Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds: “Do No Harm”

lkml.org

Post reply on HN
Print view View original

171–180 of 233 posts

Re: Linus Torvalds: “Do No Harm”

#171

Post by rhinoceraptor »

anameaname wrote: post #32
theWatcher37 wrote: post #21

Earlier quoted context omitted.

Absolutely not. If “do no harm” is a principle, then the kernel should ensure that no harm is taking place. If flaws within the kernel allow harm to occur while otherwise normal transactions are occurring then it is absolutely preferable to panic and shut down over allowing that potential harm to occur. To suggest otherwise, that detected errors that allow harm should be allowed, is pure insanity. Linus is unquestion…

A thought experiment that comes up in Kernel design classes is what should happen if the OS was running the flight-control software for an Airplane you are on? If there was a bug in the kernel, perhaps a double free or a memory leak, what should happen? A panic would result in the airplane falling to certain doom. But if it were to keep running, it may be a security vulnerability. Being absolutist in either direction…

The flight control system should absolutely panic. No (sane) person designs flight control systems without multiple redundancies.

Re: Linus Torvalds: “Do No Harm”

#173

Post by AnIdiotOnTheNet »

mschuster91 wrote: post #14
margorczynski wrote: post #6

Quick question - doesn't Linux driver model (they run in kernel-space) create a giant attack vector because of that?

Lots of drivers on Windows, OS X and Linux run in kernel space simply because kernel-to-user-and-back context switches are expensive and so kill performance. I believe the exceptions are printer and scanner drivers (these run in user-space CUPS in OS X/Linux), some filesystem drivers (basically, FUSE-backed) and cheap-ish USB drivers.

Since WDDM, a good portion of the display driver in Windows is in user space, as are sound and network drivers. This is how you can upgrade your graphics driver without rebooting or even losing your open windows, and why network and sound driver crashes don't usually bluescreen. It is probably the biggest reason why Windows doesn't crash anywhere near as often as it used to.

Re: Linus Torvalds: “Do No Harm”

#174

Post by _asummers »

zzzcpan wrote: post #117
amelius wrote: post #8

Earlier quoted context omitted.

> Grsecurity will rather terminate userland programs or, in some rare cases, panic the kernel if it finds itself in an undefined state. This is exactly what you want if you care about security, but it's not a trade-off everyone is happy with (including Linus). I'd also like my kernel to halt whenever an assertion does not hold, for the sake of keeping my sanity; not just for security. Why would you not want this?

A better way of course is not to halt on assertion, but to limit the scope of any potential problem in a such way, that an assertion could only crash a tiny isolated thing and trigger its restart, possibly not impacting availability whatsoever. You still get your sanity, but also get users happy with a rock solid thing that just works even in a presence of errors. The idea is known as supervision trees.

Erlang VM works this way, if someone's looking for a program that does this in practice. They have the mantra "let it crash". Something higher than you is in a better position to handle your error and restart you to a known good state.

Re: Linus Torvalds: “Do No Harm”

#175

Post by AnIdiotOnTheNet »

pjmlp wrote: post #90
quink wrote: post #54

I'm reminded of a recent security fix for IE11 that Microsoft pushed out earlier this year: https://developer.microsoft.com/en-us/microsoft-edge/platfor... It killed printing from iframes completely. Great that they solved the security problem, whatever it may have been. They also broke a major piece of browser functionality that a lot of enterprises rely on fundamentally. Hell, even printing shipping labels from eBa…

Because there is a workaround, applications just need to be updated. "Either use Print Preview instead of print button or if currently using window.print() in javascript change this to document.execCommand('print’, false, null)"

> Because there is a workaround, applications just need to be updated.

What actually happened: people reverted the patch. In the real world, you can't expect timely or even correct response from vendors you rely on. It sucks, but it's how it is.

Re: Linus Torvalds: “Do No Harm”

#176

Post by pgeorgi »

mtgx wrote: post #110
lima wrote: post #3

Background: the "kernel self protection project" (KSSP) recently upstreamed the Grsecurity/PAX reference counting implementation which prevents a certain class of security bugs from being exploited. Grsecurity is a security hardening patchset for Linux that makes deliberate trade-offs in favor of security, sacrificing availability if necessary. This, aside from the political issue, is the main reasons why it's hard t…

Because Linus hates them? Make Brad Spengler the primary maintainer of the Linux kernel and we may actually get self-driving cars that don't kill us when they get hacked in 5 years.

> Make Brad Spengler the primary maintainer of the Linux kernel and we may actually get self-driving cars that don't kill us when they get hacked in 5 years.

But only because every self-driving car project out there will avoid Linux like the plague.

Re: Linus Torvalds: “Do No Harm”

#177

Post by matwood »

theWatcher37 wrote: post #24
_nalply wrote: post #4

Earlier quoted context omitted.

If your security patch kills users' buggy processes or even crash their systems then you are a «bad security person». Please report the bad access first so users and developers of their software have time to fix the bug. Upgrades disabling users' software are a big no-no. After all security is meaningless for a non-working system.

I’m so glad that backwards thinking concepts like this are dominant, otherwise we might actually have secure software! Think about it, an open-source OS is choosing backwards compatibility over security. This would have caused quite the stir in the 90’s Linux community.

Do you want your system to kernel panic every time the security code gets a false positive about a problem? The security code is just as likely to have bugs as the software it is securing.

Re: Linus Torvalds: “Do No Harm”

#178

Post by titzer »

mrsernine wrote: post #64
sgentle wrote: post #23

It's interesting to see this laser focus on a particular kind of user. If you're running Linux on a server, you're a user, but unless you're very irresponsible you would probably rather your programs crash than give away private information. Your interface is to a cluster of machines where individual crashes are probably not that big a deal. If you're running Linux via Android, you're a user, but mostly you're a user…

>you would probably rather your programs crash than give away private information Crashing on a security issue is a good thing for every kind of user. Crashing on a latent bug that COULD be exploited (maybe not possible at all) is a totally not desirable situation. The problem here is that hardening methods lack the ability to make that distinction.

> Crashing on a latent bug that COULD be exploited (maybe not possible at all) is a totally not desirable situation.

How do you square this with the reality that "keep on truckin" is generally the path from bugs to security exploits, and has been shown to be over and over in the wild?

Re: Linus Torvalds: “Do No Harm”

#179

Post by dwild »

AnIdiotOnTheNet wrote: post #149
teamhappy wrote: post #125

Earlier quoted context omitted.

Let's say somebody gives you an USB stick and you plug it into your laptop. Which of the following scenarios would you like to see? 1. 0-day in the kernel's USB code. You're part of stuxnet now. 2. 0-day in the kernel's USB code. You're part of stuxnet now. You also get a message that tells you how and where to report the bug that was exploited. 3. 0-day in the kernel's USB code. Your computer crashes. You're not par…

This is exactly the kind of thinking Linus is talking about. In 3, I lost my work. Possibly very important work. To most people, being a part of stuxnet, while undesirable, is preferable to losing their work. And you neglected a scenario 4: nobody is attempting to compromise my machine, but a buggy bit of USB code just crashed my system and took all my work with it.

You never learned at school to save what you are working on often? It's crazy, you are either too old to have required computer for school work or too young to have not lived through years of constant bluescreens.

Both 3 and 4 are mitigated by you saving your document often... it's not so bad, considering it can happen whatever you do.

Nowadays, Word is made to keep saving your change for that reason... They learned and designed it for the worst situation which is a whole system crash. If you can't handle that, well you aren't doing your work well.

Re: Linus Torvalds: “Do No Harm”

#180

Post by throw2016 »

Some security folks tend to have tunnel vision. They are focused on their own little patch and the first instinct is to control and shutdown with zero concern for usability. job done. bye. But that's too self serving and lazy.

And if that's what they want fine, release your own app or distro and let people who need/desire that level of security choose security over everything else without trade-offs.

The worst thing is a kind of entryism and trying to impose yourself on people operating under different constraints. That's why you always need a strong manager to balance interests and this is the role Linus is playing. More often that not with this kind of imposition something comes out of the blue, and you are left squandering hours to fix things and get back up and running.

Post reply on HN