aka @JWBananas@lemmy.world

aka @JWBananas@kbin.social

  • 0 Posts
  • 66 Comments
Joined 2 years ago
cake
Cake day: June 14th, 2023

help-circle



  • Systemd-init, the core part of systemd, offersa wide range of features surpassing other init systems. More features lead to more bugs and security vulnerabilities.

    This is a bad take. Many of systemd’s features improve security significantly. And having all that code in one cohesive place can’t possibly be inherently less secure than the cornucopia of init scripts we used to use.









  • If you’re going to run fiber cables, run two or three. At least two.

    You don’t want to do that twice if you don’t have to. And if you need to troubleshoot your layer 1 at some point in the future, it’s a lot less frustrating to have a good spare versus having to run more later just for testing.

    I would go with 2 in aggregate (if you have the ports) + 1 spare.

    But yes, fiber would definitely be a better option if you have enough clearance to run it without kinking it. Might even be cheaper depending on the cost of copper these days. The real cost is usually in the SFP+ modules.

    Definitely do some research on the switches that you have before you buy the modules and cabling. Certain modules can be finicky with certain switches.





  • You basically just made the case for exactly why.

    Programs should be using the system resolver, not parsing that file.

    The system resolver should have predictable behavior. But if other programs are doing their own DNS resolution (or otherwise predicating their functionality) based directly on the contents of resolv.conf then their behavior will not always be consistent with the system resolver (or with how the sysadmin intended things to function).

    And that can break things in subtle, unpredictable ways, which is always a headache.

    Thus, on some modern systems, resolv.conf simply declares the local systemd-resolved instance (i.e. 127.0.0.1) and nothing else.

    A single global resolv.conf file also will not let you configure different behavior based on interface or on network namespace. Want to ensure DNS lookups for specific apps occur only through your VPN-specific DNS servers but all other apps only use the normal system resolvers (i.e. no leaking from either side of the divide)? Want to also ensure DNS lookups for those specific apps fail when the VPN is down (again, as opposed to leaking)? systemd-resolved has your back.

    And before anyone asks, yes, I am aware there are other, more crude and convoluted ways to do that with e.g. iptables (just like you can use crude, inconsistent init.d spaghetti scripts to manage services). It’s just one single real-world example.

    A single global resolv.conf file also will not let you configure different behavior based on interface or on network namespace.

    The point is to configure everything using consistent, predictable configuration files and syntax, and to ensure consistent, predictable behavior.

    But if you ultimately still want resolv.conf.d back, then your distro of choice undoubtedly provides a way to do so.