Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds: “Do No Harm”

lkml.org

Post reply on HN
Print view View original

101–110 of 233 posts

Re: Linus Torvalds: “Do No Harm”

#101

Post by Slavius »

jhasse wrote: post #76
Slavius wrote: post #72

Earlier quoted context omitted.

...or is being remotely exploited and it silently succeeds. Who wants that?

That is very unlikely. Crashing would happen 100% of the time though. Most people want that trade-off (meaning: If their browser would crash, they would switch to another one, even it was less secure).

Corrupting SP is part of almost every exploit and I can guarantee you that it is very likely (going to cause harm on your system). Try to pull Metasploit GIT repo to get some idea about thousands of payloads that do corrupt SP without crashing the host...

Re: Linus Torvalds: “Do No Harm”

#102

Post by Slavius »

mythz wrote: post #74
Slavius wrote: post #57

Earlier quoted context omitted.

So what happens when your browser crashes? I experience that on a regular basis. Id' rather have my browser crash/killed instead of slowly overwriting my filesystem buffers or corrupting my stack pointer... Other than that browser are multi-thread/process applications. Usually only a single tab or a plugin crashes unless core browser process is affected. Most users would accept the trade off between crashed browser a…

> Most users would accept the trade off between crashed browser and infected/corrupted system. Most users are using computing devices a means of getting stuff done. They don't want to spend any energy thinking about how their software works, they want their devices to be invisible, which they use to run their Apps uninterrupted. The trade-off is whether to let Apps continue running vs hard crashing and taking down al…

Apps are supposed to keep their state either by saving your work regularly to persistent media or keeping your data off-client. We're living in 21st century in a cloud era FFS.

Keep running your app although integrity corruption within the application happened is putting user data at risk. IMHO an application that corrupts 3 days long presentation file save is to every user more frustrating than the one that crashes due to error leaving you with 5 minutes of unsaved changes lost.

Microsoft have invented "Application Recovery and Restart" exactly for this purpose.

Re: Linus Torvalds: “Do No Harm”

#103

Post by Nokinside »

Annatar wrote: post #98
Nokinside wrote: post #91

Earlier quoted context omitted.

> double free or a memory leak, what should happen Both offensive and defensive programming is important in safety critical programs and I get your point, but those things you mention don't' happen in safety critical systems. There is no dynamic memory allocation. RTOS used will support "brick wall partitioning" for memory, processing and other resources. Different systems can run in the same OS but they cant' compet…

but those things you mention don't' happen in safety critical systems. Errors in logic happen everywhere.

_those_

dynamic memory allocation errors don't happen when there is no dynamic memory allocation.

Re: Linus Torvalds: “Do No Harm”

#104

Post by zaarn »

margorczynski wrote: post #88
Santosh83 wrote: post #70

Earlier quoted context omitted.

I don't see how you can convert a kernel-space driver to a user-space one without significant rewriting, and in some cases it may not be possible at all.

What about some abstraction/interfacing layer/driver that would take care of exposing some kernel functionality an average driver needs and provide additional validation?

Drivers need to do things that are inherently unsafe.

The driver responsible for you harddrive needs to instruct the SATA controller to copy a piece of data from disk to a specified memory location.

The kernel has no understanding of the process without the driver and is therefore incapable of preventing abuse.

You can somewhat prevent this using various methods but those cost performance.

And keep in mind the abstraction itself already costs performance and this doesn't even allow easy extending of the abstraction if necessary.

While microkernels that do run everything in userspace are nice in theory, you usually pay in CPU cycles compared to kernel-mode drivers.

Re: Linus Torvalds: “Do No Harm”

#105

Post by mtgx »

zx2c4 wrote: post #63

I wrote the email that prompted this quite civil response. I'm very pleased with the outcome, because I think this clear statement of his position is a lot more useful for people to work with, rather than just assuming Linus hates security or something. I interpreted his response in practical terms as essentially being the following. Patch set merge 1 has "report" as default and "kill" as a non-default option. Patch…

Is that really a position Linus has maintained for a long time? Because I got the feeling Linus really just hated anything to do with security.

It's only in more recent years when the automotive and IoT industries have started to get involved in the Linux Foundation and them asking for more security features that he seems to have tried to find ways to "compromise" with security people.

Re: Linus Torvalds: “Do No Harm”

#106

Post by rimliu »

smnrchrds wrote: post #60
kyberias wrote: post #25

I think the earlier message drives the points home in more familiar Linus style: https://lkml.org/lkml/2017/11/17/767 "Some security people have scoffed at me when I say that security problems are primarily "just bugs". Those security people are f*cking morons." Gotta love the guy. :)

The person at the other end of the conversation would disagree with this sentiment: "Thanks. Still, I'd prefer Linus yell at me than other folks trying to do similar work. If I can shield anyone from this abuse, then maybe they won't give up on kernel security development. Digging Linus's actionable feedback out of the ad-hominem attack can be challenging." [1] [1] https://twitter.com/kees_cook/status/932694978366619…

I am happy Linus shields Linux kernel from those golden-hearted individuals whose feel-good attitude would allow questionable solutions designed by committee to slip in.

Re: Linus Torvalds: “Do No Harm”

#107

Post by TickleSteve »

john61 wrote: post #62
muppetman wrote: post #18

Earlier quoted context omitted.

Say there's a minor error in a network driver. Yes, it might be exploitable by a smart person. But the error only triggers once a day when a counter rolls over. Do you really want your box to lock up and panic when this error is encountered, or do you just want your box to keep working. I'm firmly in the first camp (I'll take lock up and freeze thanks) but 99% of users don't care about a bug like that and just want t…

I want both. Panic in a test/development kernel, do not panic in a production environment.

It the opposite...

you should panic in a production environment and reset the state of the machine (which has become indeterminate).

The correctness and validity of the data >> uptime.

Re: Linus Torvalds: “Do No Harm”

#108

Post by kadenshep »

smnrchrds wrote: post #60
kyberias wrote: post #25

I think the earlier message drives the points home in more familiar Linus style: https://lkml.org/lkml/2017/11/17/767 "Some security people have scoffed at me when I say that security problems are primarily "just bugs". Those security people are f*cking morons." Gotta love the guy. :)

The person at the other end of the conversation would disagree with this sentiment: "Thanks. Still, I'd prefer Linus yell at me than other folks trying to do similar work. If I can shield anyone from this abuse, then maybe they won't give up on kernel security development. Digging Linus's actionable feedback out of the ad-hominem attack can be challenging." [1] [1] https://twitter.com/kees_cook/status/932694978366619…

>Digging Linus's actionable feedback out of the ad-hominem attack can be challenging.

They're not really that separate. He's being totally disingenuous and still letting his own fragile ego get involved.

Re: Linus Torvalds: “Do No Harm”

#109

Post by TickleSteve »

makomk wrote: post #93
Slavius wrote: post #42

Earlier quoted context omitted.

I can't think of single useful piece of software nowdays that is exposed to public and can't run in active-active load balanced or clustered scenario. If your kernel/system/userland-app misbehaves it simply needs to be shut down, reported and examined. It might have been some random memory block the last time your app made an buffer overflow, but it could as well be the stack pointer next time...

Remember, we're necessarily just talking about servers here; every single hospital has mission-critical client machines that cannot go down and obviously those aren't load balanced or clustered. (Though mostly they seem to be running Windows.)

For safety-critical systems, resetting on a fault is very much factored into the worst-case response time and expected behaviour.

PANIC on fault is exactly what you design into the systems.

Re: Linus Torvalds: “Do No Harm”

#110

Post by mtgx »

lima wrote: post #3

Background: the "kernel self protection project" (KSSP) recently upstreamed the Grsecurity/PAX reference counting implementation which prevents a certain class of security bugs from being exploited. Grsecurity is a security hardening patchset for Linux that makes deliberate trade-offs in favor of security, sacrificing availability if necessary. This, aside from the political issue, is the main reasons why it's hard t…

Because Linus hates them? Make Brad Spengler the primary maintainer of the Linux kernel and we may actually get self-driving cars that don't kill us when they get hacked in 5 years.
Post reply on HN