With respect to https://lkml.org/lkml/2017/11/21/356 and this thread I just want to get #CVEs on all the things so we can figure out the scope of the problem, and then look at what we need to do to "fix" "it" (assuming "it" is a real problem, dunno without data).
Linus Torvalds: “Do No Harm”
221–230 of 233 posts
Re: Linus Torvalds: “Do No Harm”
#222Earlier quoted context omitted.
Actually, we are. That's how the GPL works.
No, it's not. The GPL on the Linux kernel means that grsec can't distribute a new Linux kernel with their patches while withholding code. That's not what they're doing. If I write a Linux kernel patch on a consulting project, I am absolutely not required to publish it.
> If I write a Linux kernel patch on a consulting project, I am absolutely not required to publish it.
That would be a work for hire, and it is not the same thing as developing patches independently and distributing them with extra terms, because there is no distribution involved.
> The GPL on the Linux kernel means that grsec can't distribute a new Linux kernel with their patches while withholding code. That's not what they're doing.
That would be true if the patches were not derivative works of the Linux kernel in a legal sense. I'm no lawyer, but that seems contrary to the plain meaning of "derivative work".
Bruce Perens' argument is persuasive to me: https://perens.com/2017/06/28/warning-grsecurity-potential-c...
As is Linus Torvalds' ("kernel patches clearly _are_ derived works"): http://yarchive.net/comp/linux/gpl_modules.html
Re: Linus Torvalds: “Do No Harm”
#223Earlier quoted context omitted.
That's fine in theory, but it didn't stop my disk from being corrupted. If the computer hadn't panicked, my data would still be available.
its not theory... your system wasn't designed to be fault-tolerant in that manner. Systems that matter, are.
The linux kernel needs to work with both tolerant and non-tolerant systems. Saying it needs to work a specific way that completely breaks real world things is completely naive, and exactly what Linus was railing against.
Re: Linus Torvalds: “Do No Harm”
#224Earlier quoted context omitted.
I see. It's ok because we'll just pass the buck and make it someone else's problem.
Let's say somebody gives you an USB stick and you plug it into your laptop. Which of the following scenarios would you like to see? 1. 0-day in the kernel's USB code. You're part of stuxnet now. 2. 0-day in the kernel's USB code. You're part of stuxnet now. You also get a message that tells you how and where to report the bug that was exploited. 3. 0-day in the kernel's USB code. Your computer crashes. You're not par…
4. 0-day in the kernel's USB code. Your computer crashes. You're not part of stuxnet. You also get a message that tells you how and where to report the bug that was exploited, but the part of your computer that was supposed to log the message died with the rest of the system, so you never see it and the bug never actually gets reported. Your computer continues to crash randomly for the next few days as an infected computer keeps trying to spread.
Re: Linus Torvalds: “Do No Harm”
#225Earlier quoted context omitted.
Yes, but how many of all cases of corrupted stack pointers are exploits?
Why would that matter? We're not trying to be secure against random cosmic rays. We're trying to be secure against attackers . http://wondermark.com/406/
It matters because we're talking about letting the browser crash on all cases.
> We're trying to be secure against attackers.
We also want a browser that doesn't crash.
Re: Linus Torvalds: “Do No Harm”
#226Earlier quoted context omitted.
Absolutely panic in a production environment. Potential data corruption is far worse, so is a potential security compromise.
It really depends on the use case! E.g. performing industrial control automation or airplane rudder control in a completely segregated network. You want control over these tradeoffs, not hardcoded behaviors.
Linux is ill suited for that.
Look at seL4, minix3, eChronos instead.
Re: Linus Torvalds: “Do No Harm”
#227Earlier quoted context omitted.
No, it's not. The GPL on the Linux kernel means that grsec can't distribute a new Linux kernel with their patches while withholding code. That's not what they're doing. If I write a Linux kernel patch on a consulting project, I am absolutely not required to publish it.
> If I write a Linux kernel patch on a consulting project, I am absolutely not required to publish it. That would be a work for hire, and it is not the same thing as developing patches independently and distributing them with extra terms, because there is no distribution involved. > The GPL on the Linux kernel means that grsec can't distribute a new Linux kernel with their patches while withholding code. That's not w…
> That would be a work for hire ....
Not necessarily, in fact perhaps not even usually.
1. The consulting contract might or might not provide for the client to own any work product created. Many such contracts provide that the client will own only the specific end product, while the consultant retains ownership of any reusable "Toolkit Items."
But what if the contract is silent about ownership of consulting work product?
2. As to copyright: Under U.S. copyright law, the default mode is that IF: An original work of authorship is created outside an employer-employee relationship, THEN: The copyright is owned by the individual author (or jointly by multiple co-authors) UNLESS: A) the work of authorship falls into one of nine specific statutory categories, and B) the parties have expressly agreed in writing, before the work was created, that it would be a work made for hire. [0] [1]
3. Any patentable inventions would be owned by the inventor(s) unless they were employees who were "hired to invent" or "set to experimenting," in which case the inventions would be owned by the employer; so far as I recall, this doesn't apply in the case of outside-contractor consulting projects — the client would not own any resulting inventions unless the contract specifically said otherwise. [2]
[0] https://www.law.cornell.edu/uscode/text/17/201 (ownership of copyright)
[1] "A 'work made for hire' is—(1) a work prepared by an employee within the scope of his or her employment; or (2) a work specially ordered or commissioned [A] for use as a contribution to a collective work, [B] as a part of a motion picture or other audiovisual work, [C] as a translation, [D] as a supplementary work, [E] as a compilation, [F] as an instructional text, [G] as a test, [H] as answer material for a test, or [I] as an atlas, if the parties expressly agree in a written instrument signed by them that the work shall be considered a work made for hire. [¶] For the purpose of the foregoing sentence, a 'supplementary work' is a work prepared for publication as a secondary adjunct to a work by another author for the purpose of introducing, concluding, illustrating, explaining, revising, commenting upon, or assisting in the use of the other work, such as forewords, afterwords, pictorial illustrations, maps, charts, tables, editorial notes, musical arrangements, answer material for tests, bibliographies, appendixes, and indexes, and an 'instructional text' is a literary, pictorial, or graphic work prepared for publication and with the purpose of use in systematic instructional activities." From https://www.law.cornell.edu/uscode/text/17/101
[2] See the annotated flowchart at http://www.oncontracts.com/docs/Who-owns-an-employee-inventi... (self-cite).
Re: Linus Torvalds: “Do No Harm”
#228Earlier quoted context omitted.
Hooold it. Some of those things are not like the others. -- I pity the engineers working on ventilation machines and the like. Medical devices are insanely hard to get right; that's neck and neck with aviation testing. I'm reminded of SQLite3's "aviation-grade" TH3 testsuite, which apparently has 100% code coverage. Let's be honest; Linux's monolithic design can't really attain that. I would never use Linux for a med…
Erlang's error-handling model is good (and interesting). Th e motto is: "Let it crash". Each node does not handle errors at all, but PANICs on a fault. It is up to the supervisor (with global knowledge and state) to handle the fault appropriately.
It's good for uptime, but not good for correctness. The main problem is that it is hard to differentiate expected from unexpected crashes. Something like a missing pattern match can lead to a crash and it is very hard to know if the programmer "intended" for a crash to occur in that case or if the missing pattern is a bug.
You can have processes that reboot once every few minutes running for years because people didn't realize they were bugged.
Re: Linus Torvalds: “Do No Harm”
#229Earlier quoted context omitted.
> Make Brad Spengler the primary maintainer of the Linux kernel and we may actually get self-driving cars that don't kill us when they get hacked in 5 years. But only because every self-driving car project out there will avoid Linux like the plague.
Instead of self-driving cars maybe crashing from being hacked in some possible future we'll get kernel panics leading to crashes in all possible futures because we'll trigger car crashes on every false positive, because crashing in the face of the unknown is a seemingly acceptable solution to a security risk. Even if the software is running self-driving cars and crashing may mean crashing. In practice, false positive…
You would rather have a self driving car in an undefined state, rather than having it shut down? A random glitch could be just as bad as an exploit; if some chunk of memory gets overwritten and your car decides that the brick wall doesn't actually exist any more, I don't think whether it was an an exploit or not really matters. The occupants end up injured either way.
Re: Linus Torvalds: “Do No Harm”
#230Earlier quoted context omitted.
Because there is a workaround, applications just need to be updated. "Either use Print Preview instead of print button or if currently using window.print() in javascript change this to document.execCommand('print’, false, null)"
> Because there is a workaround, applications just need to be updated. What actually happened: people reverted the patch. In the real world, you can't expect timely or even correct response from vendors you rely on. It sucks, but it's how it is.
Then after you get compromised in some way, you will start to look for better vendors.