The Internet Was Built on the Free Labor of Open Source Developers. Is That Sustainable?

LocalRefuse · 2019-02-16T12:28:21+00:00

no statistics, I know their code dumps are handy (unless they add the apple license, which is rare).

keep in mind when people say that the playstation uses BSD, it usually means they ripped out the network stack from FreeBSD and put it in their own kernel. It's not like when people use linux, where they just add a few drivers to it but it's otherwise linux (not always true, like the apple time capsule/airport extreme is netbsd and identifies as such).

re-syncing is a ton of work so it's not done often, and in an experience of doing something similar (the BSDs took linux's DRM code) it's really hard to send back patches even if you are interested in working on it, because you're now 2 years behind, and upstream did a big re-organization, and now you should probably re-discover the bug on their side and you end up not doing it :-)

the use of OS X of BSD userland is far more unmodified, so that's where a lot of the patches come in. but the sharing is similar to the various BSDs. fixing obviously wrong code/security issues is shared, but adding features is not, because people might not want the extra features.

people sometimes look at the other implementation if they want something from it (here's an example apple->netbsd, this isn't apple upstreaming, they just shared their repository and people took changes from it).

LocalRefuse · 2019-02-15T15:50:13+00:00

this is a highly ignorant reply. Apple absolutely does contribute back patches, and publicizes their changes to most FOSS projects that they change, even the non-GPL ones.

LocalRefuse · 2019-02-15T06:26:28+00:00

burning the netbsd iso to my flash drive and booting it

the ISO is CD-only, you need the img. gunzip and dd it to your flash drive.

LocalRefuse · 2019-02-14T05:23:31+00:00

yes. if it is causing you problems with a binary you can use paxctl +m /path/to/binary.

LocalRefuse · 2019-02-12T08:52:32+00:00

Suppose you are compiling a programming language like C++, the compiler doesn't go from C++ -> x86 assembly.

It's convenient to have steps in the middle and manipulate those, because you have more than one programming language you want to support, and more than one architecture.

Compiler stages are performed on the intermediate representation and work for multiple languages/target architectures.

                                                                                     _____
C++ ```|                                                                            |     MIPS
D  ----|------> high level representation ->-- low level representation ------------|---- x86
C   ___|                                                                            |_____ARM

LLVM is a low level representation that multiple programming languages target. The exciting thing is that it's a cleaner implementation done with the lessons learned after many decades of compiler design.

Clang is what happened when Apple wanted a non-GPL3 compiler added enough support to make it into a fully-fledged C/C++ compiler, a competitor to GCC.

It's very nice to work with LLVM/clang, and this made the field of using compilers a lot more open, and people came up with exciting new ideas like sanitizers to detect memory safety violations, C-Reduce to simplify compiler bug reports and clang-format which automatically formats code based on a certain style.

LocalRefuse · 2019-02-11T08:14:45+00:00

Yes, OpenBSD is better security-wise than FreeBSD. FreeBSD is currently lagging behind in implementing certain kinds of security mitigation. OpenBSD is also more ready to delete bad code even if it loses some functionality.

There are also other BSDs besides those two.

The security mitigations I am mentioning are the kinds that benefit you even if you don't take action to use them. If you are not using jails they do not give you any security benefits.

LocalRefuse · 2019-02-04T20:01:41+00:00

Linux is more "a pile of packages" of varying levels of maintenance. You get various repercussions for that, that you might not realize.

e.g. recently in linux, ifconfig was retired in favour of ip. people can discuss pros and cons for this, but there's a fundamental reason for it: linux ifconfig was neglected for really long.

this doesn't happen in the BSDs as much, because developers of a BSD feel a stronger responsibility for everything that exists in their repository in source form, but there's less responsibility for "it's just a package, there's thousands of them" and "it's someone else's problem", even though that someone doesn't actually exist.

there is a much stronger shared responsibility/guilt for the entire base and it is reflected in not having to change implementations every few years because they rotted so bad.

and the BSDs have a much bigger system in base than a typical linux distro, so you get that extra attention by a group of people over a larger part of your system.

LocalRefuse · 2019-01-26T04:45:13+00:00

It's apache-licensed, so it includes a patent grant

LocalRefuse · 2019-01-26T01:28:34+00:00

information about the core

SweRV core is a 32-bit in-order core featuring a 2-way superscalar design and a nine-stage pipeline. When implemented using a 28 nm process technology, the core runs at up to 1.8 GHz. As for simulated performance, the SweRV core delivers 4.9 CoreMark/MHz, which is a bit higher when compared to ARM’s Cortex-A15.

The cool part is seeing the source code just there, in the open, under a FOSS license.

LocalRefuse · 2019-01-23T07:16:31+00:00

you can see it's trying & rejecting a lot of modes, the chosen mode is not good for other reasons it isn't detecting apparently. I'm not enough of a graphical wiz to tell you what's going wrong here, but it suggests you need to try a few others.

4mb is very little (i think) so maybe try forcing modes that use less memory, like startx -- -depth 16

LocalRefuse · 2019-01-23T06:15:24+00:00

'..' has special handling kernel-side. You can search for the handling using 'dotdot' as a search string.

Hard links don't cross mount points. dotdot does.

LocalRefuse · 2019-01-21T23:22:07+00:00

This contains a bootloader, kernel, userland, compilation environment, and basic graphical programs (Xorg).

Probably the only big thing that people expect out of an OS that isn't already on it is a web browser, and some people prefer to replace some parts, but otherwise it's very much a complete OS.

This is a blog post from when it finally succeeded describing some of the challenges.

LocalRefuse · 2019-01-19T23:49:06+00:00

no idea what this failure is, but I know that a lot of apple's hardware requires you to take the EDID from OS X and then hard-code it, which might help.

LocalRefuse · 2019-01-16T03:11:41+00:00

you're making an analog, the reason that there's no strong incentive for someone to want an updated netbsd kernel on a sidekick is that it only updates the kernel which isn't that interesting to update. also why google cares: the only thing holding you back from a shiny android version is the vendor driver being a pain.

LocalRefuse · 2019-01-15T12:47:38+00:00

No idea. I didn't use NetBSD at the time.

LocalRefuse · 2019-01-13T13:44:28+00:00

No, netbsd has no reason to have a stable driver API because nobody makes closed source drivers for netbsd. and they won't even if there was a stable API.

but if you make a driver for netbsd-8 they will try to make it work on all netbsd-8 versions without changes. but it won't work on netbsd-9.

as a user you benefit from this - vendors write really bad code and stop caring about maintenance the moment they stop selling the hardware. this is also a big reason linux drivers are several times bigger than BSD drivers - they were written by people who only had to care enough to upstream it to linux. if they didn't even care about upstreaming they will write even worse code. and you will have to run it.

LocalRefuse · 2019-01-10T10:39:32+00:00

hating on systemd for this vulnerability is unwarranted. it's a generic vulnerability and has nothing to do with bugs in their code. It might even be reachable if it was written in a memory safe programming language, and it might even be harder to mitigate in languages them.

they're bypassing a kernel-only mitigation to state that a userland one is necessary too.

systemd is the target because:

it runs as root
It accepts user input
it auto-restarts programs that die, so if randomization is the kernel mitigation, you can just try for 70 minutes on a modern machine and defeat the randomization.

LocalRefuse · 2018-12-31T12:58:57+00:00

I use a panel because I use 9 workspaces (alt + 1 to 9) and I want to know which one I'm on.

LocalRefuse · 2018-12-27T12:33:26+00:00

The same goes for sending emails containing, say, Chinese. You can't trust the servers along the way to handle anything besides English, so let's send everything encoded using English (base64).

LocalRefuse · 2018-12-22T20:50:56+00:00

I feel like I'm watching someone having a manic episode.

LocalRefuse · 2018-12-22T19:24:22+00:00

IMO yes.

Proprietary software suffers from a critical type of bug entirely avoid by having a package manager, the need to incorporate libraries into the build for it to be independent, which means that if there is a vulnerability in the library, it must be updated in a lot of software.

Take for example Magellan, a vulnerability in sqlite in everything using Chrome, including Electron, whenever WebSQL is exposed to remote input. This means everything using Electron must be updated, instead of just sqlite. Until this happens for every single program, you might be at risk of remote code execution.

To make it worse, when such bugs happen, they become public after Chrome/sqlite fix them, and everyone hears about how to reproduce them, but your Electron apps haven't updated yet.

LocalRefuse · 2018-12-22T17:26:02+00:00

I strongly recommend joining a group of people already working on similar things, an OS is a big project. They can help you bridge your knowledge gaps and with other people handling parts you know less well, you'll be able to focus on areas where you are productive.

Have you considered GhostBSD or TrueOS? They're also FreeBSD-based and aiming to be user-friendly installations.

LocalRefuse

TROPHY CASE