Re: NSS and PAM

Dag-Erling Smørgrav wrote:
> NSS itself doesn't make much sense to me; it's an elaborate hack
> designed to drag all those nice shiny directory services down in the
> mud where struct passwd has been wallowing for the past twenty years,
> instead of allowing applications to take advantage of their superior
> functionality.
> 
> As for PAM, a lot of what's wrong with it today could be fixed by
> redesigning it to include directory services.  If you fixed the
> conversation system (by formalizing service function execution as an
> FSM) and cleaned up the configuration syntax, you'd end up with
> something quite nice.
> 
> DES

Replacing passwd/group/NSS/PAM/whatever with a real database or 
directory backend is a kind of holy grail for Unix that's been discussed 
for many years.  I would love to see it happen.  But I doubt it could 
ever happen within a collaborative project like FreeBSD, since it would 
be impossible to get enough people to agree upon the innumerable small 
details.  I don't want to sound so pessimistic, but I think that's just 
a reality of group projects.

I think this is part of the reason that many people are passionate about 
the dynamic library implementation of PAM/NSS.  We realize that the odds 
are very high that the alternatives will be endlessly discussed, but 
never implemented.  Since this is a feature that many of us really need, 
we prefer the less than perfect but existing implementation to the 
perfect, but never implemented solution.

This discussion has really reminded me of the classic paper by Richard 
Gabriel on "Lisp: Good News, Bad News, How to Win Big".  This is one of 
the best essays on the "Worse is Better" phenomenon.

http://www.ai.mit.edu/docs/articles/good-news/good-news.html
http://www.dreamsongs.com/WorseIsBetter.html

Richard Coleman
richardcoleman_at_mindspring.com