i’ld like this summary the most:

Musk now says it’s ‘pointless’ to build a Tesla

😁

one example of a program that did multiple things is sfdisk, it used to make the kernel reload the new partition table but that was not its main job, only changing them. the extra functionality moved to blockdev which is nearer to doing such as it also triggers flushing buffers and i think setting read/write status. i am fully ok with that change as it removes code from a program that doesn’t need it to another that already does similar things so that other partitioning programs like gdisk fdisk or parted could go the same way so that maintainers of the reread-partition-table things can concentrate on one solution at one place (in userspace) instead of opening issues at an unknown number of projects that also alter partitioning. the “do one thing” paradigma is good for developers who maintain the code and i pretty much appreciate their work. if you are up to only want one-day-flies that either die or take huge amounts of resources only for keeping them alive (image of a mayfly in an emergency room and a heart-lung machine attached while chirurgs rushing around trying to enlenghten its life a few seconds more) then you are good with monolithic tools that could hardly be maintained and suck allday as no one wants to fix any bugs or cannot without creating new ones due to the tightened dependency hell it has internally.

the point is not a lack of examples doing wrong but where one wants to be heading towards.

Lol what???

wouldn’t that be the definition of stable?

the computer on voyager 2 is running for 47 years now, they might have rebooted some parts meanwhile but overall its a long time now, and if the program is free of bugs the time that program can run only depends on the durability of the hardware, protection from cosmic rays (which were afaik the problems the voyager probes faced mostly, not bugs) which could be quite long if protected from hazardous environments and maybe using optoelectronics but the point is that a bug free software can run forever only depending on hardware durability and energy supply, in any other way no humans are needed for a veery long time ;-)

However, systemd makes the system much more secure and reliable as it is

less secure and less reliable day-by-day you meant? systemd introduces needless dependencies ever since as if that was it sole intention ever from its very beginning, which already were used for wide attacks, and exactly those attacks that the people working hard to remove unneeded dependencies for security reasons meant to prevent by things like “do one thing only” (but security was not the number 1 reason for this one i think), systemd instead: ‘lets add another level of that exponential dependency tree from the insecurity hell’ felt like they did this stupid thing intentionally every month for a decade or more.

and stability… if you don’t monitor what systemd does, you’ll never know how bad it actually is. i’ve made custom scripts to monitor systemd’s failures (failing in doing a very primitive of its job) and there are hundreds (actually varying around 200 to 300 sometimes more) of such per day on all our systems for one particular(!) measurement only that was breaking service stability and i wrote a measure-and-fix+monitor workaround. other fixes were not monitored however, only silently fixed by workarounds, thus just unnumbered systemd bugs/instabilities in the dark that stole a lot of work capacity…

if you run distros with systemd, unreliability is your daily experience unless you don’t really care or have never experienced stability before - like running a service (a single process) for 8 years without any interruption then it suddenly stops and you go like “was it maybe an attack? the process died, how could that be? were there any connects from outside at that moment?” not talking about not updating something that long, but “stability” itself CAN be like if you dont stop it, it’ll still run in 10000+ years maybe millions, more likely that humans extincted themselves way earlier than of a process “just dying” by a bug… while systemd even randomly stops things that were running well for no reason (varying) once a month more or less (also varying in what it actually randomly stops, sometimes (2 times) it even stopped ssh on my servers, me asking myself if i should create yet another workaround for systemds buggyness to not locking me out again from network or ratjer go for the real solution for most* of all systemd problems - *see below) on the few standard installs i personally have as i didn’t have the way to automatically replace provider installed distro on VMs in the DC. i want this replacing automatically for the same reason why i don’t like systemd, it causes manual work for a thing that should go automated. however due to systemd’s perpetuated instability i now managed to have this way, and every second working on getting rid of systemd is worth it 100k times. this however does not solve all systemd-introduced problems as the xz attack showed (a systemd-dependency on xz made the infected xz library beeing useful-for-the-atracker during compiletime of sshd binary with which then the attacker could infect the newly built sshd binary),one could still be attacked through systemd’s dependency hell even if one does not use systemd by oneself, but the build machines used for your distro could be affected/infected by systemd’s needless dependencies when “also” compiling for systemd-affected distributions thus there is the risk of becoming a victim of needless-systemd-dependencies while not using systemd at all. however the attack through systemd dependency (and that the public solution was not the removal of needless dependencies only included as source for superflous third party “needs”) made clear that systemd is an overall problem for security that will not be solved quickly but stay just like all windows insecurities will stay as long as they whish to push them to their “users”.

systemd reducing overall security and its unreliability combined with some builtin impediments (i.e. when debugging its defects) is what drove me away from systemd. there are solutions way more stable and way more secure (and way better documented btw) that do not call in for needless dependencies, reducing risks, attack vectors and increases overall debuggability i.e. by deterministic behaviour as an easy example. and none of its important (to me) promises have been fulfilled yet by systemd, drop-in-replacement? have heared that lie thousands of times, but in the last decade i have not experienced it a single time in a distro and it does not seem to be included/finished any more.

for windows users or windows admins a linux with systemd on it IS an improvement in stability, security and of course for updating, yes. but all of that does not come from systemd, rather the opposite is the case, systemd reduces it month by month, thats my experience and thats the most important experience for me, idc what lies whitdepapers tell or what broken promises are believed by anyone or the masses, i want secure and stable servers and services and systemd does not fit in for any of these goals and the time it was still “young” and early problems could be accepted in the hope they get fixed soon are gone, but without those fixes having ever appeared.

the OS was not the comparison, but the hardware it runs on (just as @Freefall said) but also you seem to be wrong with your other assumption:

And both those devices are tied to a specific OS.

Which seems not to be the case as install instructions for another OS can be found here (i didn’t try it though) for the mentioned device:

https://wiki.lineageos.org/devices/pdx215/

lineage os still is an “android”, but another vendor with clearly different approach than the original firmware and what hinders you from writing bsd drivers and compiling a bsd kernel for it instead? So i count the Xperia 1 III as NOT bound to any OS or OS vendor.

But despite the way longer possible support/security, freedom of choice and endless other possibilities that often come along with free OS choice, this pure and great advantages weren’t even mentioned there, thus it wasnt an OS comparison as it also wasn’t a bound-to-an-OS vs. absentness of vendor-lock-in-limitation-jungle comparison.

you should definitely know what type of authentication you use (my opinion) !! the agent can hold the key forever, so if you are just not asked again when connecting once more, thats what the agent is for. however its only in ram, so stopping the process or rebooting ends that of course. if you didn’t reboot meanwhile maybe try unload all keys from it (ssh-add -D, ssh-add -L) and see what the next login is like.

btw: i use ControlMaster /ControlPath (with timeouts) to even reduce the number of passwordless logins and speed things up when running scripts or things like ansible, monitoring via ssh etc. then everything goes through the already open channel and no authentication is needed for the second thing any more, it gets really fast then.

no bad politics

😭

The whole point of ssh-agent is to remember your passphrase.

replace passphrase with private key and you’re very correct.

passphrases used to login to servers using PasswordAuthentication are not stored in the agent. i might be wrong with technical details on how the private key is actually stored in RAM by the agent, but in the context of ssh passphrases that could be directly used for login to servers, saying the agent stores passphrases is at least a bit misleading.

what you want is:

• use Key authentication, not passwords
• disable passwordauthentication on the server when you have setup and secured (some sort of backup) ssh access with keys instead of passwords.
• if you always want to provide a short password for login, then don’t use an agent, i.e. unset that environment variable and check ssh_config
• give your private key a password that fits your needs (average time it shoulf take attackers to guess that password vs your time you need overall to exchange the pubkey on all your servers)
• change the privatekey every time immediately after someone might have had access to the password protected privkey file
• do not give others access to your account on your pc to not have to change your private key too often.

also an idea:

• use a token that stores the private key AND is PIN protected as in it would lock itself upon a few tries with a wrong pin. this way the “password” needed to enter for logins can be minimal while at the same time protecting the private key from beeing copied. but even then one should not let others have access to the same machine (of course not as root) or account (as user, but better not at all) as an unlocked token could also possibly be used to place a second attacker provided key on the server you wanted to protect.

all depends on the level of security you want to achieve. additional TOTP could improve security too (but beware that some authenticator providers might have “sharing” features which could compromise the TOTP token even before its first use.

My theory is that you already have something providing ssh agent service

in the past some xserver environments started an ssh-agent for you just in case of, and for some reason i don’t remember that was annoying and i disabled it to start my agent in my shell environment as i wanted it.

also a possibility is tharlt there are other agents like the gpg-agent that afaik also handles ssh keys.

but i would also look into $HOME/.ssh/config if there was something configured that matches the hostname, ip, or with wildcards* parts of it, that could interfere with key selection as the .ssh/id_rsa key should IMHO always be tried if key auth is possible and no (matching) key is known to the ssh process, that is unless there already is something configured…

not sure if a system-wide /etc/ssh/ssh_config would interfere there too, maybe have a look there too. as this behaviour seems a bit unexpected if not configured specially to do so.

antarctica:

• no bad politics
• no wars so far
• people there are mainly interested in science
• no economic abuse or exploitation
• pinguins!
• no air conditioning needed to survive the summer.
• winter is offline time, visitors won’t arrive or leave then.
• last place to stay cool during boomers heritage “heat death of our planet”

well sure, it has downsides too. Next Rollercoaster park is -tbh- unreachable, internet connection is sloo.oo…oow (or did they already finish the submarine fibre cable?) and sunbathing basically only brings you frost bites (if you’re lucky).

However i am not planning to migrate there.

accepted

In the US slavery should be illegal since ages but isn’t yet.

there is in fact only regulation as long as it is legal. how do you regulate if it is illegal? it only gets hidden then. and literally everywhere it went bad when it became illegal. everything you claim to want to achieve (regulation and workplace security) is completely lost and things get worse, more victims, less control, violence cannot be prosecuted cause none would go to police when anything happens, etc etc. , that is until it becomes legal again, but until then making it illegal even short time would cause way more damage than is possible to “fix” in a decade or two. just read about what happened where govs already took that path. if you want it to get out of control and destroy health and lifes, and create ground for forced prostitution (aka slavery), then yes, making it illegal is the way you get exactly that result.

and for the relationship thing… as far as i know (which is not much) the mayority of such customers already are in a relationship (mostly the one called marriage) while singles way less do such.

until planes have some magic build-in that turns cleptomans into normal people and hinders underpayd in-flight staff from ensuring their already due income upgrade by other means, i’ld say every unobserved bag is prone to theft, everywhere.

if you know such a theft-preventing magic, pls tell, so we can also build it into regular streets in big touristic cities and into all buildings in the wallstreet, that would help the world a lot.

i did say that health care professionals follow suggestions which is 100% true for the suggestions they get from (known health damaging) pharma corporations. and these suggestions are mainly for profit. maybe let me note the opioid crisis here, that did not even touch my country directly (that is until this becomes officially maybe), but assumingly yours. if you don’t know what happened there and who followed who’s suggestions, maybe start reading. same happens in other countries too and for the same purposes.

a fact that is official here (as in there was a need for a law that currently helps) is that you get different diagnoses from different doctors and NEED to go to at least two different ones to have a chance for a correct diagnose. it took me >30 years to find a doctor that also tells me what is maybe less probable but also maybe a correct diagnose. the others just ignored all facts that were noncomplient to their diagnose and either were silent about it or incapable of also assuming other things with slightly similar symptomes.

the system is that prone to do wrong diagnoses while not paying for real treatment that some patients and doctors silently agree to do some extra things that are paid better to finance the things that are not paid in one go as a compromise to circumvent the harmful system. this is not public as in news, but when you go to a doctor that you know and need something that is not paid and offer something else at the same time that actually gets paid like a scan for something that could be important for symptoms you might have, chances are very good to get better real help than when strictly following the laws without such offers. i’ve talked about this with a doctor where i was not patient and i observed this once from little distanze.

i did not say that healthcare professionals intentionally harm for profit but follow guidelines made for profit-only that cause harm.

also maybe ‘interesting’ to read: https://blogs.bmj.com/bmj/2021/07/05/time-to-assume-that-health-research-is-fraudulent-until-proved-otherwise/

i tend to say that some shamans with true intention to help might often be better than a socalled healthcare system that truely is based on profit-only directors. while healthcare professionals depend on intentionally wrong informations (see opioid crisis) from profit-only corporations, their actions effects can highy contradict what their true intentions are. but for patiens really the outcome is what counts.

so even if someone says that treatment from healthcare professionals harms the patient this does not at all include evil intent from that professional.

sorry for making you feel less convinced by a misspelled word.

that is only partly true, health system (here) also proposes to make false diagnoses for making money while the really needed treatment is underpayed or not payed at all or - in some cases - not payed at all if some facts change “after” the diagnosis so that the involved doctors spent time and money while afterwards not beeing payed at all. doctors doing false diagnoses (here) are mainly following the systems suggestion to skip real treatment but instead abuse patients.

yeah, that’s why i am happy to avoid the us when travelling, mainly because of reports that electeonics are bricked regulary by them, but this discussion is more about theft. like “never allow hand luggage to be checked, better miss the flight instead”:

https://travel.stackexchange.com/questions/99956/how-common-is-it-for-airport-officers-to-steal-valuables-from-luggage

it’s not always about travellers that could lay hands on your stuff, maybe staff “needs” a living wage too ;-)

i once had to look at a firefall appliance cluster, (discovered, it could not do any failover in its current state but somehow the decider was ok with that) but when looking at its logs, i discovered an rsh and rcp access from an ip address that belonged to a military organisation from a different continent. i had to make it a security incident. later the vendor said that this was only the cluster internal routing (over the dedicated crosslink), used for synchronisation (the thing that did not work) and was only used by a separate routing table only for clustersync and that could never be used for real traffic. but why not simply use an ip that you “own” by yourself and PTR it with a hint about what this ip is used for? instead of customers scratching their head why military still uses rcp and rsh. i guess because no company reads firewall logs anyway XD

someone elses ip? yes! becuase they’ll never find out !!1!

i really appreciate that ipv6 has things like a dedicated documentation address range and that fc00:/7 is nicely short.

ipv6 in companies… ipv6 is not hard, but for internal networking no company (really) “needs” more than rfc1918 address space. thus any decision in that direction is always “less” needed than any bonus for (da)magement personnel is crucial for the whole companies survival…

for companies services to be reachable from outside/ipv6 mostly “only” the loadbalancers/revproxies etc need to be ipv6 ready but … this i.e. also produces logs that possibly break decades old regexes that no one understands any more (as the good engineers left due to too many boni payed to damagement personnel) while other access/deny rules that could break or worse let through where they should block (remember that 192.168. could the local part of ipv6 IF sone genious used a matching mech that treats the dot “.” as a wildcard as overpayed damagement personnel made them rush too fast), could be hidden “somewhere”. altogether technical debt is a huge blocker for everything, especially company growth, and if no customer “demands” ipv6, then it stays on the damagement personnels list as “fulfilling the whishes of engineers to keep them happy” instead of on the always deleted “cleaning up technical debt caused by damagement personnel” list.

setting up firewalls for ipv6 is quite easy and if you go the finegrained “whitelisted or drop/block” approach from the beginning it might take a bit for ipv6 specials to be known to you, but the much bigger thing is IMHO the then current state of firewall rules. and who knows every existing rule? what rules should be removed already and must not be ported to ipv6? usually firewalls and their rules are a big mess due to … again too many boni payed to damagement personnel, hindering the company from the needed steps forward…

ipv6 adoption is slow for reasons that are driving huge cars that in turn speed up other problems ;-|