Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus: Don't bother with grsecurity. Their patches are pure garbage

spinics.net

Post reply on HN
Print view View original

71–80 of 172 posts

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#71

Post by geofft »

madez wrote: post #47

A genuine question: Why isn't it perfectly reasonable to accept to break compatibility in order to increase security? Isn't that what we do in our lifes all the time? When the authorities issue new fire safety regulations for buildings, then that is breaking compatibility to the older building standard. We still do it because there is good reason. Sometimes even old buildings need to be retrofitted, and that is then…

It is, and he's wrong, and he's usually wrong when security comes up.

See also git using SHA-1: people warned him about this, and he argued passionately and incorrectly that git doesn't use SHA-1 as an integrity measure. He also argued passionately and incorrectly that SHA-1 was unlikely to be broken and worrying about it was a waste of effort. And now other people are doing a lot of slow work to dig ourselves out of literally every single git repo in the world relying on a broken crypto primitive.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#72

Post by dkarapetyan »

djrogers wrote: post #49
dkarapetyan wrote: post #15

Earlier quoted context omitted.

Google Linus rant. There are many examples.

The term “Crying Wolf” implies the very specific and extreme accusation of lying. Ranting, or even ranting then reversing course are very different from lying. Words have meaning, be careful how you use them.

Words have meaning? ffs. Was there a shitpost memo sent out I didn't get. thx cpt obvious

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#73

Post by windows_lover »

whoami_nr wrote: post #22
windows_lover wrote: post #12

Linus, and this stubborn attitude of his, is the reason that Linux will always lag behind Windows in kernel security. With the vast security improvements Microsoft are putting into their operating system year on year, it's a shame to see Linux failing to keep up.

>Linux will always lag behind Windows in kernel security Are you serious about that statement ?

I am indeed. Linux lacks many of the security features and exploit mitigations present in Windows, despite the efforts of contributors such as grsecurity.

There appears to be no overarching strategy in Linux to improve security, it's all rather haphazard.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#74

Post by cyphar »

dkarapetyan wrote: post #66
cyphar wrote: post #25

Earlier quoted context omitted.

Crying wolf requires him to have been wrong (or lied). I think that GP was asking you for evidence of _that_, not of evidence that Linus has ranted in the past. From memory, I can't recall a time where his ranting was not justified, but he has been wrong a couple of times. Unless I'm missing something blatant, that doesn't constitute "crying wolf" to me.

The parable of the boy crying wolf is not about lies but about desensitizing your audience to what you are saying. I've read enough of the rants to know there is very little signal to all the noise he makes. The grsecurity stuff could be bad but I sure as hell am not gonna get my analysis from Linus. If he acted more like a grown up then maybe but he doesn't. He character assassinates and then says you are doing sill…

> The parable of the boy crying wolf is not about lies but about desensitizing your audience to what you are saying.

... Because the little boy was lying. If there really was a wolf every time he said there was they would consider him a brilliant scout rather than an untrustworthy source of information.

It's strange that it's necessary to explain children's parables on HN.

> The kernel dev space needs less drama and more grown ups.

I don't disagree with that, I just don't agree with saying that Linus is crying wolf. Because you don't appear to understand what it means.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#75

Post by Tomte »

vacri wrote: post #63
ajarmst wrote: post #9

Earlier quoted context omitted.

I kind of find Linus refreshing, although I'm not sure that would survive working directly with him. I think you're begging the question though: surely compatibility/ABI stability/performance trumps extreme security (for some values of 'extreme') for people and in cases where that is true. I happen to agree with you and Linus on this (baring a known exploit of an unpatched security bug), but that heirarchy is nowhere…

I've always found it weird that de Raadt is admired for being abrasive, and Torvalds is pilloried. I've always wondered, if the grsec people are such believers of 'security above all else', why they just don't work with OpenBSD instead.

Lower hanging fruit and much larger potential client base in Linux. grsecurity are a business, after all.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#77

Post by hacknat »

geofft wrote: post #65
hacknat wrote: post #31

Earlier quoted context omitted.

And without backwards compatibility you would have never heard of Linux.

That's a very strong claim. Some evidence in favor is that, at least in the early days of Linux, Microsoft took the same strategy of prioritizing backwards compatibility over security - and reaped the rewards by becoming extremely popular and extremely full of security holes. So clearly the strategy worked for MS. On the other hand, MS did respond and prioritize security, and was able to pull it off without compromis…

I don't think it's "very" strong. It might just be "strong".

Rehashing MS's 90s-00s history of prioritizing security creates an unfair assumed comparison. Linux doesn't get to control userland the way MS does. I don't want to belittle MS's efforts, but the attack vector is a lot smaller in NT. Linux has way more features and use cases than the NT kernel ever has (maybe by an order of magnitude). We also don't have the complete picture on NT because of the source being closed.

> With the a.out to ELF transition and libc5 to libc6 transition back in the day, and to this day with OpenSSL versions, the GCC 5 libstdc++ ABI change, etc

You need to remember that Linux's use cases are way bigger than being able to build C binaries and stay forward with SSL. It's easy to forget, but Linux is hardly just servers, they are probably the biggest embedded foot print outside the no-OS or RTOS space, tons non-PC peripheral and consumer electronic applications. You're calling out one set of features that a huge swath of Linux consumers probably never touched for a decade (remember its only been recently that embedded applications have communicated over a network, or had to do so securely).

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#78

Post by fosco »

babyrainbow wrote: post #62
Diederich wrote: post #41

Earlier quoted context omitted.

Note: this is a lot tamer than a lot of the stuff I've seen him post in lwn.net comments. I have a lot of respect for their work. It's just a shame that their toxic communications will make the good things they do so much less likely to be widely adopted.

> their toxic communications If you can't handle the truth, then every truhful communication can be "toxic" to you.

Excuse typos from phone...A quote from Randy pausch (0) last lecture(1)

"And he put his arm around my shoulders and we went for a little walk and he said, Randy, it’s such a shame that people perceive you as so arrogant. Because it’s going to limit what you’re going to be able to accomplish in life. What a hell of a way to word “you’re being a jerk.” [laughter] Right? He doesn’t say you’re a jerk. He says people are perceiving you this way and he says the downside is it’s going to limit what you’re going to be able to accomplish.

(0)https://en.m.wikipedia.org/wiki/Randy_Pausch

  (1)http://www.cmu.edu/randyslecture/

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#79

Post by dkarapetyan »

Guess you lack the level of abstraction capabilities I expect. Sure. The parable is just about lies and not signals and noises. All Linus rants are full of information. He is a brilliant programmer. Everything he screams and shouts about is always correct. He has never confused a raccoon with a wolf.

Re: Linus: Don't bother with grsecurity. Their patches are pure garbage

#80

Post by clhodapp »

simcop2387 wrote: post #67
Aeolun wrote: post #40

So, just to confirm I see this correctly: Grsecurity creates patches for issues in upstream, but their patches are too fucking big/ugly, so nobody upstream really wants to merge them, and when someone tries to fix em (take the important bits out), grsecurity complains about them using their work. Grsecurity then say they don't feel like doing a lot of work on their patches when they're not paid to do it.

Along with that Grsec then says that if while the patch is GPLv2 if you distribute them they'll never let you subscribe again to get the patch in the future.

That's a pretty interesting loophole in the GPL: apparently (at least with V2), it might be fine to impose consequences for exercising your rights while technically giving them to you. It certainly violates the spirit of the GPL even if it doesn't violate the letter.
Post reply on HN