socsa

SELinux isn’t really meant to be a user space “utility,” for lack of a better term. It’s meant to be an expert focused security framework for those with the expertise to both understand and implement robust security policies. Your average user daily driving Linux or even running a few self hosted services doesn’t really need complex security policies, and is definitely better served by some simpler tools.

Most people don’t actually like real security as much as they claim they do. SELinux and its derivatives are pretty much the only real option we have for properly robust security these days.

A skightly different view, but when I started a lot of companies did give back. I have worked with, hired, managed and led at least a half dozen teams with the explicit mission to make an already existing open source project do what we want by contributing functionality upstream, or by forking the project. I actually wrote a “open source engineering management” curriculum back when I was still teaching.

Unfortunately these efforts often sttuggle in a similar way - some developer who is not affiliated with us starts creating friction, and blowing up internal schedules, sometimes seemingly on purpose. Management starts to ask why so many of our features are dependent on SkankTopia6969 approving PRs and awkward conversations ensue. And then the project slowly becomes the process of educating an increasingly detached internal hierarchy on the realities of open source development, and people inevitability start asking why this is even in-house tooling in the first place.

Despite that, I’ve fielded a bunch of products like this, though always at fairly small scale (like $10M/yr revenue). The only time I’ve really done it big league the project got canned during a technical reorg.

Gen Z was a mistake

Praise be upon him

Wait until you find out how much of Linux the NSA has built.

This makes it seem like jerking off to MILF porn is hard because there is a learning curve

Great so now I will mangle all my merge commits depending on which version the host is using.

The M stands for beefcake

Vim is way easier tho

Be the operator overload you wish to see in the world