Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus: Don't bother with grsecurity. Their patches are pure garbage

spinics.net

Post reply on HN
Print view View original

51–60 of 172 posts

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#51

Post by [deleted] »

ThrustVectoring wrote: post #45
topkeker wrote: post #6

Grsecurity wouldn't exist if Linux made security a priority. It doesn't, because backwards compatibility and features is more important to them. It doesn't mean because Linus says something so strongly on a subject is right or wrong, he is generally abusive and rants and has for years. Grsecurity is important to some people, not all, and vice versa for the features and backwards compatibility crowd. Personally I'd ho…

If backwards compatibility is broken, what you wind up with is a subsection of users that out of necessity use versions of linux with none of the updates that secure the product. You can't just tack on security patches that break user-required features willy-nilly, there's a big cost paid here.

[deleted]

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#52

Post by KGIII »

ajarmst wrote: post #9
doe88 wrote: post #5

For all his unfortunate abrasiveness one strength of Linus is and has always been his capacity to see the big picture, e.g. that usually compatibility/API,ABI stability/performances trumps extreme security measures and also he has always been able to accomodate with big players/corps in the industry.

I kind of find Linus refreshing, although I'm not sure that would survive working directly with him. I think you're begging the question though: surely compatibility/ABI stability/performance trumps extreme security (for some values of 'extreme') for people and in cases where that is true. I happen to agree with you and Linus on this (baring a known exploit of an unpatched security bug), but that heirarchy is nowhere…

I have never even tried to read the kernel source, but I read the mailing lists - quite frequently. Linus runs a tight ship. It is funniest when someone does something that will break userspace.

He sets high standards. Meet them. I don't believe any forks have really done well. His method works, as abrasive as it may appear.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#53

Post by technion »

ajdlinux wrote: post #11

The grsecurity team does have some valid criticisms of the upstream community, and of course they've done some brilliant technical work, but spender is unfortunately a pretty toxic community member who puts many upstream kernel devs to shame when it comes to ability to flame. It's a shame - there's a lot of good stuff in grsec/PaX, but I think the upstream community is better off without the people involved. The KSPP…

Similarly, I used to run grsec on RedHat once upon a time. But the whole thing just got too hard. When a critical update came, I could get a stock kernel running "yum update", or I could play around building a whole new grsec kernel.

I wish there was a way to take personalities out of this and let mainline merge the useful parts of grsec.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#55

Post by jlarocco »

uhhfcuvv wrote: post #28
rhblake wrote: post #10

See Linus' follow-up http://seclists.org/oss-sec/2017/q2/596 for clarification: > They aren't split up, there has never been any effort by you to make them palatable to upstream, and when somebody else dioes try to make them palatable to upstream, you start crying about how people are taking advantage of your work (hah), and try to make them private instead. ... > It's literally less work for people to re-implement t…

And the other guy's reply: http://seclists.org/oss-sec/2017/q2/597

Seems like a waste of time for him to hold up that side of the argument. Even if he's 100% correct, what's he going to achieve? The changes aren't going into the kernel until they get past Linus, and for that to happen the patches need to meet the same standards as every other patch. It's not like he's going to lower the bar for one company.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#56

Post by amluto »

madez wrote: post #47

A genuine question: Why isn't it perfectly reasonable to accept to break compatibility in order to increase security? Isn't that what we do in our lifes all the time? When the authorities issue new fire safety regulations for buildings, then that is breaking compatibility to the older building standard. We still do it because there is good reason. Sometimes even old buildings need to be retrofitted, and that is then…

It is acceptable to break compatibility to fix a security problem, but it needs to be a minimal break. The problem with this particular issue is that it's breaking compatibility with major applications, which is no good.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#57

Post by kazinator »

skynode wrote: post #23
windows_lover wrote: post #12

Linus, and this stubborn attitude of his, is the reason that Linux will always lag behind Windows in kernel security. With the vast security improvements Microsoft are putting into their operating system year on year, it's a shame to see Linux failing to keep up.

A differently sounding username would have at least helped your case. :) Even if Windows kernel security is more robust, anybody can easily fault you for some form of cognitive bias. I use Windows, therefore Windows is more superior.

> A differently sounding username would have at least helped your case. :)

No, it wouldn't; it is quite obvious that the account was created by a Linux fanboi just to make this lame ironic joke, and that lame account creation just to make a lame (and off-topic) joke is likely why it was flagged.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#59

Post by nisa »

protomyth wrote: post #35

Reading one of the follow-up e-mail http://seclists.org/oss-sec/2017/q2/586 Wouldn't it be nice if you didn't demand free work of us in our free time? seems an odd line, but is there some context for the non-Linux person on what is going on?

Don't count on this recount to be correct but as far I've followed it:

200x? - grsecurity patchset is introduced and fixes a lot of bug-classes (!) and introduces lot's of security improvements to the kernel that are ground breaking and find their way in other systems like *BSD / Windows

200x-201x - code and trademarks of grsecurity get ripped from embbedded vendors - Linux foundations does nothing because they don't pursue GPL violations - no intent from grsecurity to upstream their work - at least without getting paid for it.

2016-2017: - Linux foundation founds KSPP and works on integrating basically PaX/grsecurity into mainline - does not even ask grsecurity or PaX if they want to get paid for helping but they are flamed at and bothered with inquiries from devs - according to grsecurity most of KSPP work is copy&paste the grsecurity code without deeper understanding - introducing even new vulns - grsecurity only publishes patchset for current mainline kernel, no more long term releases

2017: - things are escalating, grsecurity patches go dark - lot's of rants and hate from all sites.

now: - this mess.

I can see the point from the grsecurity guys - they produced ground breaking research and it got ripped of everywhere and Linux foundation does not protect it's interests because the corporations don't want GPL enforcement (not related to the current dark patchset) and they don't even bother offering them money for the work to integrate this stuff. The bad mouthing from Linus is quite idiotic if you consider that most, if not all kernel vulns did not affect grsecurity in the past years. It's also true that the patchset breaks code depeding on the settings in plenty of ways.

Add lot's of rants and flames, big ego, personal attacks from grsecurity to Linux devs and vice versa...not exactly professional. Not sure what was/is going on beyond that.

At least that's some outsider Twitter/Mailinglist perspective. It's not black and white and IMHO Linux Foundation and KSPP have some explaining to do.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#60

Post by vacri »

madez wrote: post #47

A genuine question: Why isn't it perfectly reasonable to accept to break compatibility in order to increase security? Isn't that what we do in our lifes all the time? When the authorities issue new fire safety regulations for buildings, then that is breaking compatibility to the older building standard. We still do it because there is good reason. Sometimes even old buildings need to be retrofitted, and that is then…

> When the authorities issue new fire safety regulations for buildings, then that is breaking compatibility to the older building standard.

Do the old buildings automagically get updated to the new standard everyone is using? Does the city shut down every business in a building that doesn't match standard (= break software) until that building is retrofitted (which is time-consuming and costly)? That's what breaking backwards compatability does, it stops people from doing their thing until someone fixes it (sometimes it's on them, sometimes it's on you). And not everyone can afford a 'drop everything now to fix the issues brought up by the kernel release'.

In any case, a good way to get people to not use your product is to keep breaking it.

> Sometimes even old buildings need to be retrofitted, and that is then what is done.

Is it? There was a very famous fire in London just a couple of weeks ago, of a building which wasn't up to standard, yet filled with people. Dozens of people died.

Post reply on HN