News for hackers. Stuff that matters.

A comment on Linux distros without systemd. Parent comment

Re:Linux distros without systemd by lmm on Monday May 20, 2019 @10:01AM (#19960386)
The objections to systemd are still as valid as ever. We still see a pretty high rate of security vulnerabilities in it.

However, as projects adopt systemd-proprietary APIs, distros are forced to choose between maintaining ongoing forks of those projects, dropping those projects, or adopting systemd. E.g. I suspect Slackware only avoided being forced to adopt it because they'd already decided to not support gnome.

[ Parent | on HN ]
Re:Linux distros without systemd by PlutoIsAPlanet on Monday May 20, 2019 @10:04AM (#19960409)
High rate?

Compared to the Linux kernel, systemd's CVE rate is very low.

[ Parent | on HN ]
Re:Linux distros without systemd by siffland on Monday May 20, 2019 @12:30PM (#19962107)
I have to call this out as a very poor comparision. I would love to know the linux kernel commits in 2019 vs CVE's in a percentage, vs systemd commits in 2019 vs CVE's in a percentage (or 2018 or 2017).

Now compare systemd CVE's with OpenRC or runit CVE's or any other init system and then you have an argument. But comparing it to the kernel with hundreds of people commiting changes is weak.

This comment is not defending nor attacking systemd.

[ Parent | on HN ]
Re:Linux distros without systemd by marcosdumay on Monday May 20, 2019 @11:15AM (#19961197)
Systemd has a historic of refusing to fill CVEs, even for incredibly bad vulnerabilities.
[ Parent | on HN ]
Re:Linux distros without systemd by dredmorbius on Monday May 20, 2019 @05:17PM (#19965304)
Compared to sysvinit, upstart, or procd, say, to remain in the same domain space?

(Though the implication that systemd is an OS Kernel is ... interesting.)

[ Parent | on HN ]
Re:Linux distros without systemd by yellowapple on Monday May 20, 2019 @09:57PM (#19967034)
Don't you know? systemd is the world's most popular operating system! A shame it has such a terrible init system...
[ Parent | on HN ]
Re:Linux distros without systemd by telmich on Monday May 20, 2019 @10:10AM (#19960452)
Do you have a source for it?
[ Parent | on HN ]
Re:Linux distros without systemd by markstos on Monday May 20, 2019 @10:19AM (#19960544)
In 2017, the Linux Kernel had over 450 CVEs, while systemd had 5.

https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm... https://www.cvedetails.com/vulnerability-list/vendor_id-7971...

So far in 2019, the gap has narrowed: "only" 45 CVEs so far for the Linux kernel, and 7 for systemd.

[ Parent | on HN ]
Re:Linux distros without systemd by snazz on Monday May 20, 2019 @04:21PM (#19964744)
As marcosdumay said upthread, “Systemd has a historic of refusing to fill CVEs, even for incredibly bad vulnerabilities.”

This contributes to the low rate of CVEs in systemd relative to Linux (for which many less-important bugs get CVEs).

[ Parent | on HN ]
Re:Linux distros without systemd by the_why_of_y on Monday May 20, 2019 @05:51PM (#19965649)
A quick look at the list of CVEs in the grandparent comment indicates that there are at least 3 different Assigning CNAs for systemd CVEs: MITRE Corporation, Red Hat, Inc. and Canonical Ltd.

My conclusion is that the systemd project is not its own CNA and therefore not in a position to authoritatively decide which systemd bugs get CVE numbers assigned and which do not.

[ Parent | on HN ]
Re:Linux distros without systemd by PlutoIsAPlanet on Monday May 20, 2019 @10:14AM (#19960491)
Sure

https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm...

https://www.cvedetails.com/product/38088/Freedesktop-Systemd...

For a piece of software used by millions of machines, that's a very low CVE count.

[ Parent | on HN ]
Re:Linux distros without systemd by nonsense1234 on Monday May 20, 2019 @01:13PM (#19962593)
> We still see a pretty high rate of security vulnerabilities in it.

Prove it. As someone else pointed out, there were 5 CVEs for systemd in 2017 and 7 so far this year most of which are low severity. If you think the mess of shell scripts and programs that systemd replaces had less than that you're simply delusional.

[ Parent | on HN ]