Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Theo de Raadt: "You've been smoking something mind altering" (2007)

marc.info

Post reply on HN
Print view View original

71–80 of 99 posts

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#71

Post by mvdtnz »

rurban wrote: post #69
ranger_danger wrote: post #65

I wished more people would take issue with developers' bad attitudes. I know this is an extremely unpopular take, but I refuse to use software where the main dev(s) are openly abusive to others. Sadly this includes the majority of open source operating systems and many other very popular applications... but it's my decision and you're welcome to disagree with me. I am not trying to prevent others from using said soft…

There was no abuse and bad attitude. He was telling the truth about Linux hypervisors. And it got worse since then. Then they talked Xen, which at least has a security boundary. Now everybody switched to kvm with none. Only speed matters, security not at all.

> You are absolutely deluded, if not stupid

.. is abusive.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#72

Post by Veserv »

tptacek wrote: post #13

One of his dumber takes. Virtualization replaces an ultra-functional general-purpose kernel evolved over decades to support every conceivable application with a drastically smaller "kernel" (KVM and the userland hypervisor). It's a drastic attack surface reduction, and the empirical data bears that out: kernel LPEs aren't even newsworthy (there's whole repos full of unnamed, unremarked-upon LPEs), and KVM escapes are…

Virtualization is responsible for effectively none of those security benefits.

It is the reduction to a smaller “kernel” that is responsible. If you applied the same design and operational model to running regular old processes instead of virtual machines you would also get a system with less security holes than the grossly insecure rat’s nest that is Linux, Windows, or whatever other commercial IT OS you have in mind.

Virtualization is almost entirely orthogonal, if not harmful, to security of the platform and operations. It is not magic pixie dust that makes your operational model more robust. You need a robust operational model, then you can have a robust operational model with virtual machines.

There is a reason why the most secure systems in the world are separation kernel architectures instead of hypervisors even though most of those systems do support virtualization as a feature, just not as the basis of their security propertys.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#73

Post by dlcarrier »

Gud wrote: post #62

I don't understand the constant (almost always unsubstantiated) criticism of the *BSDs from many Linux advocates. Personally I evaluate each OS by it's merit, and I've concluded that OpenBSD, FreeBSD and some Linux distributions(I use arch btw) are solid operating systems. On the server I prefer FreeBSD because of it's amazing flexibility, and stable yet evolutionary base system and in my opinion, superior init syste…

If you like Arch and init systems with simple RC scripts, check out Artix Linux (https://artixlinux.org/), which is an Arch-based Linux distribution that supports multiple options for init systems.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#74

Post by dredmorbius »

boricj wrote: post #18
tptacek wrote: post #13

One of his dumber takes. Virtualization replaces an ultra-functional general-purpose kernel evolved over decades to support every conceivable application with a drastically smaller "kernel" (KVM and the userland hypervisor). It's a drastic attack surface reduction, and the empirical data bears that out: kernel LPEs aren't even newsworthy (there's whole repos full of unnamed, unremarked-upon LPEs), and KVM escapes are…

Doesn't that message date back to a time that either predates or is almost concurrent with the introduction of x86 hardware-assisted virtualization? I wasn't around playing with VMs back then, but I'm not sure that the track record of x86 virtualization 20 years ago was that great.

The email in question actually addresses one of the first, if not the first, x86 hypervisor product, Xen, relying on both my memory of the time (I did some work with Xen in the mid aughts) and Wikipedia: https://en.wikipedia.org/wiki/Timeline_of_virtualization_tec...>.

The Xen hypervisor itself was pretty minimal, as I understand mostly serving to time-slice CPU cycles among guest domains and partition memory access. As a contrast to VMWare, device access and drivers were handled by the guests themselves.

As such, the attack surface of the Xen hypervisor itself is fairly minimal. Most security issues seem to be denial of service vulnerabilities, though there are some privilege escalation, access, information leak, and overflow issues listed:

https://xenbits.xen.org/xsa/>

I generally respect de Raadt's expertise and instincts, though he may have been over his skis here.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#75

Post by jraph »

worik wrote: post #68

That is old news, Theo was harsh, arrogant and rude. He was not always right, but always RIGHT!! But ten years ago. What is the point now?

Don't take this personally, but I am sorry to have to inform you that it was, in fact, almost 20 years ago. Just months after Rihanna released Umbrella, and a year after Mika released Relax.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#76

Post by tptacek »

Veserv wrote: post #72
tptacek wrote: post #13

One of his dumber takes. Virtualization replaces an ultra-functional general-purpose kernel evolved over decades to support every conceivable application with a drastically smaller "kernel" (KVM and the userland hypervisor). It's a drastic attack surface reduction, and the empirical data bears that out: kernel LPEs aren't even newsworthy (there's whole repos full of unnamed, unremarked-upon LPEs), and KVM escapes are…

Virtualization is responsible for effectively none of those security benefits. It is the reduction to a smaller “kernel” that is responsible. If you applied the same design and operational model to running regular old processes instead of virtual machines you would also get a system with less security holes than the grossly insecure rat’s nest that is Linux, Windows, or whatever other commercial IT OS you have in min…

You can falsify these claims simply by looking at the records of platform vulnerabilities. I don't think this is a live argument.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#78

Post by ranger_danger »

rurban wrote: post #69
ranger_danger wrote: post #65

I wished more people would take issue with developers' bad attitudes. I know this is an extremely unpopular take, but I refuse to use software where the main dev(s) are openly abusive to others. Sadly this includes the majority of open source operating systems and many other very popular applications... but it's my decision and you're welcome to disagree with me. I am not trying to prevent others from using said soft…

There was no abuse and bad attitude. He was telling the truth about Linux hypervisors. And it got worse since then. Then they talked Xen, which at least has a security boundary. Now everybody switched to kvm with none. Only speed matters, security not at all.

Disagree, but regardless, both Theo and Linus have long, storied histories of prolonged habitual abuse without much remorse. Even after Linus "stepped back", it never really stopped after he came back.

We'll probably also disagree on what is abuse or not, but that's ok.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#79

Post by Veserv »

tptacek wrote: post #76
Veserv wrote: post #72

Earlier quoted context omitted.

Virtualization is responsible for effectively none of those security benefits. It is the reduction to a smaller “kernel” that is responsible. If you applied the same design and operational model to running regular old processes instead of virtual machines you would also get a system with less security holes than the grossly insecure rat’s nest that is Linux, Windows, or whatever other commercial IT OS you have in min…

You can falsify these claims simply by looking at the records of platform vulnerabilities. I don't think this is a live argument.

Great, then falsify it. Point at a system with the same operational model as KVM-based multi-tenant systems with large numbers of platform vulnerabilitys.

Let us review a standard operational model:

Virtual machines are usually pre-allocated their total RAM. Virtual machines are usually pre-allocated a number of cores and pinned to them. Virtual machines are usually only allocated a small number of devices such as a virtual block storage device and virtual network device upon which they implement a in-VM filesystem and network stack. Virtual machines usually have no access to shared services provided by the hypervisor.

So we have a operational model where you have to pre-allocate RAM to a process. You have to pre-allocate a whole core and pin the process to it. The process has no access to a global filesystem, network stack, or devices. The process has access to exactly one file, which is logically similar to a virtual block storage device, and a single raw network socket, which is logically similar to a virtual network device. The process has no ability to form a socket to another process, form a new file, or even have any way of interacting with other processes at all. The process has no access to shared services of any kind.

The chasm between that operational model and any commercial IT operating system is immense, being basically the polar opposite in every dimension in the direction of security. Default-deny instead of default-allow. Shared-nothing instead of shared-everything. What you have there is a system even more static and simple than what runs on most microkernels. That is the comparable class of platforms with a similar operational model.

To demonstrate that virtualization is the key factor, you need to demonstrate that actually comparable systems with similar operational models like microkernels have more platform vulnerabilitys than comparable KVM-based, or even just hypervisor-based, systems. Which, again, flies against the face of evidence as the systems that are actually used in high security applications designed to protect against state actors are separation kernels instead of hypervisors.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#80

Post by tptacek »

Veserv wrote: post #79
tptacek wrote: post #76

Earlier quoted context omitted.

You can falsify these claims simply by looking at the records of platform vulnerabilities. I don't think this is a live argument.

Great, then falsify it. Point at a system with the same operational model as KVM-based multi-tenant systems with large numbers of platform vulnerabilitys. Let us review a standard operational model: Virtual machines are usually pre-allocated their total RAM. Virtual machines are usually pre-allocated a number of cores and pinned to them. Virtual machines are usually only allocated a small number of devices such as a…

These are a lot of words that I think are trying to work around the fact that LPEs are commonplace and KVM escapes are very rare.
Post reply on HN