I implemented the current NAT system in Linux. In particular, avoiding port reservation in favor of squishing more connections into one IP address, as long as the remote address allowed us to differentiate.
This, in turn, means incoming traffic from a different address is unroutable. You no longer have a public endpoint. This is "poor man's firewall", but erodes our ability to have a server the way we used to.
I was a young engineer solving a specific problem, without considering the larger picture. It wasn't the only thing, but I feel it definitely moved the internet to a client/server infrastructure and a key equality was lost.
Mate ... How many people are engineers, technicians, mildly interested, not fussed or call the internet "Facebook"?
IPv4 without NAT was fucked at the design stage. To be fair: Who knew?
I was asked by my employer a while back to investigate this new www thing that has hit the internet (in around 1994 or 5, it took a while to notice) and I said it was a bit crap and no better than WAIS and GOPHER. I was using telnet on a Windows 3.1 PC and telnetting madly via a VAX and a X.25 PAD and what I now know was close to magic!
No one had any idea how things would turn out back then.
I'm actually quite impressed how long IPv4 has managed to work and without NAT (which I do mildly despise, given 30 years messing with this stuff), it would be stuffed.
> no better than WAIS and GOPHER. I was using telnet on a Windows 3.1 PC
I had a corporate internship in the late 1990s and they blocked external web access.
They did, however, allow external Telnet access. This meant that whenever I had free time and/or was waiting for new projects, I would telnet back to my college server and use lynx to go read my favorite websites.
Sorry, i am not very much into kernel/netstack development, but a question. So does it mean that even if an alternative NAT system will be available in Linux (kernel module with a switch or whatever) - it will not be adopted by industry because everyone (and every device) is used to how it works now?
NAT itself was a hack to let everything keep working like it already was despite there being more computers than IPv4 addresses.
The Internet Protocol only concerns itself with IP addresses. The idea is that each computer has an IP address, so computers can communicate by sending IP packets; each IP packet says, "Message from computer with IP address X to computer with IP address Y".
But computers have multiple processes, so there's a need to know which process at the receiving computer is the recipient and which process on the sending computer is the sender. This is why transport protocols (TCP and UDP) add a port field. A port uniquely identifies a particular socket opened by a particular process on a computer. So a TCP or UDP message sent via the Internet Protocol contains the information, "From the socket with port 41590 on the computer with IP address X, to the socket with port 443 on the computer with IP address Y".
NAT is a giant hack which is primarily implemented in routers. It makes a whole household (or office building, or university campus) look to the outside world like one big computer with one IP address.
Say we have a computer with IP address L, a router with public IP address X, and a public server with IP address Y. The computer will send a message to the router which says, "From port 41590 @ L, to port 443 @ Y". The router will invent a new random port number (say 41200), add an entry to its NAT table which says "port 41200 means port 41590 @ L", then send a message to the public Internet: "From port 41200 @ X to port 443 @ Y".
When someone then sends back a message "to port 41200 @ X", the router looks that up in its NAT table and rewrites the packet to say "to port 41590 @ L", then sends it to the computer with that local IP address.
The computer doesn't really know that it's speaking through a router. It needs to know that "packets to the public Internet should be sent via the router" but that's it, the packets it sends and receives looks the same as if the router wasn't there. The rest of the world doesn't know that it's speaking to the computer behind the router; from their perspective, it looks like they're just speaking directly to the router. All the special network address translation logic lives only within the router.
Already back then, you couldn't easily deploy solutions which required all computers and middle-boxes on the Internet to change. That's why NAT exists in the first place.
You could deploy a new NAT implementation, but the problem NAT solves is fundamentally that there aren't enough IPv4 addresses for every computer to have an IPv4 address so you need multiple computers to share. I don't think there's a better solution to that problem other than switching everything over to IPv6 (which has been in progress for the past 30 years and has barely reached 50%).
As an aside, you see the term "CGNAT" sometimes as well. This stands for Carrier-Grade NAT and is an evolution of the NAT concept to much bigger contexts; a whole city could share a handful of public IP addresses, making large regions effectively one "local network" behind a "router". Multiple streets could look to the outside world like they're just one gigantic computer. Each household in that area will then probably do its own layer of NAT, making it look to the CGNAT router like the household is one big one computer. This configuration can be called "double NAT". Since each router doing NAT only needs to know about its own NAT, there's really no limit to how deeply you can nest it.
If it's any consolation, I don't think NAT did anything particularly harmful other than making the adoption of IPv6 less urgent. It's CGNAT that's the real problem, not NAT.
I was confused. But yes, that same Zilog Corporation as the Z80. They also did... action comics as promotional material?
The final page, containing disclaimers (presumably from their standard spec sheets?) disclaiming any inaccuracy and warning "Not for use in life support" is adding, not removing, my confusion.
Yes, it's marketing materials for their computer products, including the Z80. "Not for use in life support" is extremely common in computer hardware disclaimers.
Always use -Wundef. For CCAN all config vars use #if and we lint for ifdefs of them, because you have to pick a side here, and sometimes using HAVE_X in C code is useful, so I prefer always-defined.
I hacked up a (not SMP-safe!) compressed loopback driver for a now-forgotten startup's "bootable business card" rescue disk. Over a year later I received an email from someone wanting to use it who was trying to port it forward.
When someone on my team started playing with this new Knoppix thing I was blown away: not just a rescue disk but a full-on distribution!
Moral: publish your hacks!
Hey, I found the email:
Date: Sat, 3 Jun 2000 02:17:47 +0200
From: Klaus Knopper <knopper@linuxtag.de>
To: Paul.Russell@linuxcare.com.au
Subject: Compressed Loopback device
Message-ID: <20000603021747.A17496@linuxtag.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
Sender: rusty@linuxcare.com.au
Hello Mr. Russel,
I'm trying to use your compressed loopback device as found on the LinuxCare
rescue CD-Rom, for my selfconfiguring Linux distribution that runs entirely
from CD (including XFree and KDE).
Unfortunately, the version that I got of the cloop device seems to act quite
instable (of course I recompiled it for Kernel 2.2.15, which should not
differ all too much from 2.2.14). I blame it on the fact that the file handle
is being read from stdin of insmod, but it could be something different.
With an SMP-Kernel, cloop.o crashes immediately on insmod when calling
fget(0). With a non-SMP kernel, it kills the kernel block buffer system,
shutting down all other block devices as well, when accessing certain large
files on an ext2 filesystem within the compressed block device file. It seems
that the ll_rw_block() routine fails in that case, and wait_for_buffer() never
returns, locking up something in the kernel block buffer management.
Do you maybe have a newer version of cloop that I can start working on?
Btw, I found and fixed the bug in extract_compressed_fs.c, but I think it
would really be nice if the sources for the whole package could be downloaded
from LinuxCare somewhere without having to get the whole CD-Rom image.
If I find the cloop lockup-bug before you have time to answer, I will send a
patch.
Regards
-Klaus Knopper
---
Klaus Knopper LinuxTag 2000 - Europes largest Linux Expo
No, not really, and I don't think you need to be snarky.
It may be an industry body, but it runs multiple community conferences and projects which support Open Source. A notable example in this case being the OpenSSF https://openssf.org/
The LF is not perfect, but I would expect them to come from an OSS and community angle on this.
I am pretty sure that these industries use the open source projects the Linux Foundation maintains. So it is pretty clear the Linux Foundation is indeed a user community group, too.
I guess our experiences vary - our family had month long adventure vacations most years since the 1970s, and growing up we did a half year tour about the whole country when dad got cumulative long service year.
(Disclosure: while I haven't talked with him in years, Tridge was my colleague and mentor for many years. I feel it is worth considering his view before joining a crusade)
> I thought it would be a good idea to do the core structure for the new test suite in public on master first though given all the rage that has generated maybe that was a bad idea.
I don't entirely understand what this is saying. People wouldn't have been outraged if only the tests had been updated and/or he pushed solely on master - but he pushed breaking changes onto the release branch(es) too. Breaking workflows that have worked for years is a prime way to get people irate, and then seeing "Claude" in the commits just pours gasoline onto the fire.
It seems that wasn't the Claude part, though I haven't seen a full analysis of exactly what broke. I also only saw one report: are there multiple, or do you just perceive that?
Rsync has many options: I can totally believe that fixing a bug in one place broke someone's usage, to be fair.
"yes, there were regressions in some use cases of rsync in the 3.4.3 release. I quite deliberately tried to err on the side of fixing security issues for that release, and there were some valid (but unusual) use cases that got caught up in the changes"
Yeah a big reason you see so much pushback on clanker slop is that it's having (and there was certainly the expectation of it having) a negative impact on the ability of plenty of people to pay their bills.
I used to think that until I did a little digging into it. Specifically, corporations are considered legal persons because they are separate legal entities, thereby creating a wall between your personal affairs and your business. It protects your personal assets from any liabilities, debts, or lawsuits.
Also, since it's a separate entity, its lifetime is not tied to the owner. So if the owner dies, their shares are inherited by somebody else, and the company keeps operating.
It helps in raising money for business operations. A corporation raises capital by issuing and selling shares of stock. However, if a physical person did that, I think it would be called indentured servitude.
I'm confused about why you believe this contrasts with what the above poster said. You've described a bunch of practical reasons why this is legally expedient and also at least one that seems to contrast with your own concept of personhood
Yes, it does conflict with my own concept of personhood. I forgot to add that to my comment.
I was trying to show that it is not "merely a legal expedient", that corporate personhood had a specific purpose, and that it differed from a real person. I think that the confusion about legal personhood in corporations comes from how lawyers explain its existence. A couple of lawyers I've had explained it as, it's just like a person in the law, except where it's different.
The problem is that we haven't created a clear enough distinction between a natural person and a legal person. In many cases, corporations have rights but not the responsibility. For example, they have speech rights, but they don't go to jail when the corporation commits a crime. The judicial inequalities between ordinary people and rich people are even greater between natural persons and corporations.
Yea, I mean, I think the reason people balk at corporate personhood are to do with both the iniquities committed by corporate actors and the fact that personhood is a really confusing model for all this
A model that treats what effectively amounts to a body of assets united by a charter as equivalent to a person - except when it isn't - is inherently confusing because these are not at all similar kinds of entities. While it's clear that this model has a purpose, I think people are right to point out that the equivalence is drawn by rather stilted logic and even more right to question whether the consequences of this legal framing are desirable from their perspective
A corporation is a separate entity. They hire people to work for them, but any liabilities incurred by the Corporation are rarely passed through to the workers. If you pay attention, it's more likely for a worker to go to jail or be held responsible for a screw-up by the legal system than one of the suits at the top.
The title at least sounds less like judgement and more analysis and more about AI assistance (and claude in particular) than rsync. Maybe I am too used to postmortems!
> Now if any of the people posting the rage stuff want to actually review any of the code I’ve published and make constructive criticisms then that would be great!
When you quickly churn more lines of code in a few days than you changed in months, and then release them as a normal, not sure you're expecting "constructive criticism"
Also if I suspect the project is just slopping high amount of code without proper thought, I probably won't invest my time into reading those changes
I get that there's a lot of loud nonsense flying around about AI, both positive and negative, and I echo the sentiment that people should have some damn perspective when talking to FOSS maintainers, but I think writing a bunch of AI-assisted code that causes regressions and then responding to that by throwing out a strawman about how critics (with PhDs no less!) are telling him these things can't do anything at all and can't possibly understand how literally everything has fundamentally changed in the last few months sounds way more like a guy who has a motivated (and understandable - he's retired ffs) reason to... a little bit buy into the hype
I think he makes a lot of good points here, but also think that kind of statement is unlikely to assuage the real concerns of people using the software. I think people are more likely to fork rsync now rather than rely on a more diverged earlier alternative implementation though
One of the most reliable OSS sync/backup tools on the planet for 2+ decades broke under people's daily backup use of it because of a large pile of LLM-driven changes basically out of nowhere from the project maintainer in a minor point release. I think they're right to be annoyed and to complain about it.
Whilst a lot of the Claude changes are test related, there were still other changes that obviously broke things for people - and who's to say that some of the testing changes may not have thinned out the testing too given one commit "rewrote all shell tests in python" with over 4000 lines added and removed at once. And even after all that Claude churn on the testing, these breaking changes obviously weren't caught by tests, so it's not exactly an "enhancement" from the end user perspective.
> Just because you got shat on the head once it doesn't mean it's fine to be shat on the head every day now.
This happens frequently when there are fixes for CVEs, since regression tests can't catch many things which incremental rollouts can. It happened for example in 2025. People are right to imply the reaction is totally outsized here, and it's almost certainly the case that people are overreacting to AI (rather than the somewhat weak idea that it's because of the frequency of these issues).
What's really funny is that the people opposing AI here are showing far less literacy than those who wrote the code. People claiming to be affected by this bug severely are likely exposing themselves:
* One bug is for Linux < 5.6, where it didn't hit distributions. This is a low severity bug where it can't build, where distribution maintainers may be reasonably expected to fix it themselves (although rsync will also fix it eventually too).
You probably don't want to revert in this scenario. If someone is hit by this bug and is running rsync in an automated manner, it is highly likely they're ignoring very many security practices: you're usually not supposed to run native rsync in an automated manner (the main use case is for public users, where you can't SSH etc; since it's unencrypted, you're supposed to check a checksum against a website etc); these cases are hit with chroot false, which is deeply discouraged and leads to far larger attack surfaces.
I implemented the current NAT system in Linux. In particular, avoiding port reservation in favor of squishing more connections into one IP address, as long as the remote address allowed us to differentiate.
This, in turn, means incoming traffic from a different address is unroutable. You no longer have a public endpoint. This is "poor man's firewall", but erodes our ability to have a server the way we used to.
I was a young engineer solving a specific problem, without considering the larger picture. It wasn't the only thing, but I feel it definitely moved the internet to a client/server infrastructure and a key equality was lost.
reply