柊 つかさ

The rational is systemd has a huge amount of features that normal desktop users will never need. If you use something like OpenRC or Runit the experience is not much (or any) different. All those features will introduce complexity and potential bugs and vulnerabilities.

Unless you use xdg-desktop-portal, the field that systemd added does absolutely nothing.

Sure it doesn’t add much, but many of the systemd things are ‘not much’. But together it is a lot.

I don’t see the vulnerability, especially considering that you’re comparing it to an SSH vulnerability (which, it should be noted, was caught in testing and never released).

Luckily it was the case, but it was way too close for comfort. It doesn’t change the fact that bloated systems like systemd are what enable these types of attacks. If you use many of its features I’m sure its great, all software has bugs and holes in it. But the point is that if you don’t need the features you don’t need to expose yourself to the extra bulk and risks. Same for things like sudo vs doas. Almost everyone uses sudo but 99.9%+ doesn’t use any features that doas doesn’t have. And then of course systemd invents its own alternative 😅.

And then there is the Unix philosophy. If we need age verification, why does it need to be in the init system? Why not a separate package that can be installed along side any init system / kernel / desktop environment / etc? If it lives in the init system, every init system needs to implement their own version of it.

I doesn’t but the exploit required it.

First Artix made me not vulnerable to the XZ backdoor (requires systemd). Now it saves me from age verification nonsense. Even on Lemmy sentiment seems people who avoid systemd are just cranks. But every time we are right.