HN user

groks

269 karma
Posts4
Comments115
View on HN
github.com 9y ago

Bubblewrap: Unprivileged sandboxing tool

groks
91pts8
groups.google.com 15y ago

Amazon outage compared with appengine's high-replication datastore

groks
1pts0
www.google.com 15y ago

Google Subscribed Links

groks
2pts0
perspectives.mvdirona.com 15y ago

Google Megastore: The Data Engine Behind GAE

groks
7pts0
Microsoft’s Surface Pro 5 Said to Move to Intel Kaby Lake Processors 9 years ago

The things that I don't feel as comfortable with are basically UI things and application launching. I love Cmd-space to launch stuff on OSX, and hitting the Windows key to search for stuff to launch just feels sluggish in comparison.

In Gnome, Hit the Windows key and start typing 'shortcut' to run the keyboard shortcut editor.

Start typing 'application' to search-ahead-find the 'Show all applications' shortcut and click it.

Press Cmd-space.

0ThreadHN
What makes us Red Hat 9 years ago
  cat << EOF > ~/.config/gtk-3.0/gtk.css

  /* Make window title bars more compact.
   *
   * From: https://unix.stackexchange.com/questions/276951
   */

  headerbar entry,
  headerbar spinbutton,
  headerbar button,
  headerbar separator {
      margin-top: 2px; /* same as headerbar side padding for nicer proportions */
      margin-bottom: 2px;
  }

  EOF
0ThreadHN
Grappling with Go 9 years ago

The true metric for success for something like ntpsec is the number of meaningful security problems ntpd has been vulnerable to since ntpsec's inception that ntpsec hasn't been.

They talk about 3 areas where bugs have been removed, including:

  Much of ntpd’s most convoluted code lives in ntp_proto.c, which
  implements the state machine central to the protocol. Of the 29
  vulnerabilities that have received CVEs so far in 2016, a couple
  of multi-KLOC functions in ntp_proto.c are responsible for 15 of
  them — just over half. Of course, "just rip it out" wouldn’t
  suffice in this case: this is core business logic, not junk code.
  So we rewrote those functions from scratch, cutting line count
  considerably and yielding a far more readable result.
https://blog.ntpsec.org/2016/12/13/fantastic-bugs-and-where-...

The other two areas are guaranteed bug-free because they removed the code.

0ThreadHN
The Many, the Humble, the Ubuntu Users 10 years ago

it lacks several packages that I use (Kodi comes to mind

    $ dnf search kodi
    kodi.x86_64 : Media center
    ...
> They also changed the package manager from Yum, so a lot of new things to learn since I last used 17
    $ yum search kodi
    Redirecting to '/usr/bin/dnf search kodi' (see 'man yum2dnf')

    kodi.x86_64 : Media center
    ...
0ThreadHN
YouTube no longer supports 4K video playback in Safari 10 years ago
    $ youtube-dl --list-formats https://www.youtube.com/watch?v=DeJLzyxZqbk | grep '[0-9]x[0-9]'
    278          webm       256x144    DASH video   93k , webm container, vp9, 24fps, video only, 1.09MiB
    242          webm       426x240    DASH video  110k , vp9, 24fps, video only, 1.00MiB
    160          mp4        256x144    DASH video  113k , avc1.4d400c, 24fps, video only, 1.41MiB
    243          webm       640x360    DASH video  196k , vp9, 24fps, video only, 1.83MiB
    133          mp4        426x240    DASH video  247k , avc1.4d4015, 24fps, video only, 3.08MiB
    134          mp4        640x360    DASH video  263k , avc1.4d401e, 24fps, video only, 2.95MiB
    244          webm       854x480    DASH video  322k , vp9, 24fps, video only, 3.11MiB
    135          mp4        854x480    DASH video  554k , avc1.4d401e, 24fps, video only, 6.30MiB
    247          webm       1280x720   DASH video  714k , vp9, 24fps, video only, 7.48MiB
    136          mp4        1280x720   DASH video 1127k , avc1.4d401f, 24fps, video only, 12.92MiB
    248          webm       1920x1080  DASH video 1579k , vp9, 24fps, video only, 17.86MiB
    137          mp4        1920x1080  DASH video 2304k , avc1.640028, 24fps, video only, 27.09MiB
    17           3gp        176x144    small , mp4v.20.3,  mp4a.40.2@ 24k
    36           3gp        320x180    small , mp4v.20.3,  mp4a.40.2
    18           mp4        640x360    medium , avc1.42001E,  mp4a.40.2@ 96k
    43           webm       640x360    medium , vp8.0,  vorbis@128k
    22           mp4        1280x720   hd720 , avc1.64001F,  mp4a.40.2@192k (best)
0ThreadHN
Bubblewrap: Unprivileged sandboxing tool 10 years ago

I agree, the tool is (currently) poorly documented. I would have appreciated something like this:

    bwrap --ro-bind / / id

    bwrap --ro-bind /usr /usr \
          --ro-bind /lib64 /lib64 \
          id

    bwrap --ro-bind /usr/bin/ps /usr/bin/ps \
          --ro-bind /lib64 /lib64 \
          --proc /proc \
          ps -x

    bwrap --ro-bind /usr/bin/ps /usr/bin/ps \
          --ro-bind /lib64 /lib64 \
          --proc /proc \
          --unshare-pid \
          ps -x

    bwrap --ro-bind /usr/bin/echo /usr/bin/echo \
          --ro-bind /lib64 /lib64 \
          echo "to a file outside the container" > /tmp/a-file

    bwrap --ro-bind /usr/bin/sh /usr/bin/sh \
          --ro-bind /lib64 /lib64 \
          --bind /tmp/a-file /tmp/a-file \
          sh -c 'echo "editing inside, available outside" > /tmp/a-file'
But it's never going to be easy. For example:

- The above works on my 64bit, combined /usr system, but maybe not yours. The more complicated the example, the more likely differences between systems are to show up.

- You may want to run a program with different privileges in different scenarios, so it is hard to guess what the right thing to do is in the general case.

Both bubblewrap and firejail need to be setuid. People commented on the firejail thread that it has a lot of code to be audited. Bubblewrap addresses that by stripping down to the essentials. It's going to have to compensate for that with great documentation and error messages.

0ThreadHN