Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds: “Do No Harm”

lkml.org

Post reply on HN
Print view View original

201–210 of 233 posts

Re: Linus Torvalds: “Do No Harm”

#201

Post by edoceo »

jlgaddis wrote: post #184
zx2c4 wrote: post #63

I wrote the email that prompted this quite civil response. I'm very pleased with the outcome, because I think this clear statement of his position is a lot more useful for people to work with, rather than just assuming Linus hates security or something. I interpreted his response in practical terms as essentially being the following. Patch set merge 1 has "report" as default and "kill" as a non-default option. Patch…

It would be awesome if this could be set by a sysctl, instead of setting a kernel option and recompiling the kernel.

Patch Set Merge 1.5?

Re: Linus Torvalds: “Do No Harm”

#202

Post by mcguire »

snvzz wrote: post #83
drinchev wrote: post #34

Earlier quoted context omitted.

Linux is used in so many critical systems. What happens when a security bug stops the ventilating machine of a person lying in hospital bed, or halts the screen of a surgeon. Not to mention voting machines, ISP's, telecoms. For me having all those stopped, when properly exploited, looks more like a very scary DoS attack vector. Imagine a security f*ck up, like Heartbleed, but this time with an option to halt kernels…

> Linux is used in so many critical systems. It shouldn't be. It's ill suited for that. Look at seL4, minix3, echronos instead.

Minix 3?

Re: Linus Torvalds: “Do No Harm”

#203

Post by TickleSteve »

__david__ wrote: post #186
TickleSteve wrote: post #107

Earlier quoted context omitted.

It the opposite... you should panic in a production environment and reset the state of the machine (which has become indeterminate). The correctness and validity of the data >> uptime.

On the other hand, the mere act of panicking may corrupt data (by virtue of stopping processes). I learned this the hard way when my kernel panicked while I was shrinking a large ext4 volume (the panic was unrelated to the shrinking). It's not just a simple equation like you've claimed.

A panic should stop the processor dead, no data should be corrected as a result. Data in flight should not be used if you use transactional I/O and therefore will not be used if a write does not complete.

Re: Linus Torvalds: “Do No Harm”

#204

Post by mcguire »

Nokinside wrote: post #91
anameaname wrote: post #32

Earlier quoted context omitted.

A thought experiment that comes up in Kernel design classes is what should happen if the OS was running the flight-control software for an Airplane you are on? If there was a bug in the kernel, perhaps a double free or a memory leak, what should happen? A panic would result in the airplane falling to certain doom. But if it were to keep running, it may be a security vulnerability. Being absolutist in either direction…

> double free or a memory leak, what should happen Both offensive and defensive programming is important in safety critical programs and I get your point, but those things you mention don't' happen in safety critical systems. There is no dynamic memory allocation. RTOS used will support "brick wall partitioning" for memory, processing and other resources. Different systems can run in the same OS but they cant' compet…

http://www.space.com/26593-apollo-11-moon-landing-scariest-m...

https://www.doneyles.com/LM/Tales.html

Re: Linus Torvalds: “Do No Harm”

#205

Post by TimPC »

pgeorgi wrote: post #176
mtgx wrote: post #110

Earlier quoted context omitted.

Because Linus hates them? Make Brad Spengler the primary maintainer of the Linux kernel and we may actually get self-driving cars that don't kill us when they get hacked in 5 years.

> Make Brad Spengler the primary maintainer of the Linux kernel and we may actually get self-driving cars that don't kill us when they get hacked in 5 years. But only because every self-driving car project out there will avoid Linux like the plague.

Instead of self-driving cars maybe crashing from being hacked in some possible future we'll get kernel panics leading to crashes in all possible futures because we'll trigger car crashes on every false positive, because crashing in the face of the unknown is a seemingly acceptable solution to a security risk. Even if the software is running self-driving cars and crashing may mean crashing. In practice, false positives are way more common than exploits and in many user cases they'd rather have 1 computer exploit than 1000 or 10,000 crashes.

Re: Linus Torvalds: “Do No Harm”

#206

Post by kazinator »

amelius wrote: post #8
lima wrote: post #3

Background: the "kernel self protection project" (KSSP) recently upstreamed the Grsecurity/PAX reference counting implementation which prevents a certain class of security bugs from being exploited. Grsecurity is a security hardening patchset for Linux that makes deliberate trade-offs in favor of security, sacrificing availability if necessary. This, aside from the political issue, is the main reasons why it's hard t…

> Grsecurity will rather terminate userland programs or, in some rare cases, panic the kernel if it finds itself in an undefined state. This is exactly what you want if you care about security, but it's not a trade-off everyone is happy with (including Linus). I'd also like my kernel to halt whenever an assertion does not hold, for the sake of keeping my sanity; not just for security. Why would you not want this?

> This is exactly what you want if you care about security,

A deliberate panic could be the basis of a denial-of-service exploit.

Re: Linus Torvalds: “Do No Harm”

#207

Post by CJefferson »

teamhappy wrote: post #142
CJefferson wrote: post #140

Earlier quoted context omitted.

The problem is, what actually happened (in a previous commit) was: The IPv6 stack does a perfectly sensible and legal thing. The hardener code misunderstands the legal code, and causes a reboot. That it was Linus is worried about -- often it is hard to tell the difference between "naughty" code which can never be a security hole, and genuine security holes. They should all be fixed ASAP, but making code that previous…

Bugs in the hardening code are obviously bad and annoying but that's besides the point. All bugs are bad and annoying, especially ones that cause a kernel panic. I don't think anybody is going to argue with that. That's not what Linus said though. What he said is: > when adding hardening features, the first step should *ALWAYS* be > "just report it". Not killing things, not even stopping the access. > Report it. Noth…

By first step, Linus just means "for a year or two". Yes it would be nice to put super high security on today, but instead we slowly turn up the setting, from opt in to opt out to forced on, to ensure we don't break anything.

Re: Linus Torvalds: “Do No Harm”

#208

Post by floatboth »

eecc wrote: post #133
snvzz wrote: post #83

Earlier quoted context omitted.

> Linux is used in so many critical systems. It shouldn't be. It's ill suited for that. Look at seL4, minix3, echronos instead.

Well apparently even minix3 is not free from critical vulterabilities ;) https://security-center.intel.com/advisory.aspx?intelid=INTE...

Intel's shitty apps running on Minix != Minix itself

Re: Linus Torvalds: “Do No Harm”

#209

Post by quink »

pjmlp wrote: post #90
quink wrote: post #54

I'm reminded of a recent security fix for IE11 that Microsoft pushed out earlier this year: https://developer.microsoft.com/en-us/microsoft-edge/platfor... It killed printing from iframes completely. Great that they solved the security problem, whatever it may have been. They also broke a major piece of browser functionality that a lot of enterprises rely on fundamentally. Hell, even printing shipping labels from eBa…

Because there is a workaround, applications just need to be updated. "Either use Print Preview instead of print button or if currently using window.print() in javascript change this to document.execCommand('print’, false, null)"

> applications just need to be updated

Updated away from web standards to false and null and random string. And then they made window.print work again.

Additionally what guarantee was there that execCommand(magicString) where magicString is `print` wouldn’t be removed in the next security “fix” because the security fix should have broken this too as it did window.print? After all, it seems to do the same thing. Answer: none at all and then you’re back to square one.

Re: Linus Torvalds: “Do No Harm”

#210

Post by __david__ »

TickleSteve wrote: post #203
__david__ wrote: post #186

Earlier quoted context omitted.

On the other hand, the mere act of panicking may corrupt data (by virtue of stopping processes). I learned this the hard way when my kernel panicked while I was shrinking a large ext4 volume (the panic was unrelated to the shrinking). It's not just a simple equation like you've claimed.

A panic should stop the processor dead, no data should be corrected as a result. Data in flight should not be used if you use transactional I/O and therefore will not be used if a write does not complete.

That's fine in theory, but it didn't stop my disk from being corrupted. If the computer hadn't panicked, my data would still be available.
Post reply on HN