Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds: “Do No Harm”

lkml.org

Post reply on HN
Print view View original

161–170 of 233 posts

Re: Linus Torvalds: “Do No Harm”

#161

Post by ac29 »

nerdponx wrote: post #127
lima wrote: post #3

Background: the "kernel self protection project" (KSSP) recently upstreamed the Grsecurity/PAX reference counting implementation which prevents a certain class of security bugs from being exploited. Grsecurity is a security hardening patchset for Linux that makes deliberate trade-offs in favor of security, sacrificing availability if necessary. This, aside from the political issue, is the main reasons why it's hard t…

Why isn't Grsecurity publicly available anymore?

https://grsecurity.net/announce.php

Reading between the lines, it seems to be a money thing.

Re: Linus Torvalds: “Do No Harm”

#162

Post by digi_owl »

TickleSteve wrote: post #109
makomk wrote: post #93

Earlier quoted context omitted.

Remember, we're necessarily just talking about servers here; every single hospital has mission-critical client machines that cannot go down and obviously those aren't load balanced or clustered. (Though mostly they seem to be running Windows.)

For safety-critical systems, resetting on a fault is very much factored into the worst-case response time and expected behaviour. PANIC on fault is exactly what you design into the systems.

So why is not the world running on C64s?

Re: Linus Torvalds: “Do No Harm”

#163

Post by protonfish »

AnIdiotOnTheNet wrote: post #120
mrsernine wrote: post #64

Earlier quoted context omitted.

>you would probably rather your programs crash than give away private information Crashing on a security issue is a good thing for every kind of user. Crashing on a latent bug that COULD be exploited (maybe not possible at all) is a totally not desirable situation. The problem here is that hardening methods lack the ability to make that distinction.

And yet one of the big complaints about Windows of old was how often it crashes.

Crashing randomly for no good reason isn't the same thing as crashing on a security exception.

Re: Linus Torvalds: “Do No Harm”

#164

Post by kiriakasis »

Slavius wrote: post #130
mythz wrote: post #114

Earlier quoted context omitted.

> Keep running your app although integrity corruption within the application happened is putting user data at risk. If user data is continually backed up to a remote site it's not going to be at risk from a local bug is it? Bugs exist in all software, Users are going to be be more visibly frustrated from their Apps frequently crashing then the extremely unlikely scenario where a detected bug corrupts their "3 days lo…

You clearly have limited view on application bugs. Let me elaborate a bit on bugs causing application dissatisfaction and UX frustration without crashing much, much worse than a simple error message along the lines: "OS has terminated application X because it has performed an illegal operation." Data corruption - reading or writing corrupted data - files cannot be read, saved files get corrupted, API calls from/to ex…

the standard windows user will not read the system log.

some people just use computer to do stuff to them there is little difference between "i lost my work because of a bug" and "i lost my work because of a security policy"; from a UX point of view both of them are the developer fault for releasing inadequate software.

Re: Linus Torvalds: “Do No Harm”

#165

Post by AnIdiotOnTheNet »

jbangert wrote: post #29

A few points: 1) failing loudly is better than failing silently. A memory corruption issue (or a bad refcount, etc.) is not a benign issue that only becomes relevant under carefully crafted exploit conditions. You need the carefully crafted exploit to get the system back into an attacker controlled state (I.e. code execution); by itself (with non-malicious inputs, usually something random or slightly atypical — enoug…

> Breaking user space is ok; users already expect breakage, and the cost of the additional breakages is low (to users and to society as a whole)

Which is why everyone loves rolling releases so much that Windows 10's forced upgrades are universally praised and Linux Desktop has a dominant market share.

Re: Linus Torvalds: “Do No Harm”

#166

Post by digi_owl »

iforgotpassword wrote: post #22
amelius wrote: post #8

Earlier quoted context omitted.

> Grsecurity will rather terminate userland programs or, in some rare cases, panic the kernel if it finds itself in an undefined state. This is exactly what you want if you care about security, but it's not a trade-off everyone is happy with (including Linus). I'd also like my kernel to halt whenever an assertion does not hold, for the sake of keeping my sanity; not just for security. Why would you not want this?

Servers: yes, phone/home PC: no. Maybe my dev machine but my wife wouldn't be happy with a kernel panic while writing an email. Like Linus said, this would go unreported with the average user because they just reboot in annoyance.

More and more it feels like the _sec world wants to go back to C64s dialing into big irons...

Re: Linus Torvalds: “Do No Harm”

#167

Post by corpMaverick »

lifeisstillgood wrote: post #9

do you want to know why your (random big company) does not do software development that well. when was the last time you saw an email like that from the chairman of the board to all employees? with Please in it. and long winded explanations? companies need to chnage

This is what I was thinking when I was reading. Linus has been thinking carefully about this for a long time. He has taken this piece of software and he has nurtured it for years. He has protected it. He made sure that it is coherent and maintainable. He has put forward as set of guiding principles.

I haven't seen this in the companies that I have worked for, middle and upper management don't have any insight over the products they are building. They just care about dates and getting projects done. There are not insights. There is no long term thinking. There is no awareness of the technical debt that is building up. Their only solution is to throw more money (and people) to the projects.

Re: Linus Torvalds: “Do No Harm”

#168

Post by digi_owl »

Santosh83 wrote: post #5

Very pragmatic. He sees software in the overall context of getting a job done with a computer, imperfect though it may be, instead of dying because it was not perfect. Unlike a segfault from a user space program that indeed merits a 'kill', the kernel should strive at all costs to keep running, since kernel panics are so much more inconvenient.

Just wish that the higher layers of the stack would see it as well, rather than being angry at Torvalds about it and going about how users are dumb sheep.

Re: Linus Torvalds: “Do No Harm”

#169

Post by digi_owl »

carlsborg wrote: post #86

"without users, your program is pointless, and all the development work you've done over decades is pointless. .. and (then) security is pointless too, in the end." He tends to get really mad when kernels dev inconvenience user space devs. Perhaps one of the reasons Linux succeeded was because of this fanatical customer focus - if linux is the platform, user space developers are the customers.

And then userspace goes on to piss on that by breaking their own stuff left right and center...

Re: Linus Torvalds: “Do No Harm”

#170

Post by teamhappy »

cesarb wrote: post #146
teamhappy wrote: post #142

Earlier quoted context omitted.

Bugs in the hardening code are obviously bad and annoying but that's besides the point. All bugs are bad and annoying, especially ones that cause a kernel panic. I don't think anybody is going to argue with that. That's not what Linus said though. What he said is: > when adding hardening features, the first step should *ALWAYS* be > "just report it". Not killing things, not even stopping the access. > Report it. Noth…

Step back a bit: when developing a new selinux policy, won't you develop first on permissive mode, and only after it's working without warnings, enable enforcing mode? It's the same thing here: the hardening should be developed first in a "permissive" mode which only warns, and then, after it's shown to be working without warnings, changed to be "enforcing" (in this case however, after some time the "permissive" mode…

I didn't mean that to sound like I'm in favor of turning the thing on right away.

(Also, the quotes I chose don't really help me make my case but I don't want to edit now since you've already commented on it. His first mail is way worse: https://lkml.org/lkml/2017/11/17/767)

Basically what I'm disagreeing with is that exploit mitigation's primary purpose is finding and fixing bugs. That's just not true. Its primary purpose is to protect users from exploitable bugs that we haven't found yet (but someone else might have).

Post reply on HN