Top all-time · #3518
Md at debian.org
Personal blog · blog.bofh.itsystemssecurity
Md at debian.org is a personal blog at blog.bofh.it about systems and security. Since 2013, 22 different Hacker News readers have linked it 27 times, most often “Evading from linux containers (2011)”. It is still writing: the last post was on 2026-03-23, and you can follow it by feed.
Too few sampled comments (16) to say how often HN recommends it.?
Why HN links it
Md's Debian blog, cited by HN commenters for container security (LXC and Docker privilege escapes), the Freenode/Libera Chat takeover, and systemd. Commenters link it as a source for those points.
Summarised by Claude from a sample of 16 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Evading from linux containers (2011)8 people · 10 mentions · first linked 2013-03-26
- My Resignation from Freenode6 people · 6 mentions · first linked 2021-05-19
- Systemd has not implemented age verification3 people · 3 mentions · first linked 2026-03-24
- I replaced grub with systemd-boot2 people · 2 mentions · first linked 2023-02-15
What Hacker News says?
It's worrisome to me that one of the stated objections I've seen to Freenode's new owner is related to his personal politics: https://blog.bofh.it/debian/id_461 My own personal politics are probably very very similar to the above author who was complaining about the new owner being "Trumpian", but what will happen if/when we disagreed about something? Would I get the boot from Libera? I totally don't care about Oran…
Comment linking /debian/id_461
on “Welcome to Libera Chat”Submitted Hacking Team and a case of BGP hijacking as a story · 171 points
HN discussionEarlier implementations had bugs like this http://blog.bofh.it/debian/id_413
Comment linking /debian/id_413
on “Containers vs. Zones vs. Jails vs. VMs”Submitted My Resignation from Freenode as a story · 151 points
HN discussionGiven the amount of backlash this whole debacle has in the community, couldn't a crowdfunding to cover legal costs be successful enough to start a lawsuit? AFAIK funding is the main reason why a lawsuit isn't happening ( https://blog.bofh.it/debian/id_461 ). Everyone should still move to Libera, but a lawsuit might bring some justice.
Comment linking /debian/id_461
on “Freenode ops take control of 700 channels”Submitted Mastodon is not ready for me as a story · 16 points
HN discussionWhich namespacing features are still young? Is it still possible to evade LXC as described in this post? http://blog.bofh.it/debian/id_413
Comment linking /debian/id_413
on “Docker 0.7 runs on all Linux distributions”Submitted 15 years of whois client as a story · 4 points
HN discussionAwesome product! I've squinted at lxc for a while now. This looks great! But: What about this security issue regarding lxc? Does docker takes measures to prevent this? http://blog.bofh.it/debian/id_413 The issue itself appears to be fixed if you use Linux 3.8 with compiled in namespace support (that breaks NFS and other filesystems at the moment)
Comment linking /debian/id_413
on “Docker, the Linux container runtime: now open-source”Submitted Systemd has not implemented age verification as a story · 3 points
HN discussionExample here: http://blog.bofh.it/debian/id_413 * Got root in the countainer. * You "know" where that is mapped to on the host, because it is based on the UID of the container which is set as the hostname. * You configure a trigger to run a script, using that knowledge. * Code happens on the host, outside the container.
Comment linking /debian/id_413
on “Runnable – jsfiddle for everything”Submitted I replaced grub with systemd-boot as a story · 3 points
HN discussionPlease see this example - http://blog.bofh.it/debian/id_413
Comment linking /debian/id_413
on “Runnable – jsfiddle for everything”Submitted systemd has not implemented age verification as a story · 2 points
HN discussionIt is, but the legal challenge would be expensive according to https://blog.bofh.it/debian/id_461
Comment linking /debian/id_461
on “The whole freenode kerfluffle”Submitted Bypassing deep packet inspection with socat and HTTPS tunnels as a story · 1 points
HN discussionFor your convenience here are the URLs from that broken document: http://blog.bofh.it/debian/id_413 http://reventlov.com/advisories/using-the-docker-command-to-... http://events.linuxfoundation.org/sites/events/files/slides/... http://opensource.com/business/14/9/security-for-docker https://zeltser.com/security-risks-and-benefits-of-docker-ap... https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1... https:/…
Comment linking /debian/id_413
on “Docker and Security [pdf]”Submitted On having a track record in operating systems development as a story · 1 points
HN discussionLXC is not secure at the moment. root in a LXC container can lead to root on the host. There is unfortunately no good summary of the problems - here is my list (take it with a grain of salt - a lot of these problems are mitigated in docker.io and with AppArmor in Ubuntu): - Without CONFIG_USER_NS and a newer kernel a lot of problematic things can happen. If /proc or /sysfs is mounted on the container DoS or escalati…
Comment linking /debian/id_413
on “LXC Networking introduction”Submitted I replaced grub with systemd-boot as a story · 1 points
HN discussionThis is the first that comes to mind: http://blog.bofh.it/debian/id_413
Comment linking /debian/id_413
on “Running GUI apps with Docker”Submitted Evading from linux containers (2011) as a story · 1 points
HN discussionMy understanding is that recent (13.10+) Ubuntu ships with an AppArmor profile that blocks known ways of escalating out of the container. So, LXC under Ubuntu is in better shape than LXC on other distros, where you can use the uevent_helper trick[1] to easily escape the container. It sounds like your use case could also use the new unprivileged containers[2] feature, which is going to be a dramatic increase in secur…
Comment linking /debian/id_413
on “LXC 1.0 Released”And now jess, kline, and Md: https://gist.github.com/jesopo/45a3e9cdbe517dc55e6058eb43b00... https://www.kline.sh https://blog.bofh.it/debian/id_461
Comment linking /debian/id_461
on “Freenode resignation is official, not a draft”here is post about it https://blog.bofh.it/debian/id_461
Comment linking /debian/id_461
on “The new corporate owner of Freenode is Imperial Family Companies”Telecom Italia is well-known to manage noteworthy pilot projects. But the company often fails in making these excellences the norm. For the mobile network: - the coverage of 4G is ... scarce > In Italy, almost all of the population can benefit from mobile Internet connectivity services over the 2G network, namely Global System for Mobile Communications (GSM), GPRS (General Packet Radio Service) and EDGE (Enhanced Da…
Comment linking /id_432
on “Nationwide 5G to cover all 24 square miles of San Marino”That's not even factually correct, systemd doesn't verify anybody's age, it just provides a DBus API to store any date the user enters, in case the OS provides some UI on top of it. https://blog.bofh.it/debian/id_473
Comment linking /debian/id_473
on “SystemD is of out of control. The Best Minimal, Modern, Linux alternative”
