Hacker News Reader

Comment by marcosdumay | Hacker News Reader

We are still installing obscure binary-only datacenter-wide software with full system permissions for security reasons, and powerful organizations still require that from third parties.

If we can't change that, what hope we have for a sane small-kernel capability-based system?

View on HN

> We are still installing obscure binary-only datacenter-wide software with full system permissions for security reasons, and powerful organizations still require that from third parties.

Do you mean macos? It falls under this definition from what I can see.

Chef and Puppet and other "control plane" software would satisfy that definition.

Chef and Puppet are binary-only?

Chef's omnibus installation is a full ruby interpreter along with associated support libraries like openssl and everything more or less above glibc necessary to run the client. It may not be binary only but there's ~100MB of so of binaries in it.

Pretty sure Puppet has something similar with pre-built binaries.

I believe most orgs switched to Ansible already, not because of binary blobs or their size, but because of the necessity of installing anything more than an SSH server.

Yeah, I worked for 12 years on the chef-client so I'm well aware of that.

Darwin has been released as open source. I haven't looked at it in a really long time. Has it's availability situation changed? Is it woefully out of date from current releases? hell, does macOS still use Darwin underneath?

The problem is that “Darwin” really means “whatever random subset of projects Apple decided to open source”. Perhaps once it was more of a cohesive thing; I know there were attempts by others to build a Darwin-only operating system, though I wasn’t around then. But even then it was never anything more than a toy.

In any case, today Darwin really is just a subset of projects, which can’t be used (or sometimes, can’t even be compiled) without other projects that are closed source. The projects that are open source are still updated, but new projects are rarely open sourced. And that includes rewrites: when a project goes through the rewrite treadmill and gets replaced with a shiny new codebase written from scratch, that new codebase is often placed in a new project, which like any other new project is usually not open source. Thus, even though open source projects usually aren’t directly changed to closed source, the amount of functionality provided by open source projects shrinks.

No, I mean software like the Solar Winds IDS and system auditing. But yes, proprietary OSes satisfy that too.

Reply on news.ycombinator.com