Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Notorious b.s.d.
Jan 25, 2003

by Reene

OldAlias posted:

do you use either of these as a desktop operating system? packages are outdated as gently caress.

this matters a lot less often than you might think

centos 7 is a perfectly adequate desktop

Adbot
ADBOT LOVES YOU

ahmeni
May 1, 2005

It's one continuous form where hardware and software function in perfect unison, creating a new generation of iPhone that's better by any measure.
Grimey Drawer

Soricidus posted:

just use fedora, it's the least worst desktop distro and you're gaining experience wiht the things rhel and centos are going to have in a few years. using anything else is just silly.

yeah this is exactly what I do

Notorious b.s.d. posted:

i would argue that fedora is more of an advertisement for redhat than a qa process

unless you are using 'rawhide'

(don't use rawhide)

that's fine, redhat is good and Good

Cybernetic Vermin
Apr 18, 2005

packages being old would only matter if there were actual progress on the linux desktop, as it stands you will just have vintage flaws rather than some new vulgar ones

EndlessRagdoll
May 20, 2016

fedora wasn't fit to fly on a laptop i was setting up. that and the name makes me think of a dweeb tipping his hat.

Silver Alicorn
Mar 30, 2008

𝓪 𝓻𝓮𝓭 𝓹𝓪𝓷𝓭𝓪 𝓲𝓼 𝓪 𝓬𝓾𝓻𝓲𝓸𝓾𝓼 𝓼𝓸𝓻𝓽 𝓸𝓯 𝓬𝓻𝓮𝓪𝓽𝓾𝓻𝓮
m'linux

cinci zoo sniper
Mar 15, 2013




m'anjaro

Apocadall
Mar 25, 2010

Aren't you the guitarist for the feed dogs?

Notorious b.s.d. posted:

sip/rtp over openvpn is a gigantic bag of hosed. you are completely, totally screwed.

these are real-time, latency- and jitter-sensitive audio streams. literally the worst case for tunneling over a tcp session w/ openvpn

there are special standards for encrypted sip/rtp for this very reason. you could also use native ipsec if the phones support it

they don't support ipsec, they're all yealink desk and conference phones, what we've tested so far was a conference phone and a desk phone communicating over the vpn

they just use .tar files with a config file and verious ssh keys and user/pass auth file but it does simplify deployment a bit over trying to use nat like we were, current number of phones is around 100-150 i think.

feels like if i wanted to do something similar with a branch office i would want some sort of hardware vpn instead of having every phone connect to it themselves?

MrMoo
Sep 14, 2000

OpenVPN/UDP would be equally as affective as IPsec, it's only the startup costs that are higher.

Notorious b.s.d.
Jan 25, 2003

by Reene

MrMoo posted:

OpenVPN/UDP would be equally as affective as IPsec, it's only the startup costs that are higher.

probably not

the virtue of ipsec for voip is that you can avoid tunneling. your packet stream doesn't have to get re-assembled or re-fragmented in another packet stream. your packets just get encrypted as they travel along. poof.

openvpn over udp is much better than openvpn over tcp, but it is still a big bag of hurt for latency/jitter-sensitive apps

Notorious b.s.d.
Jan 25, 2003

by Reene

Apocadall posted:

they don't support ipsec, they're all yealink desk and conference phones, what we've tested so far was a conference phone and a desk phone communicating over the vpn

they just use .tar files with a config file and verious ssh keys and user/pass auth file but it does simplify deployment a bit over trying to use nat like we were, current number of phones is around 100-150 i think.

feels like if i wanted to do something similar with a branch office i would want some sort of hardware vpn instead of having every phone connect to it themselves?

a vpn tunnel will be 100% fine for the provisioning. it will get kinda hairy for the actual voip traffic.

if you can afford hardware devices you can sidestep this problem and just set up ipsec. the devices on either end (the phones and the phone server) won't need to know anything is happening. the branch office router will just transparently encrypt packets as they go.

that said, you will probably need to use public ip space on your office networks to make it 100% transparent and avoid gre tunneling.

(have i ever mentioned that i hate working with voip?)

Notorious b.s.d.
Jan 25, 2003

by Reene
p.s. the symptom of voip being hosed by your branch office vpn is that it works just fine 90% of the time

then 10% of the time you either get hilarious delays or broken speech

it's really frustrating to test or troubleshoot

Cybernetic Vermin
Apr 18, 2005

it is weird how important network protocols and software seems to keep getting designed with people who do not understand the basic problems on the lower couple of layers, anyone who tunnels a tcp-style stream over another tcp-style stream ought to have some basic understanding of what they are getting themselves into

i mean, i can't design that poo poo well, but it certainly seems like people keep falling into traps which were understood 40 years ago

Notorious b.s.d.
Jan 25, 2003

by Reene
i don't know how nat + http proxies became the default choices for office networks but boy howdy was that the dumbest thing ever to happen to this industry

dumber than windows

Workaday Wizard
Oct 23, 2009

by Pragmatica

Notorious b.s.d. posted:

i don't know how nat + http proxies became the default choices for office networks but boy howdy was that the dumbest thing ever to happen to this industry

dumber than windows

what would you prefer then? (legit question)

cowboy beepboop
Feb 24, 2001

Shinku ABOOKEN posted:

what would you prefer then? (legit question)

ipv6 public IP for life

eschaton
Mar 7, 2007

Don't you just hate when you wind up in a store with people who are in a socioeconomic class that is pretty obviously about two levels lower than your own?

Notorious b.s.d. posted:

i don't know how nat + http proxies became the default choices for office networks but boy howdy was that the dumbest thing ever to happen to this industry

even 20 years ago IPv4 space was well understood to be scarce, and regular ISPs didn't want to provision sites with subnets etc. when they could just provision a T1 or DSL or cable modem with a single IP address and leave everything else up to the customer

plus NAT could do double duty as a firewall, and a proxy could improve performance via caching, or be used to monitor those unruly minions and block access to things the boss doesn't like

quote:

dumber than windows

that's a bit of a stretch

b0red
Apr 3, 2013

the fun part of nat + proxy is they are usually not configured correctly or entire vlans are going around them. seeing this way to much lately

celeron 300a
Jan 23, 2005

by exmarx
Yam Slacker
as a security nut, it boggles the mind as to why open source software sets default nat proxies

ekiga and pidgin, I'm looking at you

I mean, pidgin has default file trwnsfer proxies. Really?? That poo poo should just be pushed as defaults by the server and overridden by the user.

atomicthumbs
Dec 26, 2010


We're in the business of extending man's senses.
fortunately us radio hams can still be smug about owning 44.*

Korean Boomhauer
Sep 4, 2008

Apocadall posted:

because it's actually made to be an enterprise workstation and not some bespoke custom bullshit that's useless outside of toy applications?

i mean i know why fedora is better but i just needed a link to send to someone whos too boneheaded to use anything other than sabayon (is this a gaming linux or something)

celeron 300a
Jan 23, 2005

by exmarx
Yam Slacker

Korean Boomhauer posted:

i mean i know why fedora is better but i just needed a link to send to someone whos too boneheaded to use anything other than sabayon (is this a gaming linux or something)

comedy option: steam OS

celeron 300a
Jan 23, 2005

by exmarx
Yam Slacker
Really, he should use the OS that is most frequently tested for his games.

Which is probably some flavor of ubuntu.

celeron 300a
Jan 23, 2005

by exmarx
Yam Slacker
oh god, it's based on gentoo

Notorious b.s.d.
Jan 25, 2003

by Reene

the package system is called "entropy"

that seems appropriate

Notorious b.s.d.
Jan 25, 2003

by Reene

eschaton posted:

even 20 years ago IPv4 space was well understood to be scarce, and regular ISPs didn't want to provision sites with subnets etc. when they could just provision a T1 or DSL or cable modem with a single IP address and leave everything else up to the customer

twenty years ago dsl and cable were unspeakably rare, and ip space was both common and essentially cost free

i know guys who still have /24s allocated to them personally. arin gave zero fucks in the 90s




edit: also cable didn't leave anything up to the customer in the early days. the first cable connection i ever used came with a cisco access router and a guy to configure it. i poo poo you not. this was, needless to say, very expensive

ahmeni
May 1, 2005

It's one continuous form where hardware and software function in perfect unison, creating a new generation of iPhone that's better by any measure.
Grimey Drawer

Notorious b.s.d. posted:

i don't know how nat + http proxies became the default choices for office networks but boy howdy was that the dumbest thing ever to happen to this industry

dumber than windows

Blaster

Sapozhnik
Jan 2, 2005

Nap Ghost
https://www.bassi.io/articles/2016/07/05/gsk-demystified-1/
https://blogs.gnome.org/hughsie/2016/07/05/flatpak-and-gnome-software/

gnome continuing to own pretty hard today, also making big strides towards being a respectable desktop environment and rendering distributions less relevant over time

Progressive JPEG
Feb 19, 2003

:allears:

Soricidus
Oct 21, 2010
freedom-hating statist shill
is flatpak the thing where you make distros irrelevant by installing them all at the same time in hidden directories, or did they come up with a less hilariously bad way of doing it

Sapozhnik
Jan 2, 2005

Nap Ghost

Soricidus posted:

is flatpak the thing where you make distros irrelevant by installing them all at the same time in hidden directories

No, although it does kinda seem that way at first glance.

The idea is that GNOME, KDE, and Freedesktop distribute "runtimes", which are collections of libraries typically required by the apps that run on their respective desktop environments, and they release a new runtime every time they release a new version of their desktop environments. Also those runtimes are built and patched by the desktop projects themselves, not by RH or Debian or whatever. A runtime will contain things like Gtk+, Wayland, and PulseAudio client libraries, but not Xorg or GNOME Shell or whatever. Those are considered part of the OS and are not managed by FlatPak, so the runtimes are not distros.

FlatPak apps run in containers. The runtime gets bind-mounted into /usr, the app gets mounted into /app (with a similar internal structure to /usr), and each app gets a private /var that ends up somewhere under the user's ~/.local folder. Apps can also get the user's home directory mounted into the container, but the preferred way for them to interact with your files is for them to request files using DBus services which implicitly grant access to a user's files by displaying a File Open dialog and then passing the app an fd for whatever file the user picked.

The whole thing is also modularized nicely; it stores all the installed files in OSTree which is a Git type thing for binaries that can perform side-by-side runtime installations and upgrades efficiently in both space and bandwidth, and the actual containerization is done by a reusable thing called BubbleWrap.

Soricidus
Oct 21, 2010
freedom-hating statist shill
thanks for the effortpost, that sounds a lot better than I was imagining

cowboy beepboop
Feb 24, 2001

speaking of OSTree I played around with project atomic while evaluating docker runtime hosts and I really like how it handles system upgrades. good poo poo redhat.

Sapozhnik
Jan 2, 2005

Nap Ghost
KDE just released a new version of their desktop. I tried their LiveUSB image.

Trip report: it's still bad

Notorious b.s.d.
Jan 25, 2003

by Reene

Mr Dog posted:

No, although it does kinda seem that way at first glance.

The idea is that GNOME, KDE, and Freedesktop distribute "runtimes", which are collections of libraries typically required by the apps that run on their respective desktop environments, and they release a new runtime every time they release a new version of their desktop environments. Also those runtimes are built and patched by the desktop projects themselves, not by RH or Debian or whatever. A runtime will contain things like Gtk+, Wayland, and PulseAudio client libraries, but not Xorg or GNOME Shell or whatever. Those are considered part of the OS and are not managed by FlatPak, so the runtimes are not distros.

FlatPak apps run in containers. The runtime gets bind-mounted into /usr, the app gets mounted into /app (with a similar internal structure to /usr), and each app gets a private /var that ends up somewhere under the user's ~/.local folder. Apps can also get the user's home directory mounted into the container, but the preferred way for them to interact with your files is for them to request files using DBus services which implicitly grant access to a user's files by displaying a File Open dialog and then passing the app an fd for whatever file the user picked.

The whole thing is also modularized nicely; it stores all the installed files in OSTree which is a Git type thing for binaries that can perform side-by-side runtime installations and upgrades efficiently in both space and bandwidth, and the actual containerization is done by a reusable thing called BubbleWrap.

i'm not giving access to my home directory to anything directly maintained by gnome upstream

those guys are totally fuckso nutballs

Notorious b.s.d.
Jan 25, 2003

by Reene
hey remember the loving ridiculous gtk 4.x compatibility plan?

https://davmac.wordpress.com/2016/07/05/why-do-we-keep-building-rotten-foundations/

hope you like having literally 20 copies of every library with unknown security holes on your box

Sapozhnik
Jan 2, 2005

Nap Ghost
It's a bit of a PR nightmare but there's at least some merit to the argument. Basically, major things have changed in the world of GUIs since Gtk 2 was the latest and greatest. HiDPI emerging on consumer platforms is one, and a universal expectation of tear-free hardware accelerated UI compositing is another. These are breaking changes, you cannot retrofit a repaint-on-expose application to use vsynced double buffering without losing most of the benefit of double buffering. And the Gtk team do actually have some credibility in that they do continue to maintain Gtk 2.

Gtk 3 had a bunch of API breakages on account of the whole CSS thing they're doing with widgets. They didn't really have a plan nor a stable release branch that people could target in the meantime. But they are saying that will be stable soon, so Gtk 3 will no longer be such a moving target. BUT, next they want to do this scene graph stuff in order to push more drawing operations into the GPU. Software rendering a UI at 60fps on a 2440x1800 HiDPI display at 60 fps (e.g. when resizing a window) burns more battery and creates more heat than it really ought to. My laptop starts to get uncomfortable if anything uses significant amounts of CPU for an extended period of time. So they're introducing some internal plumbing called GSK, and they're also going to provide it as a scene graph API to application developers directly. People use Clutter for this sort of thing right now, but Gtk+ and Clutter have to do similar things (and mixing them is harder than it should be), so keeping them around as separate projects and continuing to develop them as well results in excessive maintenance burden. So, Clutter and Gtk 3 can be put into maintenance mode (which is a lot less work) and new development can happen in Gtk 4. If your instinct is to complain that Clutter just got pulled out from under you despite the fact that it would continue to receive bug fixes then it sounds like you want change and yet don't want change simultaneously.

Provided you believe that they will continue to maintain Gtk 3 while Gtk 4 bakes and then beyond that then this seems to be a decent proposal. They are straight up saying that Gtk 4 will have a whole bunch of churn so you should probably target Gtk 3 for the forseeable. If these revisions are co-installable and continue to be maintained just as Gtk 2 still is then what's the problem? It is possible to manage change in a non-disruptive fashion.

Sapozhnik
Jan 2, 2005

Nap Ghost

Notorious b.s.d. posted:

hey remember the loving ridiculous gtk 4.x compatibility plan?

https://davmac.wordpress.com/2016/07/05/why-do-we-keep-building-rotten-foundations/

hope you like having literally 20 copies of every library with unknown security holes on your box

No, not "literally" 20. Maybe literally two or at most three copies of Gtk itself. You realize Qt4 applications are not exactly extinct in the wild either, right?

Notorious b.s.d.
Jan 25, 2003

by Reene
qt4 already supports hi dpi just fine, has done for years

and qt5 didn't break every god drat qt4 api

none of the gtk3 insanity was really necessary, it's just the worst cadt ever

Notorious b.s.d.
Jan 25, 2003

by Reene

Mr Dog posted:

No, not "literally" 20. Maybe literally two or at most three copies of Gtk itself. You realize Qt4 applications are not exactly extinct in the wild either, right?

every upstream app provider is going to have to ship their own gtk and their own libxml2 and so on because holy lol at the amount of fragmentation we are talking about here

if i need gtk 4.6 and openssl 1.0.1f my flatpack isn't going to be able to use your runtime because it has gtk 4.7 or openssl 1.0.1e

Adbot
ADBOT LOVES YOU

Notorious b.s.d.
Jan 25, 2003

by Reene

Mr Dog posted:

If these revisions are co-installable and continue to be maintained just as Gtk 2 still is then what's the problem? It is possible to manage change in a non-disruptive fashion.

btw the official plan is to just change the *sonames* not the header names, so they won't be co-installable without shitloads of effort from distributors. you will only be able to build gtk 4.6 applications OR gtk 4.7 applications, not both at once

meanwhile, everyone is circulating various plans to remove distributors from the picture

this is all going to go wonderful

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply