Hacker News Reader

Comment by x0x0 | Hacker News Reader

[flagged]

Think whatever you shall about systemd of course, but please stop with the blind belief mud slinging:

  - systemd didn't create the patch to include libsystemd, distros did
  - current systemd versions already remove liblzma from their dependencies, the affected distros are behind on systemd updates though
  - you can implement notify in standalone code in about the same effort as it takes to use the dependency, there wasn't really a good reason for distro's to be adding this dependency to such a critical binary. systemd documents the protocol independently to make this easy. distros having sketchy patches to sshd has a long history, remember the debian weak key fiasco?

> - current systemd versions already remove liblzma from their dependencies, the affected distros are behind on systemd updates though

The affected distros aren't behind on systemd updates, the change to systemd you describe has been merged but not yet released.

Ah, thank you for the correction!

Maybe you should reconsider your "blind belief mud slinging" eh?

Be better.

libselinux also links to liblzma (and gets into sshd via PAM)

https://news.ycombinator.com/item?id=39867126

No. You are still bitter about systemd and are trying to assert blame which does not reasonably exist.

I'm not bitter, I'm wary of systemd in a security context. Their vulns seem to be a result of poor choices made deliberately rather than mistakes or sloppy coding (e.g. defaulting to running units as root when the UID/username couldn't be parsed). Lennart was staunchly anti-CVE, which to me seems again like making a deliberate choice that will only hinder a secure implementation.

I haven't followed systemd too closely, has their stance on CVEs at least evolved?

https://soylentnews.org/article.pl?sid=17/07/30/0251232

Reply on news.ycombinator.com