18 ms·

Linus Torvalds Talks Linux Security at LinuxCon

137 points by kercker 11y ago

Gravityloss 11y ago
(by the way the article is dated August 2015) I love the tone here. Not promising the moon. Everybody knows there will be bugs. In general it's just that dance that you have to do around that, that you can't admit it. Same about planning ten years to the future. Maybe you could give scenarios. I guess he's expecting quite a lot from the audience.
- deleted 11y ago
  [deleted]
teamhappy 11y ago
Here's the video: https://www.youtube.com/watch?v=5xKXHavHJ7U https://www.youtube.com/watch?v=5xKXHavHJ7U
mtgx 11y ago
Let me guess: "I could care less about it". Did I summarize it well? You know when you see Linus piss on security so easily, you start to wonder - maybe that joke about allowing the NSA backdoor in the kernel was actually true?
- 5h 11y ago
  > Let me guess: "I could care less about it". Did you mean "couldn't care less"? > Did I summarize it well? no > You know when you see Linus piss on security so easily, you start to wonder - maybe that joke about allowing the NSA backdoor in the kernel was actually true? Are you referring to the article you didn't read here? Actual takeaway: > "The only real solution to security is to admit that bugs happen," Torvalds said, "and then mitigate them by having multiple layers, so if you have a hole in one component, the next layer will catch the issue."
- 59nadir 11y ago
  Perhaps, since he tends to be on the logical side of things, his version of that would be "I couldn't care less about it." That's so obviously not what he's saying, though, but rather that it's never something you can "win" and that you just have to be rigorous in how you mitigate it.
- Gravityloss 11y ago
  You might be correct, although accidentally. He cares.
  - ckozlowski 11y ago
    I think this video is appropriate here: David Mitchell https://www.youtube.com/watch?v=om7O0MFkmpw https://www.youtube.com/watch?v=om7O0MFkmpw
- anon4 11y ago
  >could care less I literally wish I could downvote you a million times
  - ta0967 11y ago
    so many downvote's...
- dang 11y ago
  Please stop posting unsubstantive comments to Hacker News.
mrweasel 11y ago
>Most of the security issues we've had in the kernel have been just completely stupid bugs... Wouldn't that be an argument to be more stringent in reviewing and auditing the kernel code? I don't know to which extend they already do audits, but if you find a bug of a certain type, maybe consider combing the tree for other instances of that type of bug. I believe that's the approach OpenBSD has taken.
- RexRollman 11y ago
  Yeah, but then they would be masturbating monkeys too.
- aidenn0 11y ago
  My very first mentor responded to me calling something "just a stupid bug" by saying "Almost all bugs are stupid." His point was that even the most talented programmers will make stupid mistakes and stupid bugs are capable of passing through large levels of code review. Things like inverting the logic in one case of a complex conditional, or copy paste bugs like: z1 = x1 + y1; z2 = x2 + y2; z3 = x3 + y1; Are very hard to see. We have lint tools to catch a lot of them (e.g. a single '=' in a conditional), but at some point the tool lacks sufficient semantic understanding to catch everything.
  - neppo 11y ago
    That's a very common error and is called the last line effect: http://www.viva64.com/en/b/0260/#ID0E5HAE http://www.viva64.com/en/b/0260/#ID0E5HAE
sanswork 11y ago
Has Linus commented on ESRs claims about honeypots. I want to say 'ESR is a nutter' as I always do when I see his name. But I kinda want to see Linus to say it too.
- mrweasel 11y ago
  Because I'm curious: What honeypots?
  - baldfat 11y ago
    http://lmgtfy.com/?q=honeypots# http://lmgtfy.com/?q=honeypots# In computer terminology, a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems.
    - mrweasel 11y ago
      That really don't answer the question does it? ESR made some claim regarding honeypots apparently, what I wanted to know is which honeypots he's talking about.
      - sanswork 11y ago
        ESR is (in my opinion) insanely claiming that there is a conspiracy amongst women in OS to catch popular male developers in honeypots. He also claimed Linus was aware of the attempts and taking defensive measures. I kinda regret giving it attention but at the same time I wanted Linus to say it was insane to shut up all the really horrible people rallying behind ESR on it making it even more difficult for women in OS.
        reitanqild 11y ago
        > making it even more difficult for women in OS. A good start here might be to admit that some people who claim to support women in tech are actually making it harder for women in tech.
ak217 11y ago
Related to the recent interview notes by Brad Spender: https://grsecurity.net/~spender/interview_notes.txt https://grsecurity.net/~spender/interview_notes.txt IMO it's scary to hear Linus say that "security is just stupid bugs" and that he doesn't think about containers much (container/namespace security and functionality is a big and quickly emerging part of the kernel security landscape). Call it a lack of vision or whatever, but I think he should be doing more to architect for security and to recruit, place and reward talented people into security lead positions in the kernel community.
- josh2600 11y ago
  Maybe I'm just naive, but I don't really understood the security narrative of containers or kernel namespacing. If you have a zero-day for a VM, you still have to deal with the supervisor OS even if you can get out of the VM but it's not clear to me that that's the case with kernel-side isolation. Am I missing something? I suppose you could implement a sub-kernel within the kernel, but then what's the point of using a container vs a VM? Yes containers are much lighter weight than a VM, but for most people's workloads (read: anyone not running giant Map Reduce jobs) does it really matter?
- jokoon 11y ago
  Maybe security is not something you can just solve so easily, even for a kernel developer, it requires a lot of efforts in many many areas. I don't think it's his job, and I don't think he could have a big effect on linux security. It's up to people writing software that use the kernel to have good security practices.
  - crpatino 11y ago
    We are in the mess we are today because everybody think "I don't think it's my job". I have seen programmers much technically stronger and experienced than I am, and more passionate that I am, turning into idiots when talking security. It is as if, because perfect security is unreachable for any practical criteria, they automatically think it's not worth it to think about at all. And it's really creepy to see someone in the league of Torvalds to express any feelings along those lines.
fulafel 11y ago
I propose a corollary to the "bugs are shallow" quote: "Given enough code output, all programmers are stupid"
deleted 11y ago
[deleted]
riskable 11y ago
Why do I keep seeing Heartbleed and Shellshock mentioned in articles specifically about Linux security? Those two vulnerabilities had nothing to do with Linux. Software using OpenSSL or bash on any platform were vulnerable. That includes Macs and Windows. Linux is extremely popular for servers and embedded systems where OpenSSL and bash are common but bringing them up every time "security + Linux" are discussed is a bit like talking about tires that blow out whenever the topic of logistics comes up.
- mhurron 11y ago
  > Why do I keep seeing Heartbleed and Shellshock mentioned in articles specifically about Linux security? Because they're big, popular, well known names that effect software that typically runs on Linux systems so everyone goes "mm yep, that was a big Linux issue.' The Linux kernel has issues, but you're not making your case that Linus doesn't take things seriously when your examples have nothing to do with Linus' work.
- RexRollman 11y ago
  For the same reason you see X and Vim being referred to as Linux software.
- UnoriginalGuy 11y ago
  So by that logic, it is unfair to criticise flash and or Java as Windows security issues? It seems like Linux people want to shift the definition of "Linux" between only the kernel and the entire OS when it is convenient. In this case we're shifting down the definition to "kernel only" so we can avoid talking about Linux (the OS's) potential security issues. Heartbleed and Shellshock are Linux (OS) issues. Just because that same software may ship on BSD and OS X is entirely irrelevant. Linux was still by far the largest target (just like Windows is the largest target of cross-platform Java vulnerabilities). Linux as a kernel is pretty freaking secure. Linux as an OS has a lot of issues, and many (most?) popular distributions are a large part of why (e.g. SELinux is often disabled by default and a lot of packages are incompatible, a lot of services run as root by default, a lot of packages are installed by default (not the minimum), etc).

137 points by kercker 11y ago

(by the way the article is dated August 2015) I love the tone here. Not promising the moon. Everybody knows there will be bugs. In general it's just that dance that you have to do around that, that you can't admit it. Same about planning ten years to the future. Maybe you could give scenarios. I guess he's expecting quite a lot from the audience.

deleted 11y ago
[deleted]

teamhappy 11y ago

Here's the video: https://www.youtube.com/watch?v=5xKXHavHJ7U https://www.youtube.com/watch?v=5xKXHavHJ7U

mtgx 11y ago

Let me guess: "I could care less about it". Did I summarize it well? You know when you see Linus piss on security so easily, you start to wonder - maybe that joke about allowing the NSA backdoor in the kernel was actually true?

5h 11y ago
> Let me guess: "I could care less about it". Did you mean "couldn't care less"? > Did I summarize it well? no > You know when you see Linus piss on security so easily, you start to wonder - maybe that joke about allowing the NSA backdoor in the kernel was actually true? Are you referring to the article you didn't read here? Actual takeaway: > "The only real solution to security is to admit that bugs happen," Torvalds said, "and then mitigate them by having multiple layers, so if you have a hole in one component, the next layer will catch the issue."
59nadir 11y ago
Perhaps, since he tends to be on the logical side of things, his version of that would be "I couldn't care less about it." That's so obviously not what he's saying, though, but rather that it's never something you can "win" and that you just have to be rigorous in how you mitigate it.
Gravityloss 11y ago
You might be correct, although accidentally. He cares.
- ckozlowski 11y ago
  I think this video is appropriate here: David Mitchell https://www.youtube.com/watch?v=om7O0MFkmpw https://www.youtube.com/watch?v=om7O0MFkmpw
anon4 11y ago
>could care less I literally wish I could downvote you a million times
- ta0967 11y ago
  so many downvote's...
dang 11y ago
Please stop posting unsubstantive comments to Hacker News.

mrweasel 11y ago

>Most of the security issues we've had in the kernel have been just completely stupid bugs... Wouldn't that be an argument to be more stringent in reviewing and auditing the kernel code? I don't know to which extend they already do audits, but if you find a bug of a certain type, maybe consider combing the tree for other instances of that type of bug. I believe that's the approach OpenBSD has taken.

RexRollman 11y ago
Yeah, but then they would be masturbating monkeys too.
aidenn0 11y ago
My very first mentor responded to me calling something "just a stupid bug" by saying "Almost all bugs are stupid." His point was that even the most talented programmers will make stupid mistakes and stupid bugs are capable of passing through large levels of code review. Things like inverting the logic in one case of a complex conditional, or copy paste bugs like: z1 = x1 + y1; z2 = x2 + y2; z3 = x3 + y1; Are very hard to see. We have lint tools to catch a lot of them (e.g. a single '=' in a conditional), but at some point the tool lacks sufficient semantic understanding to catch everything.
- neppo 11y ago
  That's a very common error and is called the last line effect: http://www.viva64.com/en/b/0260/#ID0E5HAE http://www.viva64.com/en/b/0260/#ID0E5HAE

sanswork 11y ago

Has Linus commented on ESRs claims about honeypots. I want to say 'ESR is a nutter' as I always do when I see his name. But I kinda want to see Linus to say it too.

mrweasel 11y ago
Because I'm curious: What honeypots?
- baldfat 11y ago
  http://lmgtfy.com/?q=honeypots# http://lmgtfy.com/?q=honeypots# In computer terminology, a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems.
  - mrweasel 11y ago
    That really don't answer the question does it? ESR made some claim regarding honeypots apparently, what I wanted to know is which honeypots he's talking about.
    - sanswork 11y ago
      ESR is (in my opinion) insanely claiming that there is a conspiracy amongst women in OS to catch popular male developers in honeypots. He also claimed Linus was aware of the attempts and taking defensive measures. I kinda regret giving it attention but at the same time I wanted Linus to say it was insane to shut up all the really horrible people rallying behind ESR on it making it even more difficult for women in OS.
      - reitanqild 11y ago
        > making it even more difficult for women in OS. A good start here might be to admit that some people who claim to support women in tech are actually making it harder for women in tech.

ak217 11y ago

Related to the recent interview notes by Brad Spender: https://grsecurity.net/~spender/interview_notes.txt https://grsecurity.net/~spender/interview_notes.txt IMO it's scary to hear Linus say that "security is just stupid bugs" and that he doesn't think about containers much (container/namespace security and functionality is a big and quickly emerging part of the kernel security landscape). Call it a lack of vision or whatever, but I think he should be doing more to architect for security and to recruit, place and reward talented people into security lead positions in the kernel community.

josh2600 11y ago
Maybe I'm just naive, but I don't really understood the security narrative of containers or kernel namespacing. If you have a zero-day for a VM, you still have to deal with the supervisor OS even if you can get out of the VM but it's not clear to me that that's the case with kernel-side isolation. Am I missing something? I suppose you could implement a sub-kernel within the kernel, but then what's the point of using a container vs a VM? Yes containers are much lighter weight than a VM, but for most people's workloads (read: anyone not running giant Map Reduce jobs) does it really matter?
jokoon 11y ago
Maybe security is not something you can just solve so easily, even for a kernel developer, it requires a lot of efforts in many many areas. I don't think it's his job, and I don't think he could have a big effect on linux security. It's up to people writing software that use the kernel to have good security practices.
- crpatino 11y ago
  We are in the mess we are today because everybody think "I don't think it's my job". I have seen programmers much technically stronger and experienced than I am, and more passionate that I am, turning into idiots when talking security. It is as if, because perfect security is unreachable for any practical criteria, they automatically think it's not worth it to think about at all. And it's really creepy to see someone in the league of Torvalds to express any feelings along those lines.

fulafel 11y ago

I propose a corollary to the "bugs are shallow" quote: "Given enough code output, all programmers are stupid"

deleted 11y ago

[deleted]

riskable 11y ago

Why do I keep seeing Heartbleed and Shellshock mentioned in articles specifically about Linux security? Those two vulnerabilities had nothing to do with Linux. Software using OpenSSL or bash on any platform were vulnerable. That includes Macs and Windows. Linux is extremely popular for servers and embedded systems where OpenSSL and bash are common but bringing them up every time "security + Linux" are discussed is a bit like talking about tires that blow out whenever the topic of logistics comes up.

mhurron 11y ago
> Why do I keep seeing Heartbleed and Shellshock mentioned in articles specifically about Linux security? Because they're big, popular, well known names that effect software that typically runs on Linux systems so everyone goes "mm yep, that was a big Linux issue.' The Linux kernel has issues, but you're not making your case that Linus doesn't take things seriously when your examples have nothing to do with Linus' work.
RexRollman 11y ago
For the same reason you see X and Vim being referred to as Linux software.
UnoriginalGuy 11y ago
So by that logic, it is unfair to criticise flash and or Java as Windows security issues? It seems like Linux people want to shift the definition of "Linux" between only the kernel and the entire OS when it is convenient. In this case we're shifting down the definition to "kernel only" so we can avoid talking about Linux (the OS's) potential security issues. Heartbleed and Shellshock are Linux (OS) issues. Just because that same software may ship on BSD and OS X is entirely irrelevant. Linux was still by far the largest target (just like Windows is the largest target of cross-platform Java vulnerabilities). Linux as a kernel is pretty freaking secure. Linux as an OS has a lot of issues, and many (most?) popular distributions are a large part of why (e.g. SELinux is often disabled by default and a lot of packages are incompatible, a lot of services run as root by default, a lot of packages are installed by default (not the minimum), etc).