Well, the part about modularity is not FUD - it’s simple fact. As I wrote, SysD does incorporate more features - a lot more, so yeah … however the cost is modularity - which has always been part of the linux philosophy. Importantly, due to how SysD has taken over all the low-level functionality, it’s almost impossible for newer versions of linux to run without it … which is why Devuan was created. I know the linux mint devs didn’t want it, but have no choice at this point as it’s too hard to build around it … I suspect the same is true for many distro maintainers.
I personally do think that SysD could in the future be used as an NSA backdoor … as long as Linus is in charge of the kernel, they can’t get in that way, so they do need a very complex and overarching bit of software in order to sneak anything in and SysD fits the bill.
In short, don’t call FUD until you do the research.
I’m reasonably knowledgeable in the Linux bootprocess, and you tell me I cannot give my personal opinion leaning towards FUD just because I didn’t watch your anonymous-style text-to-speech video?
As long as you don’t provide direct evidence backed with quoted systemd code, your proposition is the exact definition of FUD until you do the research.
systemd is GPL and the sources can be inspected here: GitHub - systemd/systemd: The systemd System and Service Manager
Right … and you for one, have gone through ALL that source code. The point is, it’s a behemoth that next to nobody is going to go through … which is another reason why simpler modular components are FAR superior in terms of security.
On another note: I’m now looking into Void Linux … most likely will be harder to get SAFEnet going with it [ can SAFEnet be compiled against musl? – a lightweight alternative libc implementation ]. Overall Void seems more secure and more worked through than Devuan.
Does anyone here have any experiences they’d share with regards to either void or devuan?
cheers
Nope. You got that backwards. I’m not the one distrusting systemd and spreading FUD about it. I’m saying that you can check the source code before making libelous statements because you don’t trust systemd.
Did you go through all the source code of the Linux kernel before using it? Or do you need someone to make a conspiracy video to base your opinion on first?
Actually, there are 4 main authors and 679 others went through the source code and made changes.
There have been at least three security audits of systemd. It’s the guideline to have two audits for anything accepted into RHEL. And here is one from Debian: Debian -- Security Information -- DSA-2777-1 systemd
Your concerns are just but subjective. Who knows, you might be right if security problems are indeed missed by multiple professionals due to complexity. But I’m equally certified to disagree and propose that this is unlikely.
I’m sorry if my criticism of your argument might come across as hostile. I don’t mean to be mean. However, the way you’re voicing your concerns are simply FUD no matter how you look at it, and I don’t think it’s fair. We can agree to disagree.
I don’t get what you don’t get … I’m saying NOBODY SHOULD TRUST IT, because effectively, they’d have to take it on FAITH that it’s not backdoored … you’re telling me that the average linux user - or in the case of a SAFE-OS, an average person expecting good security, is going to be able to audit this? Seriously, who is going to build SAFE-OS - are they even going to audit this code? No they are not - be real.
I’m not debating whether or not it is clean code at the moment - it probably is … but that’s not how the bad actors work. Fist they put out something that they can get most devs to agree would be a good thing and they keep it clean - but they come in later and put in backdoors that won’t be easily spotted.
Only four main developers for such a complex piece of code and the people who’ve come in and made changes are doing so in specific parts of it - they are not auditing the whole package.
Even if a whole audit does occur at some point - that doesn’t mean that the very next update to it won’t have a backdoor in it - and that’s the problem - it’s too big, it does too much.
(Caps read like you’re shouting. You can use the formatting tools for emphasis.)
Then why are you singling out systemd? If systemd was a person, this would be rasist. Because this applies to any code. The kernel is even more complex. Don’t use Linux. Make your own OS for SAFE. I’m sure by the time it’s big, useful, and efficiënt, people will start having the same concerns and someone needs to make a new OS.
Then why did Linux opt-out of the modular and easy to maintain micro kernel and adopted the non-modular and huge monolithic kernel in stead? Seriously, find out. Whatever answer you come up with, could that answer also be applied to systemd?
I’ll give you a hint. It has to do with speed and resources. No modular micro kernel has been able to compete with the complex monolithic kernel. We all like our computers to boot fast and be fast.
I do get your concern, and I’m simply disagreeing. You can trust something e.g. 95%, 99%, or 99.98%. At a certain point it’s just paranoia, and you have to decide if you want to spend three years building your own OS (or car) because you don’t trust the OS (or car) that professionals make. Others rather spend 3 years with their family and take the 0.02% risk of losing their data for granted, considering you are far more likely to compromise your own data due to pebkac.
Apart from that, I have a problem with your loose arguments like the modularity philosophy (untrue for any crucial component like the kernel) and the lack of code review (untrue as stated in my previous post).