Slashdot Mirror

We kids have no idea what its like upgrading thousands of computers at work because unlike you, grandpa, we use [Ansible / Salt / Chef / CFEngine / Puppet]. And making changes to thousands and thousands of machines takes seconds to send out to all of them. A bit more time to verify, and any that are stuck can be rebuilt from scratch in a few more moments without even worrying about why it didn't work the first time.

Second point: why would you need some kind of interface to your firewall rules. Its a text file. Learn the syntax and keep in in version control. Then have the back end of version control push the change out through the programs that I just mentioned.

You're getting old. Its probably time to retire.

Whoosh ... read a little below on the comments section :-)

We kids have no idea what its like upgrading thousands of computers at work because unlike you, grandpa, we use [Ansible / Salt / Chef / CFEngine / Puppet]. And making changes to thousands and thousands of machines takes seconds to send out to all of them. A bit more time to verify, and any that are stuck can be rebuilt from scratch in a few more moments without even worrying about why it didn't work the first time.

Second point: why would you need some kind of interface to your firewall rules. Its a text file. Learn the syntax and keep in in version control. Then have the back end of version control push the change out through the programs that I just mentioned.

You're getting old. Its probably time to retire.

BtrFS has not been completed yet. ReFS is shipping. ReFS will not have all the features of the completed BtrFS, but for now ReFS offers features not available in any shipping Linux.

I don't think ZFS is production quality on Linux yet either. Storage Spaces under Windows is nor shipping.

I guess I should have qualified...many features are available and stable with BtrFS today, on Linux 3.2. If you need something more, like ZFS, it is available on BSD or one of the free Solaris distributions (if you're setting up servers, chances are you will be using a mix of the three). However, the architecture and intent of ReFS vs. BtrFS/ZFS is not really the same. And if we're talking about filesystems, one of the strengths of linux is access to unique special purpose fliesystems, like GlusterFS, NILFS, and XFS, if you have needs that are better suited by one of those. On Windows you really only have NTFS and I guess now ReFS.

Dynamic Access Control actually ups the ante for SELinux, grsecurity apparmor etc. While it still protects access to resources it does so based on potentially very fine grained policies which can express rules based on a very wide range of properties. And it brings claims based security all the way into the primary access control of an OS. Linux does not sport claims based security.

Ok, but let's see how it actually gets used. I don't know if you've actually ever used SELinux...there's a reason why almost no distribution ships with it enabled. It's a huge pain in the neck. Red Hat ships it with generic policies that kind of work, but don't really make use of its full capabilities. If you are storing military secrets, fine, but for most general purpose computing it just gets in your way. Creating even more fine-grained control just seems to me to be a feature set nobody will ever use.

Sure. I am not aware of any effort to bring something like VSS to Linux, though.

If you mean snapshotting, it is available in a number of different formats: at the block level (ZFS, NILFS), file level (BtrFS, OCFS2), volume level (ZFS, BtrFS, LVM2), and filesystem hack level (RSnapshot). I don't see what difference it makes whether it is a local or remote filesystem. It will work in both cases.

Yes, an automagic always-on, bi-directional VPN on steroids. No calling, no VPN client installations. Just take the laptop outside the perimeter and it is still connected, still secured, still managed.

Well, to be fair, you do still need to set it up. It doesn't just happen. The capability sounds a lot like IPsec to me, and this has been available on Linux for a long time. Windows too, but it seems they have added better integration with Active Directory.

Uhm, not quite. But unless you experience the new Server Manager you are not going to understand. It has this "declarative" feeling - comparable to controlling your network with declarative network policies as opposed to relying on scripts running on each node to set thing up.

Maybe you're right, I won't understand without actually using it. But based on your description, this sounds exactly like Chef. I would put this firmly in the "Microsoft playing catch-up" category, because this type of management has long been a strength on Linux.

If you're into devops, the company I work for has today released a knife client plugin for compatibility with Azure, allowing you to spin up and manage Azure instances easily from the command line. And of course knife can bootstrap Chef onto any of the announced Azure OSs. I'll let the press release provide details, because it does a better job of it than I will ;)

http://www.opscode.com/press-releases/opscode-announces-interoperability-with-windows-azure/

simple - chef:

http://www.opscode.com/chef/

There's a difference between installation using apt-get and actually serving pages with a full configuration that might include stuff like memcache, drupal, mariadb, in a professionally hosted environment, serving multiple domains. Gimme a break. There's a reason Debian calls its stable repo stable.

Bullshit. We run ubuntu 10.04 on all our servers. Currently we have 20 servers and will increase that number the coming months. Ubuntu has served us very well. I used to run Debian which is almost the same and also a very nice system. So what do you mean? If you run apt-get install nginx on Debian you just get a full config for memcache, drupal, mariadb with that? You actually have to configure those things yourself regardless. We use chef - http://wiki.opscode.com/display/chef/Home - for that. We run things such as redis, mysql, riak and rabbitmq. Apart from our servers we also run small devices in different parts of the world - they run Ubuntu 9.04, been running flawlessly for months (over a year in one case). Ubuntu and Debian are both great - but don't bash Ubuntu just 'cause you don't know any better, thankyouverymuch! And yeah, it's only you.

Ruby people make some cool tools that you can use even if your code isn't written in Ruby. Check out Chef and Vagrant. Both are configured with Ruby, which is amenable to making DSLs.

It's an Apache 2.0 license probably just for that reason:
http://www.opscode.com/blog/2009/08/11/why-we-chose-the-apache-license/

While the 3-Clause BSD license allows you to do pretty much anything you want with the code in question, it provides no direct language around these areas. The Apache License, on the other hand, does. It makes very clear that individual contributors grant copyright license to anyone who receives the code, that their contribution is free from patent encumbrances (and if it is not, that they license that patent to anyone who receives the code,) and that use of Trademarks extends only as far as is necessary to use the product. It also includes a patent termination clause, should a lawsuit arise.

So, if you use Apple's mDNS code, you're in the clear. If you try and reinvent something, (like microsoft is doing) are in violation in Apple's patents you're in trouble.

Puppet is a tool made to do exactly what you're asking for by abstracting the specific operating system into a generic interface. It might be worth checking out. Also there's a newcomer called chef. And then there's the oldies like cfengine.