Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus: Don't bother with grsecurity. Their patches are pure garbage

spinics.net

Post reply on HN
Print view View original

61–70 of 172 posts

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#61

Post by gizmo686 »

nisa wrote: post #59
protomyth wrote: post #35

Reading one of the follow-up e-mail http://seclists.org/oss-sec/2017/q2/586 Wouldn't it be nice if you didn't demand free work of us in our free time? seems an odd line, but is there some context for the non-Linux person on what is going on?

Don't count on this recount to be correct but as far I've followed it: 200x? - grsecurity patchset is introduced and fixes a lot of bug-classes (!) and introduces lot's of security improvements to the kernel that are ground breaking and find their way in other systems like *BSD / Windows 200x-201x - code and trademarks of grsecurity get ripped from embbedded vendors - Linux foundations does nothing because they don't…

>they produced ground breaking research and it got ripped of everywhere.

This is the part I don't get. They produced ground breaking research on a GPL platform, what did they expect to happen?

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#62

Post by babyrainbow »

Diederich wrote: post #41
uhhfcuvv wrote: post #28

Earlier quoted context omitted.

And the other guy's reply: http://seclists.org/oss-sec/2017/q2/597

Note: this is a lot tamer than a lot of the stuff I've seen him post in lwn.net comments. I have a lot of respect for their work. It's just a shame that their toxic communications will make the good things they do so much less likely to be widely adopted.

> their toxic communications

If you can't handle the truth, then every truhful communication can be "toxic" to you.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#63

Post by vacri »

ajarmst wrote: post #9
doe88 wrote: post #5

For all his unfortunate abrasiveness one strength of Linus is and has always been his capacity to see the big picture, e.g. that usually compatibility/API,ABI stability/performances trumps extreme security measures and also he has always been able to accomodate with big players/corps in the industry.

I kind of find Linus refreshing, although I'm not sure that would survive working directly with him. I think you're begging the question though: surely compatibility/ABI stability/performance trumps extreme security (for some values of 'extreme') for people and in cases where that is true. I happen to agree with you and Linus on this (baring a known exploit of an unpatched security bug), but that heirarchy is nowhere…

I've always found it weird that de Raadt is admired for being abrasive, and Torvalds is pilloried.

I've always wondered, if the grsec people are such believers of 'security above all else', why they just don't work with OpenBSD instead.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#64

Post by nisa »

whoami_nr wrote: post #22
windows_lover wrote: post #12

Linus, and this stubborn attitude of his, is the reason that Linux will always lag behind Windows in kernel security. With the vast security improvements Microsoft are putting into their operating system year on year, it's a shame to see Linux failing to keep up.

>Linux will always lag behind Windows in kernel security Are you serious about that statement ?

I guess it's not too far from the reality - at least since Windows 10? Windows got a lot of stuff that is better than Linux in that regard. Control flow guard, Device Guard Virtualisation, ALSR - the current stack/heap guard page mess is also solved there. Linux is full of local priv escalation bugs (basically every update fixes one - http://www.cvedetails.com/vulnerability-list/vendor_id-33/pr...)

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#65

Post by geofft »

hacknat wrote: post #31
topkeker wrote: post #6

Grsecurity wouldn't exist if Linux made security a priority. It doesn't, because backwards compatibility and features is more important to them. It doesn't mean because Linus says something so strongly on a subject is right or wrong, he is generally abusive and rants and has for years. Grsecurity is important to some people, not all, and vice versa for the features and backwards compatibility crowd. Personally I'd ho…

And without backwards compatibility you would have never heard of Linux.

That's a very strong claim.

Some evidence in favor is that, at least in the early days of Linux, Microsoft took the same strategy of prioritizing backwards compatibility over security - and reaped the rewards by becoming extremely popular and extremely full of security holes. So clearly the strategy worked for MS. On the other hand, MS did respond and prioritize security, and was able to pull it off without compromising backwards compatibility too much. (For instance, last week's stack-clash vulnerability straight up doesn't exist on Windows because MSVC and the NT kernel have been doing the right thing with stack probes for years.)

But some real evidence against is that this whole backwards-compatibility thing is a kernel policy, not a userspace policy; no distro cares nearly as much. With the a.out to ELF transition and libc5 to libc6 transition back in the day, and to this day with OpenSSL versions, the GCC 5 libstdc++ ABI change, etc., there's not a ton of backwards compatibility in what binaries you can actually run on a real-world Linux system. It seems hard to believe that the kernel-to-userspace compatibility story is what made Linux popular, given the vast amount of userspace-to-other-userspace incompatibility.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#66

Post by dkarapetyan »

cyphar wrote: post #25
dkarapetyan wrote: post #15

Earlier quoted context omitted.

Google Linus rant. There are many examples.

Crying wolf requires him to have been wrong (or lied). I think that GP was asking you for evidence of _that_, not of evidence that Linus has ranted in the past. From memory, I can't recall a time where his ranting was not justified, but he has been wrong a couple of times. Unless I'm missing something blatant, that doesn't constitute "crying wolf" to me.

The parable of the boy crying wolf is not about lies but about desensitizing your audience to what you are saying. I've read enough of the rants to know there is very little signal to all the noise he makes.

The grsecurity stuff could be bad but I sure as hell am not gonna get my analysis from Linus. If he acted more like a grown up then maybe but he doesn't. He character assassinates and then says you are doing silly pointer arithmetic. Can just mention the pointer stuff without shouting and screaming at author of the patch.

The drama in kernel dev is a direct result of his abrasive approach. He screams and shouts so grsecurity screams and shouts. Everyone else loses. The kernel dev space needs less drama and more grown ups.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#67

Post by simcop2387 »

Aeolun wrote: post #40

So, just to confirm I see this correctly: Grsecurity creates patches for issues in upstream, but their patches are too fucking big/ugly, so nobody upstream really wants to merge them, and when someone tries to fix em (take the important bits out), grsecurity complains about them using their work. Grsecurity then say they don't feel like doing a lot of work on their patches when they're not paid to do it.

Along with that Grsec then says that if while the patch is GPLv2 if you distribute them they'll never let you subscribe again to get the patch in the future.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#68

Post by windows_lover »

kazinator wrote: post #57
skynode wrote: post #23

Earlier quoted context omitted.

A differently sounding username would have at least helped your case. :) Even if Windows kernel security is more robust, anybody can easily fault you for some form of cognitive bias. I use Windows, therefore Windows is more superior.

> A differently sounding username would have at least helped your case. :) No, it wouldn't; it is quite obvious that the account was created by a Linux fanboi just to make this lame ironic joke, and that lame account creation just to make a lame (and off-topic) joke is likely why it was flagged.

I think it was flagged because my appreciation for Microsoft's award-winning operating system was a tad forthright.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#69

Post by madez »

vacri wrote: post #60
madez wrote: post #47

A genuine question: Why isn't it perfectly reasonable to accept to break compatibility in order to increase security? Isn't that what we do in our lifes all the time? When the authorities issue new fire safety regulations for buildings, then that is breaking compatibility to the older building standard. We still do it because there is good reason. Sometimes even old buildings need to be retrofitted, and that is then…

> When the authorities issue new fire safety regulations for buildings, then that is breaking compatibility to the older building standard. Do the old buildings automagically get updated to the new standard everyone is using? Does the city shut down every business in a building that doesn't match standard (= break software) until that building is retrofitted (which is time-consuming and costly)? That's what breaking…

The example of the recent fire in London strengthens my point. If we neglect security, then there is a price to pay for it. And now in London they do fix up buildings, because it's what makes sense.

Linux including a breaking change to increase security does not stop any business. If you are not patched to the new version, don't upgrade. The breaking change could be announced well ahead, and people would have time to fix their stuff.

That would be akin to the government releasing a new regulation but not forcing anybody to upgrade directly, but by offering tax relieve to anybody who did.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#70

Post by weego »

babyrainbow wrote: post #62
Diederich wrote: post #41

Earlier quoted context omitted.

Note: this is a lot tamer than a lot of the stuff I've seen him post in lwn.net comments. I have a lot of respect for their work. It's just a shame that their toxic communications will make the good things they do so much less likely to be widely adopted.

> their toxic communications If you can't handle the truth, then every truhful communication can be "toxic" to you.

If you speak the truth like an asshole all anyone will take away from it is that you're an asshole.
Post reply on HN