Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Theo de Raadt: "You've been smoking something mind altering" (2007)

marc.info

Post reply on HN
Print view View original

81–90 of 99 posts

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#81

Post by Veserv »

tptacek wrote: post #80
Veserv wrote: post #79

Earlier quoted context omitted.

Great, then falsify it. Point at a system with the same operational model as KVM-based multi-tenant systems with large numbers of platform vulnerabilitys. Let us review a standard operational model: Virtual machines are usually pre-allocated their total RAM. Virtual machines are usually pre-allocated a number of cores and pinned to them. Virtual machines are usually only allocated a small number of devices such as a…

These are a lot of words that I think are trying to work around the fact that LPEs are commonplace and KVM escapes are very rare.

Cool, show me a LPE in a seL4 deployment. Do you believe that is easier or harder than finding a KVM escape?

Since you are varying the security basis, implementation, and operational model simultaneously when you are comparing KVM to Linux to argue that the security basis is the important factor, I get to as well. Except mine is actually more fair because the design of a seL4-based system is actually much more similar to the design of a multi-tenant KVM-based system than the design of the KVM-based system is to the design of a Linux user environment.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#82

Post by tptacek »

Veserv wrote: post #81
tptacek wrote: post #80

Earlier quoted context omitted.

These are a lot of words that I think are trying to work around the fact that LPEs are commonplace and KVM escapes are very rare.

Cool, show me a LPE in a seL4 deployment. Do you believe that is easier or harder than finding a KVM escape? Since you are varying the security basis, implementation, and operational model simultaneously when you are comparing KVM to Linux to argue that the security basis is the important factor, I get to as well. Except mine is actually more fair because the design of a seL4-based system is actually much more simila…

Amusingly, this is the 2nd time you've tried to argue with me about this Theo post. Last time, you yourself brought it up as a model of a good security argument.

https://news.ycombinator.com/item?id=41071954

Rather than replicating my response then, I'll just incorporate that link into my point.

I ported L4 to my ARM NUC a couple weeks ago. L4 is great. Of course, L4 is also principally a platform for virtualization, so it's a pretty odd bit of evidence to try to bring up. Where have you personally been using L4?

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#83

Post by Veserv »

tptacek wrote: post #82
Veserv wrote: post #81

Earlier quoted context omitted.

Cool, show me a LPE in a seL4 deployment. Do you believe that is easier or harder than finding a KVM escape? Since you are varying the security basis, implementation, and operational model simultaneously when you are comparing KVM to Linux to argue that the security basis is the important factor, I get to as well. Except mine is actually more fair because the design of a seL4-based system is actually much more simila…

Amusingly, this is the 2nd time you've tried to argue with me about this Theo post. Last time, you yourself brought it up as a model of a good security argument. https://news.ycombinator.com/item?id=41071954 Rather than replicating my response then, I'll just incorporate that link into my point. I ported L4 to my ARM NUC a couple weeks ago. L4 is great. Of course, L4 is also principally a platform for virtualization,…

Yes, you do enjoy evading the argument. You continuously point at implementation and operational model differences as proof that virtualization is the key factor. Theo's argument is literally that virtualization versus non-virtualization is irrelevant compared to implementation and operational model deficiencys. If you make garbage implementations and operational models, then you get garbage virtualization. If you have a good implementation and operational model then you do not need virtualization for "security".

As independent evidence for this point, virtualization is not the basis of security/isolation in seL4. You have isolation without any virtual machines. Virtual machines are just a feature on top that can leverage the existing isolation functionality to also provide isolated virtual machines. Of course, a secure deployment then requires you to leverage this foundation with a good operational model and system design since you can always make a insecure system even atop a good foundation. This demonstrates that virtualization is not necessary for a secure base, nor sufficient to achieve highly secure systems.

Just to hammer in the point that you are heavily misinterpreting Theo's response, this is the full sentence at the start of the post that Theo was responding to:

"Virtualization seems to have a lot of security benefits. Rootkits can lie to DomU but not Dom0, and of course snapshotting, migration etc is really nice."

Wow, amazing, rootkits can never be in Dom0 because Xen has "virtualization" magic pixie dust. Theo is pointing out how this is nonsense and virtualization will only provide security if you can create implementations without glaring security holes. Furthermore, you should not just listen to the people who brought you insecure system 1 when they tell you that this time for sure they are going to give you secure system 2; maybe have just a little bit of cynicism and ask for some evidence first.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#84

Post by sellmesoap »

znpy wrote: post #35
mmh0000 wrote: post #30

Earlier quoted context omitted.

Ha! That’s some rose-colored-glasses view of BSD history. The lawsuit didn’t help. But the BSD developers shot themselves in the foot when they refused to support x86, referring to it as a “toy”. It wasn't until Linux came along and started eating up all of BSD's user base that they freaked out and decided x86 support might be a good idea. But by then it was too late.

I go back to take a look at the BSDs every now and then and frankly it really looks like that mindset has stayed, somehow. Generally speaking the BSDs seems really fork-a-phobic and it kinda shows given how little dynamism is there in the development those systems. Even the Solaris derivatives have a faster tempo.

GhostBSD DragonflyBSD pf/opn sense even funky hybrid stuff like Chimera Linux, out of curiosity I had a quick search and the list goes on https://github.com/DiscoverBSD/awesome-bsd

Linux has a lot of corporate sponsorship and its own legal hurdles of the past (SCO le sigh.)

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#85

Post by 10000truths »

Veserv wrote: post #72
tptacek wrote: post #13

One of his dumber takes. Virtualization replaces an ultra-functional general-purpose kernel evolved over decades to support every conceivable application with a drastically smaller "kernel" (KVM and the userland hypervisor). It's a drastic attack surface reduction, and the empirical data bears that out: kernel LPEs aren't even newsworthy (there's whole repos full of unnamed, unremarked-upon LPEs), and KVM escapes are…

Virtualization is responsible for effectively none of those security benefits. It is the reduction to a smaller “kernel” that is responsible. If you applied the same design and operational model to running regular old processes instead of virtual machines you would also get a system with less security holes than the grossly insecure rat’s nest that is Linux, Windows, or whatever other commercial IT OS you have in min…

While this is true, the unspoken factor here is compatibility. Fixing the design and operational model of Linux (or any Unix derivative) to a sensible default-nothing architecture requires completely changing the semantics of the OS, which would break so much existing software to the point that one might as well write a new kernel+userspace from scratch. It's a lot easier for a sysadmin to just plop their existing rat's nest in a hardware-accelerated parallel universe and say "job done".

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#86

Post by tptacek »

Veserv wrote: post #83
tptacek wrote: post #82

Earlier quoted context omitted.

Amusingly, this is the 2nd time you've tried to argue with me about this Theo post. Last time, you yourself brought it up as a model of a good security argument. https://news.ycombinator.com/item?id=41071954 Rather than replicating my response then, I'll just incorporate that link into my point. I ported L4 to my ARM NUC a couple weeks ago. L4 is great. Of course, L4 is also principally a platform for virtualization,…

Yes, you do enjoy evading the argument. You continuously point at implementation and operational model differences as proof that virtualization is the key factor. Theo's argument is literally that virtualization versus non-virtualization is irrelevant compared to implementation and operational model deficiencys. If you make garbage implementations and operational models, then you get garbage virtualization. If you ha…

You keep mentioning seL4. I'm curious what work you've done with it. (I've done a bunch of L4 work.)

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#87

Post by Veserv »

10000truths wrote: post #85
Veserv wrote: post #72

Earlier quoted context omitted.

Virtualization is responsible for effectively none of those security benefits. It is the reduction to a smaller “kernel” that is responsible. If you applied the same design and operational model to running regular old processes instead of virtual machines you would also get a system with less security holes than the grossly insecure rat’s nest that is Linux, Windows, or whatever other commercial IT OS you have in min…

While this is true, the unspoken factor here is compatibility. Fixing the design and operational model of Linux (or any Unix derivative) to a sensible default-nothing architecture requires completely changing the semantics of the OS, which would break so much existing software to the point that one might as well write a new kernel+userspace from scratch. It's a lot easier for a sysadmin to just plop their existing ra…

Sure, this is why virtualization is a valuable feature, it is just not the basis of security/isolation.

One of the points I am making is that when deploying on a modern multi-tenant VM-based platform, VM orchestration is analogous to process orchestration. However, you orchestrate the units, VMs, in a very different way to how you would orchestrate processes on say Linux. If your platform orchestrates, configures, and operates processes the same way a VM-based platform orchestrates, configures, and operates VMs and your implementation is solid then you would see similar security benefits. Virtualization is not the key. It just kind of looks that way because virtualization is usually paired with a fundamental re-architecture.

In greenfield application development or cases where you would do single-application VMs, you would target processes/platform directly. Only in situations where you are literally lifting code from a different OS environment that you can not or will not port to the native model would you need to go through a VM. If you orchestrate them the same way and your operational models for them are similar, then you will usually see similar outcomes. This is how it works in high security microkernels/separation kernels which simultaneously allow native processes alongside VMs. Virtualization is a feature to allow non-porting, it is not security/isolation; that is already provided underneath.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#89

Post by newsomix9xl »

otterley wrote: post #50
tptacek wrote: post #27

Earlier quoted context omitted.

Sure, I mean, he was wrong, and I assume he knows he's wrong, and wouldn't say the same thing today. He's not dumb. Just this take is.

I’ll take someone who’s dumb over someone who is smart but rudely and confidently incorrect any day. Modesty, thoughtfulness, and kindness are too-undervalued virtues in our business.

I would still prefer the opinions of smart rude people over not, but agreed about modesty, thoughtfulness, and kindness.

And even smart people can be wrong. Sometimes a lot.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#90

Post by antod »

brynet wrote: post #54
jurgenaut23 wrote: post #49

god bless usenet. The good ol' flame wars aren't what they are used to anymore with all this moderation and trolling feeding each other around here.

This is not usenet, it's the openbsd misc@ mailing list.

Maybe they mixed up usenet by doing what I used to do back then - use gmane so I could follow various mailing lists via NNTP for better thread tracking and not filling up my inbox.
Post reply on HN