| |||||||||||||
|
| |||||||||||||
Wow, some misinformation never dies.Wow, some misinformation never dies.Posted Aug 31, 2006 1:08 UTC (Thu) by sholdowa (guest, #34811)In reply to: Wow, some misinformation never dies. by flewellyn Parent article: Gentoo Linux 2006.1 released
I see, so Gentoo is just the same as all other distros that use yum/rpm, or apt/dpkg, etc then? You can choose the features you want, and they handle all the dependencies too, don't they?
So what was the advantage again, if it's *not* optimizing your kernel for your hardware?
(Log in to post comments)
Wow, some misinformation never dies. Posted Aug 31, 2006 1:18 UTC (Thu) by flewellyn (subscriber, #5047) [Link] If you use a binary package from Debian, you get the compile-time options that the maker of the package selected. If you use Gentoo, you get the compile-time options that YOU selected. The benefits here should be readily apparent. Another thing to note is that Portage is a lot better at figuring out dependency information than APT. I have used both extensively, and Portage wins hands down at handling thorny dependency issues, where APT would simply scream and die. And don't even get me started on RPM/yum, that's just a horrid mess. Also of note: if you have the ability to rebuild any necessary package (or its dependencies) at need, API or ABI changes are much less problematic. My Gentoo box handled the change from gcc-3.3 to 4.0 without problems, all C++ applications were rebuilt and just worked.
Wow, some misinformation never dies. Posted Aug 31, 2006 4:01 UTC (Thu) by sholdowa (guest, #34811) [Link] No. Portage is *currently* at least as good as / better than rpm or dpkg in this respect at the moment. They all stuff up on a regular basis ( yes, even SuSE (: ), it's just not currently gentoo's turn.
( Although I've been hearing comments to the contrary, and complaints about the amount of diskspace required lately - but that's probably just a knock-on effect of 2006.0 getting a bit long in the tooth )
Wow, some misinformation never dies. Posted Aug 31, 2006 1:50 UTC (Thu) by corey_s (guest, #12510) [Link] > I see, so Gentoo is just the same as all other distros that use yum/rpm,or apt/dpkg, etc then?
Apparently you _don't_ see. When learning about a subject which you have
With a binary package management system, such as "yum/rpm or apt/dpkg" -
With a source-based package management system such as gentoo's portage,
Never use gtk or gnome, prefer qt and kde, and only ever script in perl?
USE="-gtk -gnome qt kde perl"
into your portage 'make.conf' config, and _every_ package you ever install
scanner ~ # emerge -s firefox
* www-client/mozilla-firefox
* www-client/mozilla-firefox-bin
scanner ~ # emerge -pv mozilla-firefox
These are the packages that would be merged, in order:
Calculating dependencies... done!
... notice the '-gnome' and '-java', etc for
That means the firefox on this particular system wont build with those
But what happens if I 'emerge' using different USE flags? Let's see:
scanner ~ # USE="gnome java -ipv6" emerge -pv mozilla-firefox
These are the packages that would be merged, in order:
Calculating dependencies... done!
Whoah... completely different result. LOTS AND LOTS of CRAP that my
This translates into better security.
This translates into more simple maintenance.
This translates into better performance.
If security, reliability and performance aren't something you much care
Minimalist builds untested Posted Aug 31, 2006 3:47 UTC (Thu) by xoddam (subscriber, #2322) [Link] > This translates into better security.
There are two potential schools of thought on this. One is, "deleted code is debugged code". For sure, vulnerabilities which are specific to the subsystems you're not including will not exist in your minimalist build.
But another point is that what you're running is rather different from anything that has had serious production testing by the upstream project or distributors' QA people. It's a product release uniquely made for and by you, and although you might *generally* be able to trust that upstream will ensure that builds with options switched off do basically work, no-one but you can promise that your exact combination is solid and security-hole free. Can you ever be sure that omitting a major component which everyone else uses won't introduce subtle bugs?
Minimalist builds untested Posted Aug 31, 2006 10:46 UTC (Thu) by jimmybgood (guest, #26142) [Link] This is certainly possible, but seems unlikely unless one chooses to build without security features like selinux or privilege seperation. Do you have any examples? Has there been an abiword built the Debian way with four spell checkers and enchant that doesn't have a vulnerability that abiword built with just one spell checker *does* have? Has there been a cairo built with directfb, svga, ggi and aalib support that is more secure than a cairo built only with X support?
By the same token, upgrading in response to a security fix has been known to leave you more vulnerable than before the security fix. But common sense and experience dictate that you will more likely be safe than sorry for upgrading in such a situation.
While I can't be sure that subtle bugs won't be introduced by building with a reduced feature set, I think, with Linux anyway, the less software I have, the safer I am. With OpenBSD, though, I might agree with you. The consideration being the experience and dedication to security of the coder and the rigor with which the code is tested and audited before being released.
Minimalist builds untested Posted Aug 31, 2006 15:01 UTC (Thu) by cventers (subscriber, #31465) [Link] Perhaps, but one thing I find interesting about building your system fromsource (and then prelinking your magic blend) is that it would presumably make things much more difficult for someone that wanted to inject shellcode through an overflow vulnerability. If you want to target a bunch of Linux systems, you can go after a distribution like Red Hat where everyone is running exactly the same binaries.
In a world like Gentoo, though, they're running the same software, but
That doesn't alleviate the problem the way some other solutions (like
Wow, some misinformation never dies. Posted Aug 31, 2006 3:57 UTC (Thu) by sholdowa (guest, #34811) [Link] To quote "It's not about compiler optimization, it's about being able to choose the optimal feature set for your needs."
Now, reread *your* post in the light of that statement, which was the one that *I* was responding to. In which way does gentoo's emerge system differ to yum or apt when choosing feature sets?
See my point now?
Wow, some misinformation never dies. Posted Aug 31, 2006 7:01 UTC (Thu) by flewellyn (subscriber, #5047) [Link] Yes, but it's not a very good one. See, you're missing that many of these packages (especially complex ones like PHP or Apache) have compile-time options that determine what features are built in. If you only use precompiled packages, you can't choose those. This should be readily apparent.
Wow, some misinformation never dies. Posted Aug 31, 2006 21:13 UTC (Thu) by sholdowa (guest, #34811) [Link] Err, no you're pretty much completely wrong there. I see what you're saying, and build my internet facing servers from source for exactly that reason.
My point was that the OP made a sweeping statement that IMHO was almost totally untrue. A package management system is a package management system, is a package management system and the only thing that really makes gentoo's different is the ability/expectation to build from scratch. They're all as good as the data contained within them, and because that's put there by people, they all make mistakes at some time or other.
To address your point, debian allows me to optionally install the following modules for apache 2.0. I could have just as easily used php for an example.
libapache2-mod-annodex - Provides server-side support for Annodex media
Some information Posted Aug 31, 2006 6:52 UTC (Thu) by man_ls (subscriber, #15091) [Link] In short: with Gentoo you get to choose the dependencies you want. You don't want a dependency with GNOME, fine: you can remove it. You cannot do that with apt. emerge then figures out the remaining dependencies for you.Gentoo makes for a very nice desktop; try it one time instead of blindly bashing the fine work of many people. It was not lost time: I learned a lot. In the end I got tired of synchronizing with the repos and recompiling: yes, it's tiring, I felt like a distro maintainer (which in a sense I was). But then I had been spoilt by apt and rpm...
Some information Posted Aug 31, 2006 14:53 UTC (Thu) by cventers (subscriber, #31465) [Link] I'm still a Gentoo user.
I used to buy into this 'Gentoo Ricer' bs as well, reading sites like
I eventually decided to try Gentoo on the desktop when I started a new
|
|
||||||||||||