| ▲ | Openrsync: An implementation of rsync, by the OpenBSD team(github.com) |
| 64 points by sph 3 hours ago | 32 comments |
| |
|
| ▲ | tptacek 6 minutes ago | parent | next [-] |
| rsync has specific running modes for the super-user. It also pumps arbitrary data from the network onto your file-system. openrsync is about 10 000 lines of C code: do you trust me not to make mistakes? No, but that's why almost nobody runs it outside of strict trust boundaries. This security section would make more sense if rsync was like curl, which routinely deals with hostile counterparties. If the other side of your rsync is hostile, you probably have bigger problems! (I'm not an rpki person so I don't know if there's some part of that problem domain that changes this equation. I'm not dunking on the project, just saying this snagged me in the README). |
|
| ▲ | skeledrew an hour ago | parent | prev | next [-] |
| This attempt to avoid things that use AI is increasingly looking like some weird kind of reverse whack-a-mole where each targeted hole becomes radioactive after. Just grabbing some popcorn to watch. |
| |
| ▲ | ranger_danger an hour ago | parent [-] | | I feel bad for people with the real name Claude. | | |
| ▲ | formerly_proven 32 minutes ago | parent [-] | | It took me quite some time to realize what an utterly presumptuous product name Claude Code actually is, but only because Shannon is rarely mentioned with his first name. It's golden calf levels of hubris, even more so if you consider how incapable it was on release. It's like renaming calc.exe Einstein. Incredibly poor taste, but entirely in line with AI tech bro mentality. |
|
|
|
| ▲ | Bender 30 minutes ago | parent | prev | next [-] |
| The actual work of porting is matching the security features provided by OpenBSD's pledge(2) and unveil(2). These are critical elements to the functionality of the system. Without them, your system accepts arbitrary data from the public network. https://justine.lol/pledge/ I am not seeing pledge on Alpine Linux in edge. Have people been testing Pledge on Linux? Did I perhaps misunderstand the risk of using Openrsync without pledge? Or is this article just for OpenBSD users? |
| |
| ▲ | e12e 4 minutes ago | parent [-] | | From above your quote: > The only officially-supported operating system is OpenBSD, as this has considerable security features. And below your quote: > This is possible (I think?) with FreeBSD's Capsicum, but Linux's security facilities are a mess, and will take an expert hand to properly secure. It is portable in the sense that it compiles and runs, not in the sense that it has the same security features. I'd love to see pledge/unveil on (upstream) Linux - but I'm not holding my breath. | | |
|
|
| ▲ | WD-42 an hour ago | parent | prev | next [-] |
| What's the deal with the name? Openrsync implies to me that it's an open source alternative to a closed source program. But the original Rsync is GPL? Is this just the pushover license making it "more open"? |
| |
| ▲ | jtickle an hour ago | parent | next [-] | | OpenBSD folks would consider the GPL to be less open due to the requirement to apply the GPL to any derivative works. | | |
| ▲ | ranger_danger an hour ago | parent [-] | | And GNU folks would say the GPL is actually the more open choice because it forces the project to stay open. Two different ways of thinking about it I guess... it's nice to have choices and I don't think one is more or less "correct", more a matter of opinion/taste I guess. | | |
| ▲ | gilrain 41 minutes ago | parent [-] | | > more open choice because it forces the project A true morality must be based on consent, not coercion. Humanity may not be there yet, and therein lies the argument for force (and thus copyleft); but the ultimate goal should always be to reduce its necessity. | | |
| ▲ | datakan 29 minutes ago | parent | next [-] | | It’s not coercion. You’re free to not use it, or alternatively do what these folks did, write your own. Coercion would be forcing people to use it through some mechanism, which clearly isn’t possible with GPL. | |
| ▲ | jcelerier 26 minutes ago | parent | prev | next [-] | | Allowing closed-source to exist is always the less moral choice for many reasons (one example being ecological sustainability) | |
| ▲ | kennywinker 31 minutes ago | parent | prev [-] | | Is this not the paradox of tolerance restated in different terms? BSD license is unrestricted, it tolerates taking open source and closing it, thus always being at risk of things closing down. GPL license doesn’t tolerate taking from open source and closing it, thus ensuring things stay open. | | |
| ▲ | KZerda 22 minutes ago | parent [-] | | The BSD license is why we have Valkey and not a purely closed-source Redis. It would have been much easier to perform the rugpull if Redis had initially been GPLed. | | |
| ▲ | kennywinker a minute ago | parent | next [-] | | On top of badreligion42’s point, that both licenses allow forking just as easily - don’t you have the rugpull part backwards? Afaik BSD licensed stuff can be re-licensed under any more closed licenses at any time, where as to re-license GPL, you need consent from every single contributor. But i’m not familiar with the redis-valkey story so, maybe there is some nuance i am missing? | |
| ▲ | badreligion42 11 minutes ago | parent | prev [-] | | And how exactly did the BSD license make creating Valkey easier? GPL and BSD licenses both have the source in the open. Anyone creating a fork, can easily do so for either BSD or GPL licensed projects. Since Redis is a database, which the user won't be using a binary of, even using a fork of a supposedly GPL-licensed Redis would not require you to share your modifications with your user, same as BSD. |
|
|
|
|
| |
| ▲ | ranger_danger an hour ago | parent | prev [-] | | Many projects closely associated with OpenBSD start with "open"... openssh, openbgpd, openntpd, opensmtpd etc. | | |
| ▲ | hamdingers 34 minutes ago | parent [-] | | Not many are reimplementations of existing, much more popular, already open source projects. | | |
| ▲ | throw0101a 20 minutes ago | parent [-] | | OpenSSH was a 'reaction' to the original SSH(.com) code getting closed source: > OpenSSH originated in 1999 as a fork of Björn Grönvall's OSSH, which derived from Tatu Ylönen's original SSH 1.2.12 release, the last version distributed under a license permitting open-source redistribution before Ylönen's subsequent software became proprietary under SSH Communications Security.[4] * https://en.wikipedia.org/wiki/OpenSSH It was probably the second thing with the Open— prefix by this group of developers, OpenBSD itself being the first. They simply ran with the naming convention. OpenBGP/OSPF were developed as alternatives to Quagga (GPL). |
|
|
|
|
| ▲ | triggis 2 hours ago | parent | prev | next [-] |
| No-slop version for the sane of us Context:
https://mastodon.gamedev.place/@JeremiahFieldhaven/116654345... |
| |
| ▲ | ranger_danger an hour ago | parent [-] | | https://social.treehouse.systems/@thesamesam/116662824873341... | | |
| ▲ | akerl_ an hour ago | parent [-] | | +1 to this. Other than people's reflexive anger or fear about AI coming for their code, I don't see anything to suggest that these are bugs that are due to the inclusion of AI vs bugs in a program with a bunch of complex interop with the filesystem and network. | | |
| ▲ | triggis 44 minutes ago | parent [-] | | In any case, it's important to identify projects that are beginning to actively vibecode and clearly express position on this issue on various platforms so that authors and maintainers receive feedback.
Even if this particular bug was not written by LLM in this particular case, it's not a fact that the release does not include other regressions and that subsequent vibecoded versions will not include them & new ones. | | |
| ▲ | skeledrew 4 minutes ago | parent | next [-] | | > it's not a fact that the release does not include other regressions and [...] Are you listening to yourself? The same exact thing also has applied, applies and will continue to apply to manually written code, in perpetuity. There's nothing new under the sun here; regressions happen when there's change, and the only way to mitigate is to have healthy feedback loops. | |
| ▲ | akerl_ 17 minutes ago | parent | prev | next [-] | | No. It's not important. It's actually pretty shitty to go around looking for projects and then telling the maintainers you disagree with how they develop. | |
| ▲ | stsquad 19 minutes ago | parent | prev [-] | | Do not going harassing developers because you think they are doing it wrong. If you can do better and don't want to actually contribute to the upstream you are always free to fork it. |
|
|
|
|
|
| ▲ | jmclnx an hour ago | parent | prev [-] |
| I have not checked with OpenBSD 7.9, but as of 7.8 it did not support --exclude or -z. But outside of that openrsync works great. But seems avoiding "slop" is getting very hard. I saw postfix now has a bit of AI code in it. https://mastodon.sdf.org/@mrmasterkeyboard@mastodon.social/1... |
| |
| ▲ | nineteen999 36 minutes ago | parent | next [-] | | Somewhat ironic Postfix has a record of no root/RCE in the default install, where opensmptd hasn't (CVE-2020-7247). Time will tell if it stays that way. | |
| ▲ | agwa 18 minutes ago | parent | prev | next [-] | | Where do you see that about Postfix? I followed the links and the only thing I see is that AI is being used to find bugs, not write code. | | | |
| ▲ | Bender 22 minutes ago | parent | prev [-] | | Exclude is very commonly used in automation jobs to avoid duplicating big git repos and other big files. I think that would be a show stopper for a number of people. |
|
