were more patches before the SSH backdoor, e.g.: "Lasse Collin has already landed four of Jia Tan’s patches, marked by “Thanks to Jia Tan”" and the other stuff before and after the 5.4 release. So far I didn't see someone make a list of all patches and gather various opinions on whether the changes could be maliciously leveraged.
goombacloud
·2 年前·議論
When socat is around a simple server can also be constructed with it:

        tee /tmp/server > /dev/null <<'EOF'
        #!/bin/bash
        set -euo pipefail
        SERVE="$1"
        TYPE="$2"
        read -a WORDS
        if [ "${#WORDS[@]}" != 3 ] || [ "${WORDS[0]}" != "GET" ]; then
          echo -ne "HTTP/1.1 400 Bad request\r\n\r\n"; exit 0
        fi
        # Subfolders are not supported for security reasons as this avoids having to deal with ../../ attacks
        FILE="${SERVE}/$(basename -- "${WORDS[1]}")"
        if [ -d "${FILE}" ] || [ ! -e "${FILE}" ]; then
          echo -ne "HTTP/1.1 404 Not found\r\n\r\n" ; exit 0
        fi
        echo -ne "HTTP/1.1 200 OK\r\n"
        echo -ne "Content-Type: ${TYPE};\r\n"
        LEN=$(stat -L --printf='%s\n' "${FILE}")
        echo -ne "Content-Length: ${LEN}\r\n"
        echo -ne "\r\n"
        cat "${FILE}"
        EOF
        chmod +x /tmp/server
        # switch from "text/plain" to "application/octet-stream" for file downloads
        socat TCP-LISTEN:8000,reuseaddr,fork SYSTEM:'/tmp/server /tmp/ text-plain'
# test: curl -v http://localhost:8000/server
goombacloud
·3 年前·議論
I really think we should have means of spawning wasm components from wasm components. How the runtime runs them should be up to the runtime - it could be directly backed by kernel primitives but it could also be in a browser. Leaking posix things into wasm… is something I'd rather never want to see. Let's come up with something better as wasm did aim for from the start.
goombacloud
·3 年前·議論
To spot more common problems I recommend:

  alias shellcheck='shellcheck -o all -e SC2292 -e SC2250'
goombacloud
·3 年前·議論
For regular Linux users you can do:

  sudo touch /etc/udisks2/tcrypt.conf
  sudo systemctl restart udisks2
and then any veracrypt volumes can be used in Nautilus or GNOME Disks similar to LUKS volumes.
goombacloud
·3 年前·議論
Does this finally have UEFI by default?
goombacloud
·3 年前·議論
The next logical step would be to only support wasm programs ;)
goombacloud
·3 年前·議論
gzip uses LZ and Huffman coding and not arithmetic coding with a predictor, so yes, these are not similar.
goombacloud
·3 年前·議論
Specially compression algos that use arithmetic coding with interval weights adjusted based on the prediction of what is likely coming next are very similar. They adjust the arithmetic coding (https://en.wikipedia.org/wiki/Arithmetic_coding) based on the context of the byte/bit to predict, so the more accurate the predicted continuation is, the more efficient is the encoding. The task is very similar to that of the transformers like GPT. A perfect prediction will almost have no additional storage cost because the arithmetic interval doesn't get smaller, and thus no bit gets stored - but anyway, you have to count the size of the decompressor to get a fair benchmark.
goombacloud
·3 年前·議論
Audio is covered as well, as written in the article, I recommend reading it.
goombacloud
·3 年前·議論
https://www.mojeek.com/ even has its own crawler
goombacloud
·3 年前·議論
There are multiple ways to start containers, one of them is to define systemd units in Ignition. If that part needs to change, reprovisioning is needed but a new "flatcar-reset" tool (in Alpha) should make the barrier for reprovisioning lower by only requiring a reboot and being able to keep wanted local data. In the past Ansible was a common choice if neither Kubernetes, Nomad or even docker compose are used.
goombacloud
·3 年前·議論
There is a changed version that includes drop-in config files, masking, and loading defaults from /usr/ instead of requiring full config files to live under /etc: https://uapi-group.org/specifications/specs/base_directory_s...