Memory safety for the world’s largest software project

Post by pabs3 » Mon, Jun 27, 2022, 11:53 AM UTC

userbinator wrote: post #21

One critical example of such infrastructure is the Linux kernel, used in most servers in the world as well as in billions of devices. ...billions of devices which the manufacturer does not want you to own, to be fair, and for which full ownership requires breaking through the security features that initiatives like this are trying to strengthen. You might think that's a political/social issue and this is merely a tec…

Post by jokabrink » Mon, Jun 27, 2022, 12:40 PM UTC

viraptor wrote: post #47

jokabrink wrote: post #43

Question regarding licensing: [1] states that a source file can be "one of the compatible GPL variants and alternatively under a permissive license like BSD, MIT etc." Looking at a rust source file inside the dev tree 'Rust-for-Linux' [2], it is licensed as "Apache-2.0 OR MIT". However, Apache-2.0 appears to be incompatible with GPL-2.0 [3]. How come that the licensing in such a way is possible with the Linux licensi…

With alternatives like that, you choose what applies, so if it's licensed as "MIT or literally-anything-else", it's still valid. Now why they chose to add Apache2, that is interesting. A guess: if contributions to the project also need to be mit-or-asl2, then maybe that would force the patent grant clause to apply for contributions? (even if it doesn't change anything for the users)

Post by aaaaaaaaata » Mon, Jun 27, 2022, 12:50 PM UTC

izacus wrote: post #44

nequo wrote: post #24

Earlier quoted context omitted.

Memory safety means fewer bugs means harder to root your Android device and use the hardware you paid for in ways you want? Just guessing. It’s high time we had competitive open-source options in the smartphone space.

Devices like Google Pixel support installing your own rooted Android together with actually adding a new signature to boot loader so you get a fully secure device - it's how projects like CalyxOS can guarantee privacy. There's absolutely no need to defend security holes in an OS when you have options for proper secure installation of rooted OS available. You just need to put money where your wishes are and not buy lo…

Post by infogulch » Mon, Jun 27, 2022, 5:30 PM UTC

AgentME wrote: post #30

userbinator wrote: post #21

One critical example of such infrastructure is the Linux kernel, used in most servers in the world as well as in billions of devices. ...billions of devices which the manufacturer does not want you to own, to be fair, and for which full ownership requires breaking through the security features that initiatives like this are trying to strengthen. You might think that's a political/social issue and this is merely a tec…

Memory safety issues don't just mean people can root their own devices, they can often mean that outside attackers can root your devices too.

Post by bornfreddy » Mon, Jun 27, 2022, 6:56 PM UTC

pabs3 wrote: post #52

userbinator wrote: post #21

One critical example of such infrastructure is the Linux kernel, used in most servers in the world as well as in billions of devices. ...billions of devices which the manufacturer does not want you to own, to be fair, and for which full ownership requires breaking through the security features that initiatives like this are trying to strengthen. You might think that's a political/social issue and this is merely a tec…

If Software Freedom Conservancy win their lawsuit against Vizio, then anyone who has received a device containing the Linux kernel (or other copylefted code) will be able to sue for compliance, including source code and installation instructions. https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://sfconservancy.org/blog/2021/mar/25/install-g…