Comment by egberts1 | Hacker News Reader

Comment by egberts1 | Hacker News Reader

Reasons why I left Debian:

1. go ahead and pull that Ethernet cable, your precious networked daemon will restart thus having to lose whatever cached or learned data. This is a major problem for designer of custom daemons.

2. Try and interface with Juniper DHCP servers at major ISP using systemd-networking and /etc/systemd/network settings. You’ll be forced to revert back to ISC DHCP server and/or NetworkManager.

3. Bootup and actually making your IP-address-senstitive daemon croak because your custom Ethernet NIC requires ‘ip addr/link up’ in /etc/rc.local

4. Bootup and get to network-online state only to find out that your netdev really hasn't gotten a dynamic IP address yet, your networked daemon that requires those IP address to be defined on the netdev will croak if not handled properly.

5. You cannot firewall against PID 1.

For UNIX box that are true server or not cloistered behind an ISP-provided gateway/router, that was more than enough to ditch systemd and go Devuan distro.

It sounds like you stopped using Debian. Were you also a contributor and had trouble fixing these issues because of the governance issues described in the article?

precisely. and every six month, Id take a peek to see if RedHat employee or Debian maintainer fixed it.

You cannot operate without systemd in Debian 11+. It’s now a REQUIRED “feature” and a veritable albatross around Debian’s neck for those serious server needs.

This is untrue, Debian can still be used with sysvinit + sysv-rc or openrc.

Are you sure? I know this is the case for Debian buster (I am using sysvinit on buster on a low-RAM NAS), but on bullseye on my laptop, if I try to install sysvinit & sysv-rc, it wants to remove things like network-manager and lightdm.

Installing openrc doesn't do that, but also doesn't remove any systemd components, so unclear what would happen if I tried to do that.

but the systemd library is mandatory along with systemd and many services that. various services did not used to REQUIRE them but now do so.

you just cannot unplug systemd 100% thereby contaminating the disk with useless stuff.

The systemd library is just another library on your system, it won't interfere with your init just to have it installed.

If you could mention these services that require it, we could look at the services and see what needs to be done.

try a couple of `ldd <binary-file>` and a couple of them requires systemd.

cannot uninstall them.

Yeah but that shouldn't affect your init system. Libsystemd is just a utility library, most of its functions don't require systemd, and the few that do are a no-op when systemd isn't present.

latent library should be removed lest they too become vulnerable.

libsystemd is trivial (it’s just about a dozen of short functions), so it’s very unlikely there’s security vulnerability in it.

LOL! Clearly, you do not appear to subscribe to the KISS principle much less ascribe to the security theatre of IT and cybersecurity.

You do realize that using systemd-networkd/systemd-resolved is entirely optional, right?

Most of the issues you raise sound like you simply didn't want to investigate in depth even though you knew you had an exotic setup.

Yes, they're optional. But I don't want to waste my time disabling annoying stuff which shouldn't have been enabled in the first place.

systemd-networkd is not the default method to get network (this is still ifupdown). systemd-resolved is not installed by default.

What do you mean you can't firewall against PID 1?

If you use a firewall to restrict systemd, your system breaks.

I don't understand why you would do that or what you would expect to happen, systemd itself is the tool that implements service-level firewalling.

Last time I checked, iptables and nftables filtering was done by the kernel, and userspace tools other than systemd existed to configure them.

I'm still not sure I understand, what is it you're trying to do exactly? Those other tools should continue to work, systemd will only conflict if you explicitly enable its eBPF stuff.

You firewall against network connections, not against PIDs. What is PID 1 connecting to/accepting connections from that blocking them breaks the system?

dig in the code

Reply on news.ycombinator.com