Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus: Don't bother with grsecurity. Their patches are pure garbage

spinics.net

Post reply on HN
Print view View original

151–160 of 172 posts

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#151

Post by sighsagain »

dm319 wrote: post #116
bubblethink wrote: post #109

How are the Linux Foundation's funds allocated, and how much say does Linus have in it ? Most of this boils down to lack of money and attribution for grsec. Why didn't the Linux Foundation or Linus try to officially fund grsec to upstream their patches ? KSPP is still costing money. How much would it have cost to pay grsec directly instead ?

As far as I understand that is the opposite of how it works. The linux foundation was set up to receive funds from big business contributors - like Intel, Microsoft etc, who have an interest in the continuation of the linux kernel and wish to pay for jobs which didn't have a source of funding (i.e. Linus's job and other maintainer) and who wished to remain non-partisan. So these companies provide both code and money.…

That money is being used to pay Kees Cook to rip off grsecurity.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#152

Post by sighsagain »

majewsky wrote: post #140
vectorEQ wrote: post #131

grsecurity, i like it. pretty secure for my machine. never had any breakage... i think Linus should probarbly pay more attention to security issues in 'his' os instead of being ratty about people taking it in their own hands to fix it... if u want to know: you can increase the stack guard page for grsecurity too, as theirs is also way small... On the otherhand i dont see why a kernel doesn't track it's stack pointers…

> grsecurity, i like it. pretty secure for my machine. never had any breakage... Pretty weak argument. I'm running stock Linux without grsec and I've never had any breakage either. > i think Linus should probably pay more attention to security issues What makes you think that he doesn't? Also, there is a whole separate team (the Kernel Self Protection Project) working on the issue.

> What makes you think that he doesn't? Also, there is a whole separate team (the Kernel Self Protection Project) working on the issue.

the fact that all the KSSP has been doing is copying grsecurity code is a pretty good indication that he doesn't because the same code they are copy pasting is the code he is calling garbage.

And he's saying to not bother with the patchset that has made it so no public linux vulnerability affected my kernel in at least a year.

Let me repeat that. My kernel has not had one public reported security vulnerability in a year.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#153

Post by waynecochran »

tptacek wrote: post #147
waynecochran wrote: post #89

Earlier quoted context omitted.

Git is not really using SHA-1 for encryption, just as unique hashes. I think it is unlikely to get a collision in a non-contrived instance. Eventually git will move off of SHA-1, but I imagine it will never matter.

Nobody uses SHA-1 for encryption; it is a hash function.

It certainly has been used for encryption and probably still is. I wouldn't lose any sleep hashing my passwords with it since most mortals couldn't break it. https://en.wikipedia.org/wiki/SHA-1#Cryptography

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#154

Post by jwilk »

vacri wrote: post #63
ajarmst wrote: post #9

Earlier quoted context omitted.

I kind of find Linus refreshing, although I'm not sure that would survive working directly with him. I think you're begging the question though: surely compatibility/ABI stability/performance trumps extreme security (for some values of 'extreme') for people and in cases where that is true. I happen to agree with you and Linus on this (baring a known exploit of an unpatched security bug), but that heirarchy is nowhere…

I've always found it weird that de Raadt is admired for being abrasive, and Torvalds is pilloried. I've always wondered, if the grsec people are such believers of 'security above all else', why they just don't work with OpenBSD instead.

> de Raadt is admired for being abrasive

[citation needed]

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#155

Post by baybal2 »

uhhfcuvv wrote: post #28
rhblake wrote: post #10

See Linus' follow-up http://seclists.org/oss-sec/2017/q2/596 for clarification: > They aren't split up, there has never been any effort by you to make them palatable to upstream, and when somebody else dioes try to make them palatable to upstream, you start crying about how people are taking advantage of your work (hah), and try to make them private instead. ... > It's literally less work for people to re-implement t…

And the other guy's reply: http://seclists.org/oss-sec/2017/q2/597

This man is being called Trollvalds for a reason

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#156

Post by tinus_hn »

simcop2387 wrote: post #67
Aeolun wrote: post #40

So, just to confirm I see this correctly: Grsecurity creates patches for issues in upstream, but their patches are too fucking big/ugly, so nobody upstream really wants to merge them, and when someone tries to fix em (take the important bits out), grsecurity complains about them using their work. Grsecurity then say they don't feel like doing a lot of work on their patches when they're not paid to do it.

Along with that Grsec then says that if while the patch is GPLv2 if you distribute them they'll never let you subscribe again to get the patch in the future.

According to the license they don't have to provide the source code to anyone except those that got the compiled product.

If you take an open source product, modify it and only use it in-house you don't have to provide source code to anyone.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#157

Post by eropple »

nisa wrote: post #85
eropple wrote: post #82

Earlier quoted context omitted.

This is, as I understand it, the core of the thing. They're making derivative works of a GPL work. They don't get to have it both ways. There's nothing for the Linux Foundation to go after, and they wouldn't be able to even if there was because they don't have the copyright for grsecurity's stuff.

Lot's of embedded vendors have plenty of GPL violations - Linksys and Ubiquity for instance in the case of grsecurity it was appearently Wind River. Apparently even no source code even if you purchased a device.

Sure, but--so? grsecurity has the copyright on what they've created. They don't need the Linux Foundation to enforce violations and there's no cause to force the Linux Foundation to do so if they don't feel it's best for Linux; copyright is optionally enforced in most jurisdictions (unlike trademark in the USA). On top of that, you're miffed that the Linux Foundation didn't "ask grsecurity or PaX if they want to get paid for helping", which is orthogonal to everything?

Your posts don't make sense to me, and I've been observing this whole mess for a very long time. What you're saying reads as if the Linux Foundation should be the heavies for a private company that has never-not-once played by the same rules as the cooperative development community they work outside of.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#158

Post by pyroinferno »

ivanbakel wrote: post #7

It's a struggle to respect the security opinions of someone who has actively admitted that he thinks "[security] bugs are just bugs". [0] Personally, I find it quite hard to respect Linus generally - his offensive personality is clearly not something that would be appropriate coming from anyone else in any community, but for some reason he gets a free ride for being a difficult genius. 0. http://www.washingtonpost.co…

>For Linux, the operating system that Torvalds created

Stopped reading right there. First of all, Linux is not an operating unto itself, but rather another free component of a fully functioning GNU system made useful by the GNU corelibs, shell utilities and vital system components comprising a full OS. Because of that, the Operating System is not Linux, but rather GNU/Linux (or GNU + Linux which I recently have been calling it).

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#160

Post by tptacek »

waynecochran wrote: post #153
tptacek wrote: post #147

Earlier quoted context omitted.

Nobody uses SHA-1 for encryption; it is a hash function.

It certainly has been used for encryption and probably still is. I wouldn't lose any sleep hashing my passwords with it since most mortals couldn't break it. https://en.wikipedia.org/wiki/SHA-1#Cryptography

That's a list of places where SHA-1 is used as a hash function in cryptosystems.
Post reply on HN