:: Re: [Dng] Dng Digest, Vol 3, Issue …
Etusivu
Poista viesti
Vastaa
Lähettäjä: Joe Awni
Päiväys:  
Vastaanottaja: dng
Aihe: Re: [Dng] Dng Digest, Vol 3, Issue 65
Not wanting to advocate for Go or statically linked binaries ( unless there
is a library version conflict ).

Question about ASLR:
Matteo Panella writes, "but that [ASLR?] does *not* change the overall
layout of executable pages - again, it's set in stone by the compiler,"

besides, "overall layout." Why cant the pages of a statically linked binary
be just as randomized by the OS as a dynamically linked binary?

On Sun, Dec 7, 2014 at 7:00 AM, <dng-request@???> wrote:

> Send Dng mailing list submissions to
>         dng@???

>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
> or, via email, send a message with subject or body 'help' to
>         dng-request@???

>
> You can reach the person managing the list at
>         dng-owner@???

>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Dng digest..."
>
>
> Today's Topics:
>
>    1. Re: system scriptinng language. (Matteo Panella)
>    2. Re: contrib/non-free/antisocial/community/unsupported
>       (David Harrison)
>    3. Re: A modest proposal: dfree packages for current Debian
>       users (Franco Lanza)

>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Sun, 07 Dec 2014 10:44:07 +0100
> From: Matteo Panella <m.panella@???>
> To: dng@???
> Subject: Re: [Dng] system scriptinng language.
> Message-ID: <54842167.7060202@???>
> Content-Type: text/plain; charset="windows-1252"
>
> On 07/12/2014 02:12, Teodoro Santoni wrote:
> > This is a problem if you have to deal with black boxes and with non-Unix
> > software, that is, your programs use memory as IPC bus.
>
> No, no, no, I'm not talking about shmem and IPC, I'm talking about *code
> page sharing*, which is only possible for dynamically linked
> executables. Different Go binaries "linking" the same versions of their
> "libraries" will never *ever* share code pages for the "libraries", even
> though the content is the same.
>
> (no, not even with KSM enabled: KSM does *not* work on pagecache pages
> by design)
>
> > grsecurity solves this issue for Linux, randomizing the address space
> during
> > loading
>
> ... except that it only works for dynamically linked binaries.
> Statically linked binaries coalesce all executable code into a single
> contiguous memory area at build time and maps it to a single LOAD
> program header with the RE bits set, so the kernel cannot randomize
> anything.
>
> (ok, not really: it can play with the base address for LOAD program
> headers, but that does *not* change the overall layout of executable
> pages - again, it's set in stone by the compiler, if you want full ASLR
> you need dynamic linking and binaries built as PIE, neither of which is
> possible with Go)
>
> Regards,
> --
> Matteo Panella
>
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: signature.asc
> Type: application/pgp-signature
> Size: 665 bytes
> Desc: OpenPGP digital signature
> URL: <
> https://mailinglists.dyne.org/cgi-bin/mailman/private/dng/attachments/20141207/a45be2b8/attachment.sig
> >
>
> ------------------------------
>
> Message: 2
> Date: Sun, 07 Dec 2014 10:38:08 +0000
> From: David Harrison <david@???>
> To: dng@???
> Subject: Re: [Dng] contrib/non-free/antisocial/community/unsupported
> Message-ID: <54842E10.9000301@???>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> Unlurking here for a moment:
>
> IMO Devuan is at a stage where it could do with as many friends as
> possible, and to be seen as the right way to go.
>
> Systemd aside, labelling a whole tranche of software as 'antisocial'
> stifles those good vibes. Please can I suggest something less emotive,
> such as: 'open' and 'closed', 'inside' and 'outside'?
>
> As an illustration, aspiring thuglets in the UK are handed 'ASBOs' by
> the court -- Antisocial Behaviour Orders -- to enforce their future good
> behaviour. 'Antisocial' a word that many here associate with criminal
> activities thanks to the efforts of the newspapers.
>
> Imagine a potential convert whose use case forced them to look at
> closed, 'antisocial' code that had a less unfriendly name in some other
> distro's repos. They could justifiably wonder how much help to expect
> from the Devuan community. 'Antisocial' isn't just a word that
> discourages things. It thrice damns them.
>
> It's a small step from that to wondering off to another distro that
> didn't make such loaded distinctions. Hardly a way to build trust and
> (later) Devuan user evangelism.
>
> Trivial as the above scenario might sound, it's exactly the kind of
> thing that would build or detract from Devuan's position in the wider
> world.
>
> That's my 0.02 sesterces. Back to lurking.
>
> David H
>
> On 07/12/2014 09:09, dng-request@??? wrote:
> > Send Dng mailing list submissions to
> >       dng@???

> >
> > To subscribe or unsubscribe via the World Wide Web, visit
> >       https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
> > or, via email, send a message with subject or body 'help' to
> >       dng-request@???

> >
> > You can reach the person managing the list at
> >       dng-owner@???

> >
> > When replying, please edit your Subject line so it is more specific
> > than "Re: Contents of Dng digest..."
> >
> >
> > Today's Topics:
> >
> >     1. Re: scripts, blobs, wares, hate, Chi & cheers! (Steven W. Scott)
> >     2. A modest proposal: dfree packages for current Debian users
> >        (Joel Roth)
> >     3. Re: Uninstallation of libsystemd0 (Franco Lanza)
> >     4. Re: A devuan "constitution" (Franco Lanza)
> >     5. Re: contrib/non-free/antisocial/community/unsupported
> >        sections (Franco Lanza)
> >     6. Re: A defined list of requirements and what next? (Franco Lanza)

> >
> >
> > ----------------------------------------------------------------------
> >
> > Message: 1
> > Date: Sun, 7 Dec 2014 02:04:30 -0500
> > From: "Steven W. Scott" <codekraken@???>
> > To: dng@???
> > Subject: Re: [Dng] scripts, blobs, wares, hate, Chi & cheers!
> > Message-ID:
> >       <CACp2iDF4HvnJYe6jzcro=
> z4gyynZGaakte_U7WhJPxUZVbg+qQ@???>
> > Content-Type: text/plain; charset="utf-8"

> >
> > .... or actually, I can provide the code and you can put it wherever you
> > want. You just need to point the webhook at it.
> >
> > SWS
> > On Dec 6, 2014 11:20 PM, "Steven W. Scott" <codekraken@???> wrote:
> >
> >>
> >>    I am truly enjoying the diversity of conversation and opinion,
> without a
> >> doubt. :)
> >>    From what I have read, it seems most folks here prefer to argue the
> >> merits of their position. Only a few loners tossed the H-bomb, and then
> >> they left with righteous insecurity.

> >>
> >>    As an old-school assembler guy, I don't care what scripting language
> you
> >> use, it's a vehicle. They all have quirks and/or costs. Mercedes,
> Nissan,
> >> Audi, Chevy? It's a trade-off somewhere. Where does it hurt the least,
> Can
> >> it handle the road, can anybody drive it, and how far will it take you?

> >>
> >>    I honestly have never understood the term "non-free" for software
> that I
> >> get, well, for free. It's only when the lawyers get involved that life
> >> becomes difficult. I purchase a piece of equipment, as part of that
> >> purchase, I have right to the software for that kit. Why not just call
> the
> >> repository "unsupported?" Certainly sounds better than "antisocial",
> though
> >> I do get a chuckle every time.

> >>
> >>    Regarding the suggestion of dishevelment, I must say, from my
> >> encounters, this project has a decided Chi, balance and form on IRC.
> Good
> >> things are worthy of patience. I recommend: wait.

> >>
> >>    Constitution? Naaaah. Declaration. It's just the beginning.

> >>
> >>    Finally, I'm willing to help in any way possible.  It was suggested
> on
> >> IRC that a relay for github commits to the IRC channel would be useful
> and
> >> appreciated, so I've been playing with various bots, but fell in love
> with
> >> github webhooks, 'cause I am all about event-driven goodness. I'm still
> >> testing, but it requires the repository owner, once I have it fully
> tested,
> >> to enter a Webhook URL I will provide (legit https site of course, no
> >> self-signed). From there I can drive the events to wherever necessary.
> If
> >> that's a nogo, just let me know and I'll find an alternative method.

> >>
> >>     Cheers to all, if it sucks, say so and say why. Opinion is not hate.

> >>
> >> SWS
> >>
> > -------------- next part --------------
> > An HTML attachment was scrubbed...
> > URL: <
> https://mailinglists.dyne.org/cgi-bin/mailman/private/dng/attachments/20141207/795c4bb5/attachment.html
> >
> >
> > ------------------------------
> >
> > Message: 2
> > Date: Sat, 6 Dec 2014 22:59:17 -1000
> > From: Joel Roth <joelz@???>
> > To: dng@???
> > Subject: [Dng] A modest proposal: dfree packages for current Debian
> >       users
> > Message-ID: <20141207085917.GA23468@sprite>
> > Content-Type: text/plain; charset=us-ascii

> >
> > Hi all,
> >
> > Pleased to see so many experienced *nix hands taking issue
> > with Debian plans for introducing systemd, and seeking
> > alternatives.
> >
> > It will certainly take some months to be able to establish
> > the infrastructure teams and processes to deliver a new
> > distribution derived from Debian. In the interim I think it
> > would be nice to offer some path forward to jessie or sid
> > users wanting to escape the web of systemd dependencies.
> >
> > If we can provide equivalent packages *without* the systemd
> > dependency through a separate repository, users wanting to
> > avoid systemd could simply add the repo to their
> > /etc/apt/sources.list.
> >
> > Most of the end-user frameworks and applications that pull
> > in systemd, do not depend on systemd directly, but depend on
> > some other package that depends on systemd.
> >
> > So one strategy is to pin those key packages to versions
> > that don't depend on systemd. For example, pinning dbus
> > 1.5.8-1, avoids systemd dependencies via dbus.[1,2] That
> > approach is worth researching and publicizing.
> >
> > Another is to distribute modified package versions.
> >
> > A member of the debian-user mailing list analyzed the
> > package dependencies on systemd components on his system and
> > generated some graphs.[3] The graphs are not authoritative as
> > he only analyzed the packages installed on his system;
> > nevertheless they quite informative.
> >
> > There are less than a dozen packages at the bottom, whose
> > systemd dependencies get propagated through the rest of the
> > packaging hierarchy.
> >
> > He then rebuilt these second-tier packages for himself
> > *without* the dependencies on systemd, and found no
> > particular issues on his system. He didn't patch the original
> > sources, only made changes under debian/.
> >
> > While he wasn't interested in pursuing the project further
> > than his own needs, he kindly passed me his patches to the
> > package sources. Please contact me if you are interested
> > on working on these packages, which include:
> >
> > dbus
> > fcgiwrap
> > gvfs
> > php5
> > policykit
> > pulseaudio
> > udisks2
> >
> > I've started with dbus.[4] If someone can build
> > amd64 and i386 versions of this package, that is
> > something we can distribute.
> >
> > Thanks for your attention. Kind regards,
> >
> > Joel
> >
> > 1. http://snapshot.debian.org/package/dbus/1.5.8-1/
> > 2.
> http://refracta.freeforums.org/going-with-the-systemd-flow-or-not-t422-10.html#p3990
> > 3. http://imgur.com/a/Wi1zb
> > 4. https://github.com/bolangi/dbus-debian-dfree
> >
>
>
> ------------------------------
>
> Message: 3
> Date: Sun, 7 Dec 2014 12:09:53 +0100
> From: Franco Lanza <nextime@???>
> To: Joel Roth <joelz@???>
> Cc: dng@???
> Subject: Re: [Dng] A modest proposal: dfree packages for current
>         Debian users
> Message-ID: <20141207110953.GA32429@???>
> Content-Type: text/plain; charset="us-ascii"

>
> On Sat, Dec 06, 2014 at 10:59:17PM -1000, Joel Roth wrote:
> > Hi all,
> >
> > Pleased to see so many experienced *nix hands taking issue
> > with Debian plans for introducing systemd, and seeking
> > alternatives.
> >
> > It will certainly take some months to be able to establish
> > the infrastructure teams and processes to deliver a new
> > distribution derived from Debian. In the interim I think it
> > would be nice to offer some path forward to jessie or sid
> > users wanting to escape the web of systemd dependencies.
> >
> > If we can provide equivalent packages *without* the systemd
> > dependency through a separate repository, users wanting to
> > avoid systemd could simply add the repo to their
> > /etc/apt/sources.list.
>
> Well, this has been already discussed many time:
> Devuan initially will follow this path, and only in a 2nd phase will be
> a complete fork of the project.
>
> If you look in our github you can see that our very first package
> devuan-baseconf does exactly what you are saying, add our repos on
> /etc/apt/sources.list.d/devuan.list
>
> For "our" jessie ( devuan 1.0 ) we will be just a partial repo
> with all packages needed to avoid systemd things and the rest will come
> from "usual" debian repos.
>
> > So one strategy is to pin those key packages to versions
> > that don't depend on systemd. For example, pinning dbus
> > 1.5.8-1, avoids systemd dependencies via dbus.[1,2] That
> > approach is worth researching and publicizing.
>
> Also what we are doing by pinning our repo with 700 precedence
> and pinning our systemd-sysv with -1 precedence
> >
> > A member of the debian-user mailing list analyzed the
> > package dependencies on systemd components on his system and
> > generated some graphs.[3] The graphs are not authoritative as
> > he only analyzed the packages installed on his system;
> > nevertheless they quite informative.
>
> We also do the same
>
>
> > While he wasn't interested in pursuing the project further
> > than his own needs, he kindly passed me his patches to the
> > package sources. Please contact me if you are interested
> > on working on these packages, which include:
> >
> > dbus
> > fcgiwrap
> > gvfs
> > php5
> > policykit
> > pulseaudio
> > udisks2
> >
> > I've started with dbus.[4] If someone can build
> > amd64 and i386 versions of this package, that is
> > something we can distribute.
>
> Feel free to contribute those packages on our github repository,
> opening an issue on the repo "devuan-project", so i can add you to a
> team and let you open repository for those packages!
>
>
> > Thanks for your attention. Kind regards,
>
> Thanks for your contribution!
>
>
> --
>
> Franco (nextime) Lanza
> Lonate Pozzolo (VA) - Italy
> SIP://casa@???
> web: http://www.nexlab.net
>
> NO TCPA: http://www.no1984.org
> you can download my public key at:
> http://danex.nexlab.it/nextime.asc || Key Servers
> Key ID = D6132D50
> Key fingerprint = 66ED 5211 9D59 DA53 1DF7 4189 DFED F580 D613 2D50
> -----------------------------------
> echo
> 16i[q]sa[ln0=aln100%Pln100/snlbx]sbA0D212153574F444E49572045535520454D20454B414D204F54204847554F4E452059415020544F4E4E4143205345544147204C4C4942snlbxq
> | dc
> -----------------------------------
>
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: signature.asc
> Type: application/pgp-signature
> Size: 181 bytes
> Desc: not available
> URL: <
> https://mailinglists.dyne.org/cgi-bin/mailman/private/dng/attachments/20141207/596d9329/attachment.sig
> >
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> Dng mailing list
> Dng@???
> https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
>
>
> ------------------------------
>
> End of Dng Digest, Vol 3, Issue 65
> **********************************
>