<story><title>SELinux is unmanageable; just turn it off if it gets in your way</title><url>https://www.ctrl.blog/entry/selinux-unmanageable.html</url></story><parent_chain><item><author>tristor</author><text>Honestly, the bigger issue is that most SWEs just aren’t very good.  It’s extremely telling that when you spend time in tech forums most people dread system design questions as the harder side of interviewing for senior level SWE roles…&lt;p&gt;System design, though, is the actual point of SW ENGINEERING.  That’s the part that is responsible for creating a foundation of quality to build on.&lt;p&gt;The other side is that sysadmins have largely become DevOps or SRE roles, which means most folks left as a sysadmin are those that couldn’t hack it in the other roles.  In the end, as we grow the number of people in tech, the number of software and systems, and the complexity we experience a regression to the mean across the board.&lt;p&gt;It’s always been a pet peeve of mine that I can count on my hand the number of SWEs in my ~20yr career that had similar understanding of the system they worked with as their SRE counterparts… but this should be table stakes.</text></item><item><author>fefe23</author><text>The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don&amp;#x27;t understand.&lt;p&gt;The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin.&lt;p&gt;From a security point of view, an application is like a nuclear power plant. It&amp;#x27;s good if it works as planned, but if something blows up it endangers your whole enterprise.&lt;p&gt;The whole container movement can be seen as putting the apps in a sarcophagus like Chernobyl. That way the radiation hopefully stays in, but history has shown that it really doesn&amp;#x27;t. Also, the wheel of history has just turned one more iteration and now admins just view the sarcophagus as something you deploy as you previously deployed the app. Who is responsible that it is air tight? Well, uh, nobody, really.&lt;p&gt;You can&amp;#x27;t even blame the applications for that. Let&amp;#x27;s say you want to build a good, secure application. How do you know what files your application will try to open? What syscalls it wants to call? Library and framework functions tend to not document that properly.&lt;p&gt;Obscure files like &amp;#x2F;etc&amp;#x2F;localtime, &amp;#x2F;etc&amp;#x2F;resolv.conf, &amp;#x2F;etc&amp;#x2F;ld.so.conf, &amp;#x2F;dev&amp;#x2F;zero ... how can you expect devs to build well documented and well sandboxable applications if they don&amp;#x27;t know which files their library functions will open?&lt;p&gt;You may have heard of &amp;#x2F;etc&amp;#x2F;resolv.conf ... but have you heard of &amp;#x2F;etc&amp;#x2F;gai.conf? &amp;#x2F;etc&amp;#x2F;nsswitch.conf? &amp;#x2F;etc&amp;#x2F;host.conf? Wouldn&amp;#x27;t it be great if the man page of getaddrinfo mentioned those (mine only mentions gai.conf)</text></item></parent_chain><comment><author>mattgreenrocks</author><text>&amp;gt; It’s extremely telling that when you spend time in tech forums most people dread system design questions as the harder side of interviewing for senior level SWE roles…&lt;p&gt;Yes. It&amp;#x27;s absurd that anyone that can talk about this stuff at a basic level is seen as some sort of ultra-skilled professional. See also: the relatively small amount of chatter about this stuff in the blogosphere, where there&amp;#x27;s a million tutorials that amount to &amp;quot;here&amp;#x27;s how you run create-react-app&amp;quot; and about 3 that talk about even moderate system design topics.</text></comment>
<story><title>SELinux is unmanageable; just turn it off if it gets in your way</title><url>https://www.ctrl.blog/entry/selinux-unmanageable.html</url></story><parent_chain><item><author>tristor</author><text>Honestly, the bigger issue is that most SWEs just aren’t very good.  It’s extremely telling that when you spend time in tech forums most people dread system design questions as the harder side of interviewing for senior level SWE roles…&lt;p&gt;System design, though, is the actual point of SW ENGINEERING.  That’s the part that is responsible for creating a foundation of quality to build on.&lt;p&gt;The other side is that sysadmins have largely become DevOps or SRE roles, which means most folks left as a sysadmin are those that couldn’t hack it in the other roles.  In the end, as we grow the number of people in tech, the number of software and systems, and the complexity we experience a regression to the mean across the board.&lt;p&gt;It’s always been a pet peeve of mine that I can count on my hand the number of SWEs in my ~20yr career that had similar understanding of the system they worked with as their SRE counterparts… but this should be table stakes.</text></item><item><author>fefe23</author><text>The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don&amp;#x27;t understand.&lt;p&gt;The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin.&lt;p&gt;From a security point of view, an application is like a nuclear power plant. It&amp;#x27;s good if it works as planned, but if something blows up it endangers your whole enterprise.&lt;p&gt;The whole container movement can be seen as putting the apps in a sarcophagus like Chernobyl. That way the radiation hopefully stays in, but history has shown that it really doesn&amp;#x27;t. Also, the wheel of history has just turned one more iteration and now admins just view the sarcophagus as something you deploy as you previously deployed the app. Who is responsible that it is air tight? Well, uh, nobody, really.&lt;p&gt;You can&amp;#x27;t even blame the applications for that. Let&amp;#x27;s say you want to build a good, secure application. How do you know what files your application will try to open? What syscalls it wants to call? Library and framework functions tend to not document that properly.&lt;p&gt;Obscure files like &amp;#x2F;etc&amp;#x2F;localtime, &amp;#x2F;etc&amp;#x2F;resolv.conf, &amp;#x2F;etc&amp;#x2F;ld.so.conf, &amp;#x2F;dev&amp;#x2F;zero ... how can you expect devs to build well documented and well sandboxable applications if they don&amp;#x27;t know which files their library functions will open?&lt;p&gt;You may have heard of &amp;#x2F;etc&amp;#x2F;resolv.conf ... but have you heard of &amp;#x2F;etc&amp;#x2F;gai.conf? &amp;#x2F;etc&amp;#x2F;nsswitch.conf? &amp;#x2F;etc&amp;#x2F;host.conf? Wouldn&amp;#x27;t it be great if the man page of getaddrinfo mentioned those (mine only mentions gai.conf)</text></item></parent_chain><comment><author>rr808</author><text>&amp;gt; Honestly, the bigger issue is that most SWEs just aren’t very good. It’s extremely telling that when you spend time in tech forums most people dread system design questions as the harder side of interviewing for senior level SWE roles…&lt;p&gt;I think this is a bit unfair, the software industry is so big now there are lots of different sub-sectors. Big Tech companies have huge scale problems that are kind of unique. Most developers work on products that only have a few hundred users at a time.&lt;p&gt;Your 20 years experience is a bit telling. I&amp;#x27;m the same age, back then SWEs usually had full access to production environments. Now everything is segregated and devs can&amp;#x27;t experiment in prod and end up getting detached.</text></comment>