Re: lpd: the thin edge of the wedge?
Garance A Drosehn <[email protected]> Wed, 04 Mar 2026 13:20:53 -0500
| Newsgroups | gmane.os.freebsd.architechture |
|---|---|
| Message-ID | <AA57E931-CFD5-4CE9-8208-A01094DEB757__10979.3466444657$1772648494$gmane$org@FreeBSD.org> |
--=_MailMate_358B98BF-DEB0-4491-BC32-77577750A325_= Content-Type: text/plain; format=flowed; markup=markdown On 23 Feb 2026, at 21:43, Greg 'groggy' Lehey wrote: > I'm really quite concerned about the plans to remove lpd. I > understand that there are security issues with lpd, even if I haven't > heard any reports of exploits in over a third of a century, but the > approach seems wrong to me. If we follow this direction, we can pare > down FreeBSD to a bare minimum (the kernel and what else?). > > So what should be done? I'm explicitly copying core@ on this, though > I assume that you have all been following things. But this is a basic > issue for the project, so core@ (and not srcmgr@) should have a > position on this. > > I understand that des no longer feels interested in maintaining lpd or > fixing its apparently numerous bugs. But there are alternatives: > > 1. Find somebody who *is* interested. I haven't seen anything on the > mailing lists asking for this. Why not? > > 2. Take the corresponding code from another BSD, like we have done in > the past. des tells us, without details, that the OpenBSD code > has the same bugs. I've asked numerous times, but nobody has told > me whether they have spoken with the OpenBSD project about it. > And what about NetBSD or DragonflyBSD? > > 3. Make it a shared project amongst BSDs, like make(1). Hmm. I seem to be out of some loop here. First let me apologize for not following much of anything in FreeBSD in the past 2-3 weeks. We (RPI) had a major screwup with our VM cluster a few weeks ago, which triggered an abrupt reboot of many of our virtual machines, required a reboot of all our virtual machines to alleviate some dangers, and is now requiring a second reboot of all our virtual machines because the first fix was incomplete so we now need to fix the fix. I'm still in the middle of the second round of reboots, but I'll try catch up on the mailing lists and comment further later today. It might not be today because I'm still caught up in the cycle of reboots at work. This week is spring break for us so usually I'd have a lot of spare time, but this spring break has busy. Also, I went to do a minor macOS upgrade on my main PGP-capable mac last week, and instead that mac was upgraded two major versions of macOS. When I went to post this, I find that PGP isn't working for me anymore. I don't use PGP much, but I know it was working fine back in the end of January. But you can trust it's me. Who else would willingly *want* to admit that they have something to do with `lpd`? -- Garance Alistair Drosehn = [email protected] Lead Developer @rpi and [email protected] Rensselaer Polytechnic Institute; Troy, NY; USA --=_MailMate_358B98BF-DEB0-4491-BC32-77577750A325_= Content-Type: text/html Content-Transfer-Encoding: quoted-printable <!DOCTYPE html> <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/xhtml; charset=3Dutf-8"= > </head> <body><div style=3D"font-family: sans-serif;"><div class=3D"markdown" sty= le=3D"white-space: normal;"> <p dir=3D"auto">On 23 Feb 2026, at 21:43, Greg 'groggy' Lehey wrote:</p> <blockquote style=3D"margin: 0 0 5px; padding-left: 5px; border-left: 2px= solid #777777; color: #777777;"> <p dir=3D"auto">I'm really quite concerned about the plans to remove lpd.= I<br> understand that there are security issues with lpd, even if I haven't<br>= heard any reports of exploits in over a third of a century, but the<br> approach seems wrong to me. If we follow this direction, we can pare<br>= down FreeBSD to a bare minimum (the kernel and what else?).</p> <p dir=3D"auto">So what should be done? I'm explicitly copying core@ on = this, though<br> I assume that you have all been following things. But this is a basic<br= > issue for the project, so core@ (and not srcmgr@) should have a<br> position on this.</p> <p dir=3D"auto">I understand that des no longer feels interested in maint= aining lpd or<br> fixing its apparently numerous bugs. But there are alternatives:</p> <ol> <li> <p dir=3D"auto">Find somebody who <em>is</em> interested. I haven't seen= anything on the<br> mailing lists asking for this. Why not?</p> </li> <li> <p dir=3D"auto">Take the corresponding code from another BSD, like we hav= e done in<br> the past. des tells us, without details, that the OpenBSD code<br> has the same bugs. I've asked numerous times, but nobody has told<br> me whether they have spoken with the OpenBSD project about it.<br> And what about NetBSD or DragonflyBSD?</p> </li> <li> <p dir=3D"auto">Make it a shared project amongst BSDs, like make(1).</p> </li> </ol> </blockquote> <p dir=3D"auto">Hmm. I seem to be out of some loop here.</p> <p dir=3D"auto">First let me apologize for not following much of anything= in FreeBSD in the past 2-3 weeks. We (RPI) had a major screwup with our= VM cluster a few weeks ago, which triggered an abrupt reboot of many of = our virtual machines, required a reboot of all our virtual machines to al= leviate some dangers, and is now requiring a second reboot of all our vir= tual machines because the first fix was incomplete so we now need to fix = the fix.</p> <p dir=3D"auto">I'm still in the middle of the second round of reboots, b= ut I'll try catch up on the mailing lists and comment further later today= =2E It might not be today because I'm still caught up in the cycle of re= boots at work. This week is spring break for us so usually I'd have a lo= t of spare time, but this spring break has busy.</p> <p dir=3D"auto">Also, I went to do a minor macOS upgrade on my main PGP-c= apable mac last week, and instead that mac was upgraded two major version= s of macOS. When I went to post this, I find that PGP isn't working for = me anymore. I don't use PGP much, but I know it was working fine back in= the end of January. But you can trust it's me. Who else would willingl= y <em>want</em> to admit that they have something to do with <code style=3D= "margin: 0 0; padding: 0 0.25em; border-radius: 3px; background-color: #F= 7F7F7;">lpd</code>?</p> </div><div id=3D"1E5069B8-B094-48FD-8A96-D66CC42C52FB"><!DOCTYPE html><di= v dir=3D"auto" style=3D"color: rgb(0, 0, 0); font-family: sans-serif; fon= t-style: normal; font-variant-caps: normal; font-weight: normal; letter-s= pacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-= transform: none; white-space: pre-wrap; widows: auto; word-spacing: 0px; = -webkit-text-stroke-width: 0px;">-- = </div><div dir=3D"auto" style=3D"color: rgb(0, 0, 0); font-family: sans-s= erif; font-style: normal; font-variant-caps: normal; font-weight: normal;= letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0= px; text-transform: none; white-space: pre-wrap; widows: auto; word-spaci= ng: 0px; -webkit-text-stroke-width: 0px;">Garance Alistair Drosehn = =3D [email protected] </div><div dir=3D"auto" style=3D"color: rgb(0, 0, 0); font-family: sans-s= erif; font-style: normal; font-variant-caps: normal; font-weight: normal;= letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0= px; text-transform: none; white-space: pre-wrap; widows: auto; word-spaci= ng: 0px; -webkit-text-stroke-width: 0px;">Lead Developer @rpi = and [email protected] </div><div dir=3D"auto" style=3D"color: rgb(0, 0, 0); font-family: sans-s= erif; font-style: normal; font-variant-caps: normal; font-weight: normal;= letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0= px; text-transform: none; white-space: pre-wrap; widows: auto; word-spaci= ng: 0px; -webkit-text-stroke-width: 0px;">Rensselaer Polytechnic Institut= e; Troy, NY; USA</div></div> <div class=3D"markdown" style=3D"white-space: normal;"> </div> </div> </body> </html> --=_MailMate_358B98BF-DEB0-4491-BC32-77577750A325_=--