8 ms·
No, nobody should give Linus any slack whatsoever. He's responsible for the current fiasco, where stock Linux kernel is a joke security-wise, one can find relia
by armitron 11y ago
No, nobody should give Linus any slack whatsoever.
He's responsible for the current fiasco, where stock Linux kernel is a joke security-wise, one can find reliable vulnerabilities in a few hours, once the debugging infrastructure is there. Compare that with Windows where it's a few weeks to a few months and then a lot more work to get the reliability.
Linus holds the vast majority of the blame here, simply put, he is an idiot when it comes to security or looking ahead at how things will be in a couple of years. Linux is slowly entering every single aspect of our lives and this trend will only accelerate via IoT. Imagine what this means about security with Linus in charge.
We now KNOW that there are intelligent adversaries out there that spend hundreds of millions to defeat security worldwide.
It is simply UNACCEPTABLE and downright MALICIOUS STUPIDITY for Linus to hold the views he does in this day and age.
He's been repeatedly warned and cautioned for more than a DECADE now and he's laughed at and ignored valid criticisms from people with much more foresight than him. If this trend continues, he should be NAILED to the cross.
A security bug is NOT just a bug.
No, I shouldn't have to DISCONNECT everything that runs Linux from the Internet if I want it to have a modicum of security.
- infinity0 11y ago> Linux kernel is a joke security-wise, one can find reliable vulnerabilities in a few hours Do you have some details on this? I did not realise the situation was so bad.
- deleted 11y ago[deleted]
- nickpsecurity 11y agoI'm not sure objectively what the current state is. However, it's a little known fact that Linux kernel specifically (due to fame) benefits from tons of academic work on bug hunting tools. Every time they run a new one, they find all kinds of problems that are preventable with a safer language or sound architecture. Many of them would've been contained in a microkernel architecture rather than have full access to memory. So, one could say it's pretty bad even if the "many eyes" and code audits are finding/fixing a ton. Simply too many to justify if their process is any good. An recent example I found was the Saturn project throwing an automated tool at it and finding 100+ real bugs in one go. http://saturn.stanford.edu/pages/papersindex.html http://saturn.stanford.edu/pages/papersindex.html
- 72deluxe 11y agoI am unaware of the security warnings etc. against Linus and Linux in general as I am a bit out of touch with Linux, having moved to OSX a few years back. Do you have recommended reading or links so that I can get up to speed?
- armitron 11y agoDid you read the linked article? Grsecurity people, gentoo security people and other security insiders have been urging Linus and other maintainers to change their views for decades. Nothing has happened except plenty of hand waving and ridicule. Visit the grsecurity forums, the IRC channel for more details. Here is a recent example where PaX team are called "leeches" by a maintainer: http://lists.infradead.org/pipermail/linux-arm-kernel/2015-August/366632.html http://lists.infradead.org/pipermail/linux-arm-kernel/2015-A... If this sort of attitude is not stupid, I don't know what is. These people can't see the forest from the trees.
- 72deluxe 11y agoAh more reading required. Thanks!
- muraiki 11y agoI think that your tone will turn a lot of people off, which is why you've been downvoted (by others), but I think that what you said needs to be heard, especially re: IoT. It's a nightmare waiting to happen.