_yy

Containers also have a massive attack surface in comparison with VMs. Modern KVM has a comparable density to containers (except for memory).

I agree on the advantages on LXC though. Many hosting companies use it. Why fix it if it ain't broken?

Yes, time keeping is up to the host kernel. The time can't deviate in the container.

Nice thing is - systemd works well for both.

I explicitly did not mention Gentoo - I know a bunch of people who run it in production. But, for anyone considering to do this - if you're running Gentoo, you're essentially building your own distro, which has massive advantages but is also a huge effort. You're now in charge of security updates, maintenance and Q&A. What if you're leaving the company? There are many Debian or Redhat admins, but good luck finding a Gentoo expert.

As a sysadmin, I fully agree. I shudder at the thought of using Alpine Linux (or Arch Linux, or...) in production.

The value that stable, long term support distros provide shouldn't be underestimated.

In the US, maybe, but for sure not in Europe. We don't even have a word for "jaywalking" in Germany.

No way out of this, really. Damned if you do and damned if you don't.

At least they took the high road and admitted the backdoor right away.

But the login backdoor?

> On the one hand you have the traditional server/sysadmin thinking about uptime and stability.

For sysadmins, boot times are getting increasingly more important. We're getting to the point where we can spin up a new VM in <100ms, thanks to (in part) systemd. This doesn't matter if you've got a few servers in a rack, but it does if you're spinning up thousands of VMs.

Literally anything is better than init and the jumbled mess of shell scripts accompanying it, then.

init (the process) != init (the system), but you're right about the terminology, of course.

Full ACK. It makes so many things so much easier and, notably, much more resilient. Ever had to debug a broken init script?

The ability to "simply edit init scripts so that it works" often results in nasty, broken hacks ending up in production.

> invent something monolithic that isn't better than what it replaced

What. Even if you disagree with systemd, literally anything is better than init.

You wish. Some orgs move slowly.

We're closer than one might think: https://blog.pfsense.org/?p=1866

Many Secure Boot implementations let you load your own keys. The "removing the owner from the equation" thing is not an issue with Secure Boot, but with particular manufacturers.

> The better place for signed loader verification is in the on-disk bootloader stub.

That is already part of the Secure Boot. But who verifies the bootloader stub? The point is that you can't trust anything on the disk.

> Any bootloader relies on a chain of trust. If the on-disk (OS) portion of that fails (incidentally, the biggest attack surface) and is vulnerable (likely - proprietary software can be fuzzed like any other), then the hardware-linked protection is at best annoying to the actual hardware owner.

Firmware verifies the (on-disk) bootloader, bootloader verifies the kernel, kernel verifies the drivers, and so on. The chain of trust is there.

+1 from me. Excellent library

It's not a good solution.

https://www.imperialviolet.org/2015/01/17/notdane.html

They probably manage DNS in a Git repository/using Puppet, so deploying may be quite literal. I see no issue with that.

Do try evil-mode/spacemacs!

It's the first todo list application I've encountered which can actually compete with a piece of paper.

So far, I haven't encountered any undocumented or severe breakage when staying with the stable version. Of course, things are different if you pull from Git master, but that's to be expected...

Just use org-mode like you would use a paper todo list, and then add the bells and whistles when you need them. No need to spend a week setting it up.

Was frustrated by this, until I realized that I actually do not need my agenda on my phone. Still nice to have, but not a deal breaker.

And Google Keep is fine for shopping lists.

Doesn't have to be that complicated, though. I recommend starting with a simple workflow.

As a former Vim user, I can recommend evil-mode and the SpaceMacs project:

https://github.com/syl20bnr/spacemacs

https://bitbucket.org/lyro/evil/wiki/Home

> An Emacs distribution - The best editor is neither Emacs nor Vim, it's Emacs and Vim!

Evil is a very, very complete Vim emulation in Emacs. I have yet to find a feature which is missing. Some features work better than the original.

He patched the IP stack, so the checksum should be correct.

Still is clean and simple. I like the new syntax.

Yes but there's an interesting discussion on LWN.

What kind of CLI pager does that? Legitimately curios.

HN anti-duplicate allows resubmit for URLs which weren't well received at the first attempt.

Standalone works very well too. Can recommend.