Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds: “Do No Harm”

lkml.org

Post reply on HN
Print view View original

51–60 of 233 posts

Re: Linus Torvalds: “Do No Harm”

#51

Post by watwut »

lima wrote: post #13
alanfranzoni wrote: post #7

That's a consequence of an "old" issue in the IT security field - security researchers and developers sit at opposite sides of the table, they've got different concerns and agendas. Pick some security researchers; now tell them to build any nontrivial piece of software; I doubt they'd be able to do it, and if they succeed their software will be full of bugs, including security ones. Security is part of the correctnes…

That's not a fair (or useful) assessment. Obviously, the narrow-minded security people you describe exist, but they're a minority. Many security people are developers who specialized in security, and are very much capable of building software. The kernel code is question is exactly what you ask for - instead of finding and fixing single bugs, it's a mitigation that prevents all occurrences of a particular class of bu…

When I was looking to learn about how to systematically make secure software, I did not found all that great actionable information. There is a lot about particular hacks and vulnerabilities, lists of popular vulnerabilities categories etc. There are was one book dealing with architecture and such I found. Development quite clearly is not focus of security research.

A lot of advice, especially that found on blogs, was literally naive and felt like something written by someone who never even seen larger team working.

Re: Linus Torvalds: “Do No Harm”

#52

Post by AndrewDucker »

jbangert wrote: post #43
muppetman wrote: post #18

Earlier quoted context omitted.

Say there's a minor error in a network driver. Yes, it might be exploitable by a smart person. But the error only triggers once a day when a counter rolls over. Do you really want your box to lock up and panic when this error is encountered, or do you just want your box to keep working. I'm firmly in the first camp (I'll take lock up and freeze thanks) but 99% of users don't care about a bug like that and just want t…

But do you want your box to send silently corrupted data for the next two years? Or would you rather reboot every night, and maybe escalate to your red hat support contract, where someone will then fix the underlying bug (for which you now have crashdumps),

I'd want it to log that it's going wrong, and report that so that it can be fixed.

Re: Linus Torvalds: “Do No Harm”

#53

Post by jbangert »

sgentle wrote: post #23

It's interesting to see this laser focus on a particular kind of user. If you're running Linux on a server, you're a user, but unless you're very irresponsible you would probably rather your programs crash than give away private information. Your interface is to a cluster of machines where individual crashes are probably not that big a deal. If you're running Linux via Android, you're a user, but mostly you're a user…

It’s not even desktop users; most desktop users download Ubuntu and never touch anything, on reasonably common PC hardware. Kernel regressions mostly get caught in the Ubuntu betas or testing tracks (e.g. Debian Sid).

The typical user the kernel developers focus on here is a kernel developer: always running the latest kernel with a stable user space. I find it extremely narcissistic that they reject security improvements for billions of devices, for what essentially just makes developers lives easier,

Re: Linus Torvalds: “Do No Harm”

#54

Post by quink »

I'm reminded of a recent security fix for IE11 that Microsoft pushed out earlier this year:

https://developer.microsoft.com/en-us/microsoft-edge/platfor...

It killed printing from iframes completely. Great that they solved the security problem, whatever it may have been. They also broke a major piece of browser functionality that a lot of enterprises rely on fundamentally. Hell, even printing shipping labels from eBay was broken, and so was hilariously Microsoft Dynamics 365. And our own product.

And the first response by Microsoft on this very link? "Won't Fix" and keep a major bit of fundamental browser functionality - printing a document - not working. "Do No Harm".

Re: Linus Torvalds: “Do No Harm”

#55

Post by Slavius »

monocasa wrote: post #35
theWatcher37 wrote: post #21

Earlier quoted context omitted.

Absolutely not. If “do no harm” is a principle, then the kernel should ensure that no harm is taking place. If flaws within the kernel allow harm to occur while otherwise normal transactions are occurring then it is absolutely preferable to panic and shut down over allowing that potential harm to occur. To suggest otherwise, that detected errors that allow harm should be allowed, is pure insanity. Linus is unquestion…

It's not so black and white. Medtronic uses Linux. Do you want to be the guy who's medical equipment spontaneously reboots because of a bug that wouldn't have otherwise affected anything?

Linux is a modular kernel. I'm not aware of a single thing you can't disable or make modular during config/compile. I woudn't like to be the guy who's medical equipment killed him by slowly decreasing his oxygen levels due to buffer overflow either. If you're in this kind of business you take responsibility by discovering and fixing bugs which would go unnoticed otherwise. And if the life of your patients really depend on your equipment then having a redundant component within your device is a must.

Re: Linus Torvalds: “Do No Harm”

#56

Post by lima »

watwut wrote: post #51
lima wrote: post #13

Earlier quoted context omitted.

That's not a fair (or useful) assessment. Obviously, the narrow-minded security people you describe exist, but they're a minority. Many security people are developers who specialized in security, and are very much capable of building software. The kernel code is question is exactly what you ask for - instead of finding and fixing single bugs, it's a mitigation that prevents all occurrences of a particular class of bu…

When I was looking to learn about how to systematically make secure software, I did not found all that great actionable information. There is a lot about particular hacks and vulnerabilities, lists of popular vulnerabilities categories etc. There are was one book dealing with architecture and such I found. Development quite clearly is not focus of security research. A lot of advice, especially that found on blogs, wa…

There are many good books on security architecture. The technical details change every week, but the fundamental approach does not change.

"Security Engineering" by Ross Anderson is a must-read:

https://www.cl.cam.ac.uk/~rja14/book.html

(it's freely available, too)

Re: Linus Torvalds: “Do No Harm”

#57

Post by Slavius »

mjw1007 wrote: post #47
Slavius wrote: post #42

Earlier quoted context omitted.

I can't think of single useful piece of software nowdays that is exposed to public and can't run in active-active load balanced or clustered scenario. If your kernel/system/userland-app misbehaves it simply needs to be shut down, reported and examined. It might have been some random memory block the last time your app made an buffer overflow, but it could as well be the stack pointer next time...

Web browsers are, for practical purposes, exposed to the public. Linux doesn't run only on servers.

So what happens when your browser crashes? I experience that on a regular basis. Id' rather have my browser crash/killed instead of slowly overwriting my filesystem buffers or corrupting my stack pointer... Other than that browser are multi-thread/process applications. Usually only a single tab or a plugin crashes unless core browser process is affected. Most users would accept the trade off between crashed browser and infected/corrupted system.

Re: Linus Torvalds: “Do No Harm”

#58

Post by blaisio »

jbangert wrote: post #29

A few points: 1) failing loudly is better than failing silently. A memory corruption issue (or a bad refcount, etc.) is not a benign issue that only becomes relevant under carefully crafted exploit conditions. You need the carefully crafted exploit to get the system back into an attacker controlled state (I.e. code execution); by itself (with non-malicious inputs, usually something random or slightly atypical — enoug…

So one of Linus' main points in this series of posts is that failing loudly is actually not always better than failing silently or quietly, and it's really annoying when people come in making that assumption without thinking. This is also something that he is constantly repeating and ranting about, and it's arguably one of the reasons why Linux is so successful.

Think about a smartphone - do most users want it to crash and reboot, even if some error (which could end up being a security issue) occurred? The answer is no, absolutely not. The crashing and rebooting itself isn't really that helpful. Reporting the bug to the Linux developers _would_ be helpful.

Some people do want the frequent crashing behavior and that's okay, but it's not okay to make that decision for everyone.

Also, users might expect minor breakage if someone somewhere makes a mistake, but that doesn't mean it's okay. That's like saying if someone always washes their hands before eating, it's okay if they get sick, because they were expecting that they might get sick.

Re: Linus Torvalds: “Do No Harm”

#59

Post by zaarn »

>It's that the code has been RUN BY USERS for months. If it's been [...] in grsecurity for five years [...] It only means that hardly anybody actually ever ran it.

Subtle burn towards Grsec, I laughed a bit.

In all seriousness, I think Linus is somewhat on the right track. Security Patches should foremostly not break anyone's workflow (maybe except the evil haxor's workflow) and rather print a warning until the exact implications of a full Terminator-mode patch is understood. Because people won't upgrade to kernels that break their workflow and a warning in the kernel log is better than a vulnerable kernel.

Re: Linus Torvalds: “Do No Harm”

#60

Post by smnrchrds »

kyberias wrote: post #25

I think the earlier message drives the points home in more familiar Linus style: https://lkml.org/lkml/2017/11/17/767 "Some security people have scoffed at me when I say that security problems are primarily "just bugs". Those security people are f*cking morons." Gotta love the guy. :)

The person at the other end of the conversation would disagree with this sentiment:

"Thanks. Still, I'd prefer Linus yell at me than other folks trying to do similar work. If I can shield anyone from this abuse, then maybe they won't give up on kernel security development. Digging Linus's actionable feedback out of the ad-hominem attack can be challenging." [1]

[1] https://twitter.com/kees_cook/status/932694978366619648

Post reply on HN