Live data from Hacker News

Kernel bugs hide for 2 years on average. Some hide for 20

pebblebed.com

111–120 of 186 posts

Re: Kernel bugs hide for 2 years on average. Some hide for 20

#111

Earlier quoted context omitted.

Worst case is that it doesn't even cause correctness issues in normal use, only when misused in a way that is unlikely to happen unintentionally.

I guess because I work in security the "unintentionally" doesn't matter much to me.

But it matters for detection time, because there's a lot more "normal" use of any given piece of code than intentional attempts to break it. If a bug can't be triggered unintentionally it'll never get detected through normal use, which can lead to it staying hidden for longer.

Re: Kernel bugs hide for 2 years on average. Some hide for 20

#112

Before the "rewrite it in Rust" comments take over the thread: It is worth noting that the class of bugs described here (logic errors in highly concurrent state machines, incorrect hardware assumptions) wouldn't necessarily be caught by the borrow checker. Rust is fantastic for memory safety, but it will not stop you from misunderstanding the spec of a network card or writing a race condition in unsafe logic that int…

[dead]

Re: Kernel bugs hide for 2 years on average. Some hide for 20

#113
The lesson here is that people have an unrealistic view of how complex it is to write correct and safe multithreaded code on multi-core, multi-thread, assymmetric core, out-of-order processors. This is no shade to kernel developers. Rather, I direct this at people who seem to you can just create a thread pool in C++ and solve all your concurrency problems.

One criticism of Rust (and, no, I'm not saying "rewrite it in Rust", to be clear) is that the borrow checker can be hard to use whereas many C++ engineers (in particular, for some reason) seem to argue that it's easier to write in C++. I have two things to say about that:

1. It's not easier in C++. Nothing is. C++ simply allows you to make mistakes without telling you. GEtting things correct in C++ is just as difficult as any other language if not more so due to the language complexity; and

2. The Rust borrow checker isn't hard or difficult to use. What you're doing is hard and difficult to do correctly.

This is I favor cooperative multitasking and using battle-tested concurrency abstractions whenever possible. For example the cooperative async-await of Hack and the model of a single thread responding to a request then discarding everything in PHP/Hack is virtually ideal (IMHO) for serving Web traffic.

I remember reading about Google's work on various C++ tooling including valgrind and that they exposed concurrency bugs in their own code that had lain dormant for up to a decade. That's Google with thousands of engineers and some very talented engineers at that.

Re: Kernel bugs hide for 2 years on average. Some hide for 20

#114
post #81

Is the intention of the author to use the number of years bugs stay "hidden" as a metric of the quality of the kernel codebase or of the performance of the maintainers? I am asking because at some point the articles says "We're getting faster". IMHO a fact that a bug hides for years can also be indication that such bug had low severity/low priority and therefore that the overall quality is very good. Unless the time…

> IMHO a fact that a bug hides for years can also be indication that such bug had low severity/low priority Not really true. A lot of very severe bugs have lurked for years and even decades. Heartbleed comes to mind. The reason these bugs often lurk for so long is because they very often don't cause a panic, which is why they can be really tricky to find. For example, use after free bugs are really dangerous. However…

> …lurked for years and even decades. Heartbleed comes to mind.

I don’t know much about Heartbleed, but Wikipedia says:

> Heartbleed is a security bug… It was introduced into the software in 2012 and publicly disclosed in April 2014.

Two years doesn’t sound like “years or even decades” to me? But again, I don’t know much about Heartbleed so I may be missing something. It does say it was also patched in 2014, not just discovered then.

Re: Kernel bugs hide for 2 years on average. Some hide for 20

#115

Earlier quoted context omitted.

> are the state machine race conditions logic races (which Rust won’t trivially solve) or data races? If they are data races, are they the kind of ones that Rust will catch (missing atomics/synchronization) or the ones it won’t (bad atomic orderings, etc.). The example given looks like a generalized example: spin_lock(&lock); if (state == READY) { spin_unlock(&lock); // window here where another thread can change sta…

I'd argue, that while null ref and those classes of bugs may decrease, logic errors will increase. Rust is not an extraordinary readable language in my opinion, especially in the kernel where the kernel has its own data structures. IMHO Apple did it right in their kernel stack, they have a restricted subset of C++ that you can write drivers with. Which is also why in my opinion Zig is much more suitable, because it a…

[deleted]

Re: Kernel bugs hide for 2 years on average. Some hide for 20

#117

Before the "rewrite it in Rust" comments take over the thread: It is worth noting that the class of bugs described here (logic errors in highly concurrent state machines, incorrect hardware assumptions) wouldn't necessarily be caught by the borrow checker. Rust is fantastic for memory safety, but it will not stop you from misunderstanding the spec of a network card or writing a race condition in unsafe logic that int…

I don't think 70% of bugs are memory safety issues. In my experience it's closer to 5%.

70% of security vulnerabilities are due to memory safety. Not all bugs.

Re: Kernel bugs hide for 2 years on average. Some hide for 20

#118
post #57

Earlier quoted context omitted.

Rust would prevent a number of bugs, as it can model state machine guarantees as well. Rewriting it all in Rust is extremely expensive, so it won't be done (soon).

Expensive because of: 1/ a re-write is never easy 2/ rust is specifically tough (because it catches error and forces you to think about it for real, because it makes some contruct (linked list) really hard to implement) for kernel/close to kernel code ?

Both I'd say. Rust imposes more constraints on the structure of code than most languages. The borrow checker really likes ownership trees whereas most languages allow any ownership graph no matter how spaghetti it is.

As far as I know that's why Microsoft rewrote Typescript in Go instead of Rust.

Re: Kernel bugs hide for 2 years on average. Some hide for 20

#119

grsecurity project has fixed many security bugs but did not contribute back, as they're profiting from selling the patchset. It's not uncommon for the bugs they found to be rediscovered 6-7 years later. https://xcancel.com/spendergrsec

But the patchset should use the same license as the original code, shouldn't?

It is: https://grsecurity.net/faq

Re: Kernel bugs hide for 2 years on average. Some hide for 20

#120
post #66

Earlier quoted context omitted.

It’s hilarious that you feel the need to preemptively take control of the narrative in anticipation of the Rust people that you fear so much. Is this an irrational fear, I wonder? Reminds me of methods used in the political discourse.

> It’s hilarious that you feel the need to preemptively take control of the narrative in anticipation of the Rust people that you fear so much. > Is this an irrational fear, I wonder? Reminds me of methods used in the political discourse. In a sad sort of way, I think its hilarious that hn users have been so completely conditioned to expect rust evangelism any time a topic like this comes up that they wanted to get a…

I don’t think evangelism is necessary anymore. Rust adoption is now a matter of time.
Post reply on HN