Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds: “Do No Harm”

lkml.org

Post reply on HN
Print view View original

91–100 of 233 posts

Re: Linus Torvalds: “Do No Harm”

#91

Post by Nokinside »

anameaname wrote: post #32
theWatcher37 wrote: post #21

Earlier quoted context omitted.

Absolutely not. If “do no harm” is a principle, then the kernel should ensure that no harm is taking place. If flaws within the kernel allow harm to occur while otherwise normal transactions are occurring then it is absolutely preferable to panic and shut down over allowing that potential harm to occur. To suggest otherwise, that detected errors that allow harm should be allowed, is pure insanity. Linus is unquestion…

A thought experiment that comes up in Kernel design classes is what should happen if the OS was running the flight-control software for an Airplane you are on? If there was a bug in the kernel, perhaps a double free or a memory leak, what should happen? A panic would result in the airplane falling to certain doom. But if it were to keep running, it may be a security vulnerability. Being absolutist in either direction…

> double free or a memory leak, what should happen

Both offensive and defensive programming is important in safety critical programs and I get your point, but those things you mention don't' happen in safety critical systems.

There is no dynamic memory allocation. RTOS used will support "brick wall partitioning" for memory, processing and other resources. Different systems can run in the same OS but they cant' compete for processing time, locks or memory access. Everyone has been dealt the resources they can have from the start. It's not possible to run out file descriptors, memory if you allocate them statically from the start.

Assertion errors or monitoring errors in safety critical systems usually cause reset or change into backup system. If the program state is large and reset is not safe, retreating to some earlier state (constant backups) is likely.

Re: Linus Torvalds: “Do No Harm”

#92

Post by makomk »

amelius wrote: post #8
lima wrote: post #3

Background: the "kernel self protection project" (KSSP) recently upstreamed the Grsecurity/PAX reference counting implementation which prevents a certain class of security bugs from being exploited. Grsecurity is a security hardening patchset for Linux that makes deliberate trade-offs in favor of security, sacrificing availability if necessary. This, aside from the political issue, is the main reasons why it's hard t…

> Grsecurity will rather terminate userland programs or, in some rare cases, panic the kernel if it finds itself in an undefined state. This is exactly what you want if you care about security, but it's not a trade-off everyone is happy with (including Linus). I'd also like my kernel to halt whenever an assertion does not hold, for the sake of keeping my sanity; not just for security. Why would you not want this?

Due to the aggressive nature of grsecurity, a lot of the assertions it trips on are bogus; either they didn't understand the code they were securing or they changed the rules without properly updating all the affected code. For example, there was a particularly obnoxious panic in the tty layer a few versions back that was entirely the result of this.

Re: Linus Torvalds: “Do No Harm”

#93

Post by makomk »

Slavius wrote: post #42
payne92 wrote: post #15

Earlier quoted context omitted.

For the same reason people drive with their “check engine” light on: It’s frequently better to have a working system (i.e. “I’m late for work”), than to chase an indicator that may not represent a real problem (an actual security intrusion).

I can't think of single useful piece of software nowdays that is exposed to public and can't run in active-active load balanced or clustered scenario. If your kernel/system/userland-app misbehaves it simply needs to be shut down, reported and examined. It might have been some random memory block the last time your app made an buffer overflow, but it could as well be the stack pointer next time...

Remember, we're necessarily just talking about servers here; every single hospital has mission-critical client machines that cannot go down and obviously those aren't load balanced or clustered. (Though mostly they seem to be running Windows.)

Re: Linus Torvalds: “Do No Harm”

#94

Post by azernik »

zx2c4 wrote: post #63

I wrote the email that prompted this quite civil response. I'm very pleased with the outcome, because I think this clear statement of his position is a lot more useful for people to work with, rather than just assuming Linus hates security or something. I interpreted his response in practical terms as essentially being the following. Patch set merge 1 has "report" as default and "kill" as a non-default option. Patch…

It's only civil because it's a follow-up; usually it's only his first email in a thread that follows the classic (notorious?) Torvalds style.

For those who want it, here's his first email in the thread, profanity and all: https://lkml.org/lkml/2017/11/17/767

Re: Linus Torvalds: “Do No Harm”

#95

Post by azernik »

jbangert wrote: post #43
muppetman wrote: post #18

Earlier quoted context omitted.

Say there's a minor error in a network driver. Yes, it might be exploitable by a smart person. But the error only triggers once a day when a counter rolls over. Do you really want your box to lock up and panic when this error is encountered, or do you just want your box to keep working. I'm firmly in the first camp (I'll take lock up and freeze thanks) but 99% of users don't care about a bug like that and just want t…

But do you want your box to send silently corrupted data for the next two years? Or would you rather reboot every night, and maybe escalate to your red hat support contract, where someone will then fix the underlying bug (for which you now have crashdumps),

If you're a desktop user, or a sysadmin without said support contract, you want the former.

Re: Linus Torvalds: “Do No Harm”

#96

Post by Annatar »

Because the primary focus should be "debugging". The primary focus should be "let's make sure the kernel released in a year is better than the one released today".

Is he starting to sound like illumos engineers or what? Better late than never, but it took him long enough.

Re: Linus Torvalds: “Do No Harm”

#97

Post by avinassh »

azernik wrote: post #94
zx2c4 wrote: post #63

I wrote the email that prompted this quite civil response. I'm very pleased with the outcome, because I think this clear statement of his position is a lot more useful for people to work with, rather than just assuming Linus hates security or something. I interpreted his response in practical terms as essentially being the following. Patch set merge 1 has "report" as default and "kill" as a non-default option. Patch…

It's only civil because it's a follow-up; usually it's only his first email in a thread that follows the classic (notorious?) Torvalds style. For those who want it, here's his first email in the thread, profanity and all: https://lkml.org/lkml/2017/11/17/767

Nope, this is the first email - http://lkml.iu.edu/hypermail/linux/kernel/1711.2/01357.html

Entire thread links from start:

1 - http://lkml.iu.edu/hypermail/linux/kernel/1711.2/01325.html

2 - http://lkml.iu.edu/hypermail/linux/kernel/1711.2/01357.html

3 - http://lkml.iu.edu/hypermail/linux/kernel/1711.2/01368.html

4 - http://lkml.iu.edu/hypermail/linux/kernel/1711.2/01636.html

5 - http://lkml.iu.edu/hypermail/linux/kernel/1711.2/01701.html

Re: Linus Torvalds: “Do No Harm”

#98

Post by Annatar »

Nokinside wrote: post #91
anameaname wrote: post #32

Earlier quoted context omitted.

A thought experiment that comes up in Kernel design classes is what should happen if the OS was running the flight-control software for an Airplane you are on? If there was a bug in the kernel, perhaps a double free or a memory leak, what should happen? A panic would result in the airplane falling to certain doom. But if it were to keep running, it may be a security vulnerability. Being absolutist in either direction…

> double free or a memory leak, what should happen Both offensive and defensive programming is important in safety critical programs and I get your point, but those things you mention don't' happen in safety critical systems. There is no dynamic memory allocation. RTOS used will support "brick wall partitioning" for memory, processing and other resources. Different systems can run in the same OS but they cant' compet…

but those things you mention don't' happen in safety critical systems.

Errors in logic happen everywhere.

Re: Linus Torvalds: “Do No Harm”

#99

Post by weavie »

hpaavola wrote: post #85
exikyut wrote: post #77

Earlier quoted context omitted.

Hooold it. Some of those things are not like the others. -- I pity the engineers working on ventilation machines and the like. Medical devices are insanely hard to get right; that's neck and neck with aviation testing. I'm reminded of SQLite3's "aviation-grade" TH3 testsuite, which apparently has 100% code coverage. Let's be honest; Linux's monolithic design can't really attain that. I would never use Linux for a med…

Many medical devices run Linux. Most (AFAIK) patient monitors run Linux; GE and Philips (the biggest is business) both run on Linux. Those are the devices that keep you alive during surgery, make sure that those who are born too early (I don't know the English term here) are doing ok, monitor you state while you are in ambulance etc.

Born prematurely..

Re: Linus Torvalds: “Do No Harm”

#100

Post by ddalex »

azernik wrote: post #94
zx2c4 wrote: post #63

I wrote the email that prompted this quite civil response. I'm very pleased with the outcome, because I think this clear statement of his position is a lot more useful for people to work with, rather than just assuming Linus hates security or something. I interpreted his response in practical terms as essentially being the following. Patch set merge 1 has "report" as default and "kill" as a non-default option. Patch…

It's only civil because it's a follow-up; usually it's only his first email in a thread that follows the classic (notorious?) Torvalds style. For those who want it, here's his first email in the thread, profanity and all: https://lkml.org/lkml/2017/11/17/767

Nope, his first email in the thread was this:

https://lkml.org/lkml/2017/11/17/423

Where he's quite civil and explains quite clearly why he won't accept the patch, and what should happen for the patch to be accepted. The Kees's reply insisting on the merge is what led to the profanity-laden email, and frankly I understand that (not condone, but understand from a human-reaction point of view) - how many times does one have to iterate his viewpoint to others to make himself heard?

Post reply on HN