Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds: “Do No Harm”

lkml.org

Post reply on HN
Print view View original

81–90 of 233 posts

Re: Linus Torvalds: “Do No Harm”

#81

Post by snvzz »

john61 wrote: post #62
muppetman wrote: post #18

Earlier quoted context omitted.

Say there's a minor error in a network driver. Yes, it might be exploitable by a smart person. But the error only triggers once a day when a counter rolls over. Do you really want your box to lock up and panic when this error is encountered, or do you just want your box to keep working. I'm firmly in the first camp (I'll take lock up and freeze thanks) but 99% of users don't care about a bug like that and just want t…

I want both. Panic in a test/development kernel, do not panic in a production environment.

Absolutely panic in a production environment.

Potential data corruption is far worse, so is a potential security compromise.

Re: Linus Torvalds: “Do No Harm”

#82

Post by pjmlp »

drinchev wrote: post #34
amelius wrote: post #8

Earlier quoted context omitted.

> Grsecurity will rather terminate userland programs or, in some rare cases, panic the kernel if it finds itself in an undefined state. This is exactly what you want if you care about security, but it's not a trade-off everyone is happy with (including Linus). I'd also like my kernel to halt whenever an assertion does not hold, for the sake of keeping my sanity; not just for security. Why would you not want this?

Linux is used in so many critical systems. What happens when a security bug stops the ventilating machine of a person lying in hospital bed, or halts the screen of a surgeon. Not to mention voting machines, ISP's, telecoms. For me having all those stopped, when properly exploited, looks more like a very scary DoS attack vector. Imagine a security f*ck up, like Heartbleed, but this time with an option to halt kernels…

> What happens when a security bug stops the ventilating machine of a person lying in hospital bed, or halts the screen of a surgeon.

Linux is not a kernel for this kind of uses. Whoever does it, is doing a disservice to the people.

Operating systems like INTEGRITY RTOS or similar, are the only ones able to match the security quality requirements for such deployments.

https://www.ghs.com/products/rtos/integrity.html

Re: Linus Torvalds: “Do No Harm”

#83

Post by snvzz »

drinchev wrote: post #34
amelius wrote: post #8

Earlier quoted context omitted.

> Grsecurity will rather terminate userland programs or, in some rare cases, panic the kernel if it finds itself in an undefined state. This is exactly what you want if you care about security, but it's not a trade-off everyone is happy with (including Linus). I'd also like my kernel to halt whenever an assertion does not hold, for the sake of keeping my sanity; not just for security. Why would you not want this?

Linux is used in so many critical systems. What happens when a security bug stops the ventilating machine of a person lying in hospital bed, or halts the screen of a surgeon. Not to mention voting machines, ISP's, telecoms. For me having all those stopped, when properly exploited, looks more like a very scary DoS attack vector. Imagine a security f*ck up, like Heartbleed, but this time with an option to halt kernels…

> Linux is used in so many critical systems.

It shouldn't be. It's ill suited for that.

Look at seL4, minix3, echronos instead.

Re: Linus Torvalds: “Do No Harm”

#84

Post by pjmlp »

alanfranzoni wrote: post #7

That's a consequence of an "old" issue in the IT security field - security researchers and developers sit at opposite sides of the table, they've got different concerns and agendas. Pick some security researchers; now tell them to build any nontrivial piece of software; I doubt they'd be able to do it, and if they succeed their software will be full of bugs, including security ones. Security is part of the correctnes…

Many developers care about security the same way as security researchers.

Developers that care about design by contract, assertions, having warnings as errors, pedantic flags, get the CI system to break builds on static analyses errors, only allow for unsafe code when confirmed by profile measurements that it actually matters,....

Yet, we are able to deliver working software that fulfills project requirements, amazing!

Re: Linus Torvalds: “Do No Harm”

#85

Post by hpaavola »

exikyut wrote: post #77
drinchev wrote: post #34

Earlier quoted context omitted.

Linux is used in so many critical systems. What happens when a security bug stops the ventilating machine of a person lying in hospital bed, or halts the screen of a surgeon. Not to mention voting machines, ISP's, telecoms. For me having all those stopped, when properly exploited, looks more like a very scary DoS attack vector. Imagine a security f*ck up, like Heartbleed, but this time with an option to halt kernels…

Hooold it. Some of those things are not like the others. -- I pity the engineers working on ventilation machines and the like. Medical devices are insanely hard to get right; that's neck and neck with aviation testing. I'm reminded of SQLite3's "aviation-grade" TH3 testsuite, which apparently has 100% code coverage. Let's be honest; Linux's monolithic design can't really attain that. I would never use Linux for a med…

Many medical devices run Linux. Most (AFAIK) patient monitors run Linux; GE and Philips (the biggest is business) both run on Linux. Those are the devices that keep you alive during surgery, make sure that those who are born too early (I don't know the English term here) are doing ok, monitor you state while you are in ambulance etc.

Re: Linus Torvalds: “Do No Harm”

#86

Post by carlsborg »

"without users, your program is pointless, and all the development work you've done over decades is pointless.

.. and (then) security is pointless too, in the end."

He tends to get really mad when kernels dev inconvenience user space devs. Perhaps one of the reasons Linux succeeded was because of this fanatical customer focus - if linux is the platform, user space developers are the customers.

Re: Linus Torvalds: “Do No Harm”

#87

Post by pjmlp »

blaisio wrote: post #58
jbangert wrote: post #29

A few points: 1) failing loudly is better than failing silently. A memory corruption issue (or a bad refcount, etc.) is not a benign issue that only becomes relevant under carefully crafted exploit conditions. You need the carefully crafted exploit to get the system back into an attacker controlled state (I.e. code execution); by itself (with non-malicious inputs, usually something random or slightly atypical — enoug…

So one of Linus' main points in this series of posts is that failing loudly is actually not always better than failing silently or quietly, and it's really annoying when people come in making that assumption without thinking. This is also something that he is constantly repeating and ranting about, and it's arguably one of the reasons why Linux is so successful. Think about a smartphone - do most users want it to cra…

Interesting that you mention smartphones, because that is exactly what Google has made to their Linux fork.

Every Android app that misbehaves, just gets killed without warning.

The scenarios where this might happen, have been increasing since Android 7.

Re: Linus Torvalds: “Do No Harm”

#88

Post by margorczynski »

Santosh83 wrote: post #70
margorczynski wrote: post #20

Earlier quoted context omitted.

The logic behind why it is done like that I get. Just wondering as You said is it possible to push at least the most bug-prone and exploitable ones to user-space

I don't see how you can convert a kernel-space driver to a user-space one without significant rewriting, and in some cases it may not be possible at all.

What about some abstraction/interfacing layer/driver that would take care of exposing some kernel functionality an average driver needs and provide additional validation?

Re: Linus Torvalds: “Do No Harm”

#89

Post by PeterisP »

lima wrote: post #13
alanfranzoni wrote: post #7

That's a consequence of an "old" issue in the IT security field - security researchers and developers sit at opposite sides of the table, they've got different concerns and agendas. Pick some security researchers; now tell them to build any nontrivial piece of software; I doubt they'd be able to do it, and if they succeed their software will be full of bugs, including security ones. Security is part of the correctnes…

That's not a fair (or useful) assessment. Obviously, the narrow-minded security people you describe exist, but they're a minority. Many security people are developers who specialized in security, and are very much capable of building software. The kernel code is question is exactly what you ask for - instead of finding and fixing single bugs, it's a mitigation that prevents all occurrences of a particular class of bu…

The mitigation does not prevent a particular class of bugs, it prevents a particular class from being exploitable by turning an invisible-but-possibly-exploitable bug to a crash bug. The bug is still there, but now it has a larger impact on most customers.

That's a serious tradeoff, especially (as Linus is complaining) turning a rare bug into a crashbug doesn't allow you to detect and fix it, you need a mode where the bug is logged but the process is not stopped (and might be exploited) so that the bug can be reported, reproduced and fixed.

Re: Linus Torvalds: “Do No Harm”

#90

Post by pjmlp »

quink wrote: post #54

I'm reminded of a recent security fix for IE11 that Microsoft pushed out earlier this year: https://developer.microsoft.com/en-us/microsoft-edge/platfor... It killed printing from iframes completely. Great that they solved the security problem, whatever it may have been. They also broke a major piece of browser functionality that a lot of enterprises rely on fundamentally. Hell, even printing shipping labels from eBa…

Because there is a workaround, applications just need to be updated.

"Either use Print Preview instead of print button or if currently using window.print() in javascript change this to document.execCommand('print’, false, null)"

Post reply on HN