Re: lpd: the thin edge of the wedge?

Garance A Drosehn <[email protected]> Sun, 08 Mar 2026 16:24:47 -0400
Newsgroups	gmane.os.freebsd.stable
Message-ID	<015AFBE5-A26D-4522-BDC6-32A0153E436F__30295.4534463183$1773001518$gmane$org@FreeBSD.org>
On 4 Mar 2026, at 13:20, Garance A Drosehn wrote:

> On 23 Feb 2026, at 21:43, Greg 'groggy' Lehey wrote:
>
>> I'm really quite concerned about the plans to remove lpd.  I
>> understand that there are security issues with lpd, even if I haven't
>> heard any reports of exploits in over a third of a century, but the
>> approach seems wrong to me.  If we follow this direction, we can pare
>> down FreeBSD to a bare minimum (the kernel and what else?).
>>
>> So what should be done?  I'm explicitly copying core@ on this, though
>> I assume that you have all been following things.  But this is a basic
>> issue for the project, so core@ (and not srcmgr@) should have a
>> position on this.
>>
>> I understand that des no longer feels interested in maintaining lpd or
>> fixing its apparently numerous bugs.  But there are alternatives:
>>
>> 1.  Find somebody who *is* interested.  I haven't seen anything on the
>>     mailing lists asking for this.  Why not?
>>
>> 2.  Take the corresponding code from another BSD, like we have done in
>>     the past.  des tells us, without details, that the OpenBSD code
>>     has the same bugs.  I've asked numerous times, but nobody has told
>>     me whether they have spoken with the OpenBSD project about it.
>>     And what about NetBSD or DragonflyBSD?
>>
>> 3.  Make it a shared project amongst BSDs, like make(1).
>
> Hmm.  I seem to be out of some loop here.
>
> First let me apologize for not following much of anything in FreeBSD in the past 2-3 weeks.  We (RPI) had a major screwup with our VM cluster a few weeks ago, which triggered an abrupt reboot of many of our virtual machines, required a reboot of
> all our virtual machines to alleviate some [urgent] dangers, and is now requiring
> a second reboot of all our virtual machines because the first fix was incomplete
> so we now need to fix the fix.

Well, we (at RPI) have made it through the second set of reboots successfully, so now I can at least catch up on some of what's been happening.  Well really all that I've read is some of this thread, because I also need to catch up on my sleep.

People with good memories might remember that when I got my commit bit many years ago, it was for fixing things in `lpr`/`lpd`.  I then branched out into a few other parts of the base system, but in the past ten years I haven't done much of anything on those other parts.  But I did still like the idea of working on `lpr`/`lpd`.  I disconnected from the other parts of the system, but still kept my eye on `lpr`/`lpd`.

Back in January Warner sent me an email saying *"It's been several years since you've committed to lpr/lpd. Is that still something you're interested flagging for review in MAINTAINERS?".*  I appreciate him reaching out like that, even if he was only trying to see if I was still alive.  :)  I replied *"Yes, at least for now. Thanks."*  I expected to get some `lpd`-related emails after that, but have not seen any.  I realize that it could be that some were sent and I missed them.

While I don't track developer emails anywhere near as much as I should, I do still scan email subjects for `lpd`.  Following Warner's email, the first email I've seen with that in the subject was the one which started this thread.  Well, technically it was the one from Phabricator for *"D29566: lpd: Add -F flag to prevent daemonizing"*, which puzzled me because I thought that change was already committed.  But I read that email about 2 minutes before I read the first message in this thread.

(aside: I am also on some OpeBSD mailing lists, mainly just so I could follow `lpd`/`lpr` posts in the land of OpenBSD.  While there have been a few changes there, none of them seemed particularly urgent.)

I'll admit that right now I'm of two minds on this.  Part of me wants to point to all the commits that I have made to `lpr`/`lpd` and say *"What the hell guys?  If there's a problem then why didn't anyone contact me?"*.  However, part of me looks at the fact that I'm old and tired, and that I haven't read much of **any** FreeBSD-related email in a few weeks, and I wonder if maybe it's time for me to hang up the old commit bit.

I see that DES has committed several changes very recently, but I haven't looked through them yet.  Somewhere in this thread DES claims he's done more for `lpd` than anyone else in the last 25 years.  I'm sure that's true if we measured the last 15 years, but I really doubt it's true for the last 25 years.  And in the last 15 years I haven't seen much of any interest in `lpr`/`lpd` from anyone on any FreeBSD mailing list.

Feeding into my ambivalence is that my full-time job has been painfully busy for a few years, as RPI keeps trying to get by with less than half of the IT staff that it really needs.  So right now I'm torn between quitting FreeBSD versus quitting my job at RPI (well, "retiring" more than "quitting".  Yes, I'm that old...).

> Also, I went to do a minor macOS upgrade on my main PGP-capable mac last week, and instead that mac was upgraded two major versions of macOS.  When I went to post this, I find that PGP isn't working for me anymore.  I don't use PGP much, but I know it was working fine back in the end of January.  But you can trust it's me.  Who else would willingly *want* to admit that they have something to do with `lpd`?

I think I've fixed the issues with PGP email.  If you see this paragraph, than I have!


-- 
Garance Alistair Drosehn           =   [email protected]
Lead Developer @rpi               and        [email protected]
Rensselaer Polytechnic Institute;             Troy, NY;  USA
signature.asc (application/pgp-signature, 988 B)