18 ms·

Linus: Don't bother with grsecurity. Their patches are pure garbage

146 points by enedil 9y ago

a2tech 9y ago
Strong words. Usually when Linus ways in so strongly on a topic he's pretty certain of his take on it-it'll be interesting to see if there's further discussion on both ends.
- bitmapbrother 9y ago
  >How could they know that calling people clowns and their work garbage wasn't payment enough? >With no technical content coming from your end, there's no need to discuss anything further -- don't waste your time because I won't reply. I don't think there will be any further discussion.
- deleted 9y ago
  [deleted]
dkarapetyan 9y ago
Linus has cried wolf too many times. His outbursts about garbage patches are no longer believable.
- _e 9y ago
  Can you point to specific times? I want to dig into this more.
  - dkarapetyan 9y ago
    Google Linus rant. There are many examples.
    - cyphar 9y ago
      Crying wolf requires him to have been wrong (or lied). I think that GP was asking you for evidence of _that_, not of evidence that Linus has ranted in the past. From memory, I can't recall a time where his ranting was not justified, but he has been wrong a couple of times. Unless I'm missing something blatant, that doesn't constitute "crying wolf" to me.
      - dkarapetyan 9y ago
        The parable of the boy crying wolf is not about lies but about desensitizing your audience to what you are saying. I've read enough of the rants to know there is very little signal to all the noise he makes. The grsecurity stuff could be bad but I sure as hell am not gonna get my analysis from Linus. If he acted more like a grown up then maybe but he doesn't. He character assassinates and then says you are doing silly pointer arithmetic. Can just mention the pointer stuff without shouting and screaming at author of the patch. The drama in kernel dev is a direct result of his abrasive approach. He screams and shouts so grsecurity screams and shouts. Everyone else loses. The kernel dev space needs less drama and more grown ups.
        cyphar 9y ago
        > The parable of the boy crying wolf is not about lies but about desensitizing your audience to what you are saying. ... Because the little boy was lying. If there really was a wolf every time he said there was they would consider him a brilliant scout rather than an untrustworthy source of information. It's strange that it's necessary to explain children's parables on HN. > The kernel dev space needs less drama and more grown ups. I don't disagree with that, I just don't agree with saying that Linus is crying wolf. Because you don't appear to understand what it means.
        deleted 9y ago
        [deleted]
    - abritinthebay 9y ago
      A rant is different to "crying wolf". Be specific.
    - djrogers 9y ago
      The term “Crying Wolf” implies the very specific and extreme accusation of lying. Ranting, or even ranting then reversing course are very different from lying. Words have meaning, be careful how you use them.
      - dkarapetyan 9y ago
        Words have meaning? ffs. Was there a shitpost memo sent out I didn't get. thx cpt obvious
doe88 9y ago
For all his unfortunate abrasiveness one strength of Linus is and has always been his capacity to see the big picture, e.g. that usually compatibility/API,ABI stability/performances trumps extreme security measures and also he has always been able to accomodate with big players/corps in the industry.
- ajarmst 9y ago
  I kind of find Linus refreshing, although I'm not sure that would survive working directly with him. I think you're begging the question though: surely compatibility/ABI stability/performance trumps extreme security (for some values of 'extreme') for people and in cases where that is true. I happen to agree with you and Linus on this (baring a known exploit of an unpatched security bug), but that heirarchy is nowhere engraven in stone. If I always recompiled a critical codebase, I wouldn't care as much about ABI compatibility. If I'm always targetting a very specific platform, I don't care about compatibility. If I'm sitting on millions of unused cycles in a single-threaded realtime environment, I only care about performance to a certain point. If I'm working on software to control a medical device or nuclear reactor, my priorites around extreme security change. You're right about that priority for the vast majority of the Linux user-base, but that's a characteristic of those users and developers, not of kernel software in general.
  - KGIII 9y ago
    I have never even tried to read the kernel source, but I read the mailing lists - quite frequently. Linus runs a tight ship. It is funniest when someone does something that will break userspace. He sets high standards. Meet them. I don't believe any forks have really done well. His method works, as abrasive as it may appear.
  - vacri 9y ago
    I've always found it weird that de Raadt is admired for being abrasive, and Torvalds is pilloried. I've always wondered, if the grsec people are such believers of 'security above all else', why they just don't work with OpenBSD instead.
topkeker 9y ago
Grsecurity wouldn't exist if Linux made security a priority. It doesn't, because backwards compatibility and features is more important to them. It doesn't mean because Linus says something so strongly on a subject is right or wrong, he is generally abusive and rants and has for years. Grsecurity is important to some people, not all, and vice versa for the features and backwards compatibility crowd. Personally I'd hope someone in Linus position would see both sides of the fence, but he doesn't and always has some mouthy outrageous opinion. So this is zero surprise.
- taeric 9y ago
  To be even weakly fair, access is a component of security. If their patches break software, they would be breaking someone's security. That is, backwards compatibility deserves that high bar. Ideally, you could get security without breaking things. If you can't, at least use care and take incremental steps to get things in.
- hacknat 9y ago
  And without backwards compatibility you would have never heard of Linux.
  - geofft 9y ago
    That's a very strong claim. Some evidence in favor is that, at least in the early days of Linux, Microsoft took the same strategy of prioritizing backwards compatibility over security - and reaped the rewards by becoming extremely popular and extremely full of security holes. So clearly the strategy worked for MS. On the other hand, MS did respond and prioritize security, and was able to pull it off without compromising backwards compatibility too much. (For instance, last week's stack-clash vulnerability straight up doesn't exist on Windows because MSVC and the NT kernel have been doing the right thing with stack probes for years.) But some real evidence against is that this whole backwards-compatibility thing is a kernel policy, not a userspace policy; no distro cares nearly as much. With the a.out to ELF transition and libc5 to libc6 transition back in the day, and to this day with OpenSSL versions, the GCC 5 libstdc++ ABI change, etc., there's not a ton of backwards compatibility in what binaries you can actually run on a real-world Linux system. It seems hard to believe that the kernel-to-userspace compatibility story is what made Linux popular, given the vast amount of userspace-to-other-userspace incompatibility.
ivanbakel 9y ago
It's a struggle to respect the security opinions of someone who has actively admitted that he thinks "[security] bugs are just bugs". [0] Personally, I find it quite hard to respect Linus generally - his offensive personality is clearly not something that would be appropriate coming from anyone else in any community, but for some reason he gets a free ride for being a difficult genius. 0. http://www.washingtonpost.com/sf/business/2015/11/05/net-of-insecurity-the-kernel-of-the-argument/ http://www.washingtonpost.com/sf/business/2015/11/05/net-of-... N.B. The article is a bit deep in technical inaccuracies - it calls Linux an OS, for example.
- ajarmst 9y ago
  Nooooooo! Now we have to listen to the "what is an OS?" semantic flamewar!
  - mercymichael 9y ago
    hi my girlfriend and I been dating for about 8 to 10 months and we live together for about 4 months we recently broke uo because I was being selfish wanted to control her didn’t appreciate her didn’t show much affection but I really do love her fought a lot and I was stuck I was hurt I had to go home every night knowing shes in the other room sleeping without a care in the world I hate it I begged her back open my heart to her and nothing all she kept saying is I love you but I don’t want to be with you I have another man in my life now, I talked with the popular Dr. Akin and he prayed for my relationship and I got her back in two days. If you are hurt in your relationship,get in touch with him(prayerstosavemarriage@hotmail.com)cos I promised him I will talk about him on the internet,and now we plan of getting married next month :)
- pyroinferno 9y ago
  >For Linux, the operating system that Torvalds created Stopped reading right there. First of all, Linux is not an operating unto itself, but rather another free component of a fully functioning GNU system made useful by the GNU corelibs, shell utilities and vital system components comprising a full OS. Because of that, the Operating System is not Linux, but rather GNU/Linux (or GNU + Linux which I recently have been calling it).
peterwwillis 9y ago
This is just celebrity gossip/hype/flaming. Nothing new, interesting, or intellectually curious here.
- CalChris 9y ago
  I have to agree with this given the post. If Linus had a concrete example rather than just his sweeping condemnation, it would be different.
  - moxious 9y ago
    If there had been concrete examples and such, rational argument (hopefully) would have ensued, and HN would not have been notified about a completely normal engineering discussion down in the weeds. But seeing condemnation and drama works better for post material I suppose.
rhblake 9y ago
See Linus' follow-up http://seclists.org/oss-sec/2017/q2/596 http://seclists.org/oss-sec/2017/q2/596 for clarification: > They aren't split up, there has never been any effort by you to make them palatable to upstream, and when somebody else dioes try to make them palatable to upstream, you start crying about how people are taking advantage of your work (hah), and try to make them private instead. ... > It's literally less work for people to re-implement things than look at your mixed-up patches, and YOU SEEM TO BE DOING THAT ON PURPOSE. > Now, prove me wrong. Start trying to integrate your work upstream, and send individual patches with commit logs that can be integrated.
- uhhfcuvv 9y ago
  And the other guy's reply: http://seclists.org/oss-sec/2017/q2/597 http://seclists.org/oss-sec/2017/q2/597
  - microcolonel 9y ago
    > Just like you spend your time focusing on versions of Linux nobody actually uses (they use stable kernels or distro kernels) but which benefits your corporate sponsors and maintains the churn you want to force everyone to contribute to. The days of Linux being a community project are long gone, it's a fairy tale at this point. Clearly a load of crap. I think they should quit being spicy and think about what they should be doing instead.
  - moxious 9y ago
    "Days of our lives" Linux kernel edition. Do many people have a taste for kernel drama and Linus antics? I mostly just want the software.
    - btian 9y ago
      Then write your own? Why bother commenting here.
    - benchaney 9y ago
      Then just use the software. You get the same version whether you read lkml or not.
ajdlinux 9y ago
The grsecurity team does have some valid criticisms of the upstream community, and of course they've done some brilliant technical work, but spender is unfortunately a pretty toxic community member who puts many upstream kernel devs to shame when it comes to ability to flame. It's a shame - there's a lot of good stuff in grsec/PaX, but I think the upstream community is better off without the people involved. The KSPP effort to upstream grsec/PaX features is, of course, a good thing. [disclaimer: upstream developer who lurks on kernel-hardening]
- technion 9y ago
  Similarly, I used to run grsec on RedHat once upon a time. But the whole thing just got too hard. When a critical update came, I could get a stock kernel running "yum update", or I could play around building a whole new grsec kernel. I wish there was a way to take personalities out of this and let mainline merge the useful parts of grsec.
- OJFord 9y ago
  Your bio isn't a disclaimer.
windows_lover 9y ago
Linus, and this stubborn attitude of his, is the reason that Linux will always lag behind Windows in kernel security. With the vast security improvements Microsoft are putting into their operating system year on year, it's a shame to see Linux failing to keep up.
- motoboi 9y ago
  I'm upcoming you for good comedy.
- chronoGloat 9y ago
  Bleh. There are enough NSA backdoors in implanted within Windows to the point that any sane person regards Microsoft security as pure theater. Secrets aren't actually secrets in Windows at all.
  - deleted 9y ago
    [deleted]
  - windows_lover 9y ago
    Now that's just silliness. I invite you to provide solid technical evidence of these supposed "NSA backdoors" in Windows.
- tbodt 9y ago
  With a username of "windows_lover", what can I say?
- whoami_nr 9y ago
  >Linux will always lag behind Windows in kernel security Are you serious about that statement ?
  - snuxoll 9y ago
    I'm not going to agree or disagree on this, but Microsoft's choice to shove all syscalls into a DLL where a defined ABI is easier to maintain certainly makes dramatic security improvements to the kernel easier without breaking userspace.
chrissnell 9y ago
I'm an Arch user and I have no idea what's going on with security-focused kernels these days. I was running the grsecurity kernel package but that was recently replaced by a "linux-hardened" package that I had never heard of. Then, a pacman update tonight installed a plain Linux kernel. It's very confusing. Not unexpected for Arch but there is so little on the wiki about this.
- cyphar 9y ago
  The grsecurity patches have been made private. Although they are under the GPL (because they are a derivative work of the Linux kernel), the company that produces grsecurity engages in the unethical (and potentially illegal) business practice of threatening to terminate customer subscriptions if they exercise their right to distribute the patches. In other words, no customer is going to distribute the patches because they will have wasted money and lost access to updates. This is very reminiscent of free speech chilling effects, and I'm surprised none of the copyright holders in Linux (myself included) have teamed up to sue them. Long story short, the general community (including distributions) no longer has access to new patches making grsecurity useless for the community.
  - snuxoll 9y ago
    > the company that produces grsecurity engages in the unethical (and potentially illegal) Unethical, probably - illegal, probably not. The GPL dictates what you can do once code hits your hands (or binaries compiled with), it doesn't prevent companies from selling it to you or what contract they do it under.
    - skymt 9y ago
      That depends on how you read section 6 of the GPL2. It states in part: > You may not impose any further restrictions on the recipients' exercise of the rights granted herein. The central right granted under the GPL is, of course, the right to modify and redistribute the source. I'm not a lawyer, and I'm certain that Grsecurity could find a number of legal arguments that what they're doing is allowed (likely starting with the claim that terminating a relationship with a customer isn't legally imposing a restriction on that customer's actions), but the idea that they're in violation of the GPL isn't pulled from thin air.
someonewhocar3s 9y ago
I'm going out on a limb here, and say grsecurity is probably more bad than it is good. Then again, I don't see Linus getting really hyped about making linux work less well.
known 9y ago
BSD is more liberal than GNU/Linus
- 43224gg252 9y ago
  Why do you think this? Because they let people fork the kernel, patch it, close the source, sell it, and never contribute anything back?
- KGIII 9y ago
  The BSD license protects different freedoms than the GPL. The GPL ensures the code is free, that it can never be taken away.
- flukus 9y ago
  It sounds like the GPL is the only reason these patches are available at all.
protomyth 9y ago
Reading one of the follow-up e-mail http://seclists.org/oss-sec/2017/q2/586 http://seclists.org/oss-sec/2017/q2/586 Wouldn't it be nice if you didn't demand free work of us in our free time? seems an odd line, but is there some context for the non-Linux person on what is going on?
- nisa 9y ago
  Don't count on this recount to be correct but as far I've followed it: 200x? - grsecurity patchset is introduced and fixes a lot of bug-classes (!) and introduces lot's of security improvements to the kernel that are ground breaking and find their way in other systems like *BSD / Windows 200x-201x - code and trademarks of grsecurity get ripped from embbedded vendors - Linux foundations does nothing because they don't pursue GPL violations - no intent from grsecurity to upstream their work - at least without getting paid for it. 2016-2017: - Linux foundation founds KSPP and works on integrating basically PaX/grsecurity into mainline - does not even ask grsecurity or PaX if they want to get paid for helping but they are flamed at and bothered with inquiries from devs - according to grsecurity most of KSPP work is copy&paste the grsecurity code without deeper understanding - introducing even new vulns - grsecurity only publishes patchset for current mainline kernel, no more long term releases 2017: - things are escalating, grsecurity patches go dark - lot's of rants and hate from all sites. now: - this mess. I can see the point from the grsecurity guys - they produced ground breaking research and it got ripped of everywhere and Linux foundation does not protect it's interests because the corporations don't want GPL enforcement (not related to the current dark patchset) and they don't even bother offering them money for the work to integrate this stuff. The bad mouthing from Linus is quite idiotic if you consider that most, if not all kernel vulns did not affect grsecurity in the past years. It's also true that the patchset breaks code depeding on the settings in plenty of ways. Add lot's of rants and flames, big ego, personal attacks from grsecurity to Linux devs and vice versa...not exactly professional. Not sure what was/is going on beyond that. At least that's some outsider Twitter/Mailinglist perspective. It's not black and white and IMHO Linux Foundation and KSPP have some explaining to do.
  - gizmo686 9y ago
    >they produced ground breaking research and it got ripped of everywhere. This is the part I don't get. They produced ground breaking research on a GPL platform, what did they expect to happen?
EGreg 9y ago
The man doesn't mince words
Aeolun 9y ago
So, just to confirm I see this correctly: Grsecurity creates patches for issues in upstream, but their patches are too fucking big/ugly, so nobody upstream really wants to merge them, and when someone tries to fix em (take the important bits out), grsecurity complains about them using their work. Grsecurity then say they don't feel like doing a lot of work on their patches when they're not paid to do it.
- simcop2387 9y ago
  Along with that Grsec then says that if while the patch is GPLv2 if you distribute them they'll never let you subscribe again to get the patch in the future.
  - clhodapp 9y ago
    That's a pretty interesting loophole in the GPL: apparently (at least with V2), it might be fine to impose consequences for exercising your rights while technically giving them to you. It certainly violates the spirit of the GPL even if it doesn't violate the letter.
    - AstralStorm 9y ago
      It does not impose amy restrictions on getting the code. You need to write a bot to get status updates though. Mailing list is not the code. If he starts filtering on the web server or rejecting direct source requests, he starts violating the letter of GPL 2.
      - clhodapp 9y ago
        I'm not sure that your claim about where the line is holds up: the GPLv2 never requires you to give your source to anyone unless you first give them binaries. That's why web sites don't have to give out their sources to everyone who visits their site if they use a GPL library for instance. In any case, if what you say is correct, the grsecurity team are still trying to hold the threat of a more annoying experience over their users in order up prevent them from exercising their rights under the GPLv2.
43224gg252 9y ago
The reddit thread is better: https://www.reddit.com/r/linux/comments/6j7saq/linus_torvalds_opinion_on_grsecurity/ https://www.reddit.com/r/linux/comments/6j7saq/linus_torvald...
- pawadu 9y ago
  I found the reddit thread much more interesting than the NH discussion...
madez 9y ago
A genuine question: Why isn't it perfectly reasonable to accept to break compatibility in order to increase security? Isn't that what we do in our lifes all the time? When the authorities issue new fire safety regulations for buildings, then that is breaking compatibility to the older building standard. We still do it because there is good reason. Sometimes even old buildings need to be retrofitted, and that is then what is done. I don't get Linus in this point, and suspect so far that he is wrong, or that I didn't get it yet.
- amluto 9y ago
  It is acceptable to break compatibility to fix a security problem, but it needs to be a minimal break. The problem with this particular issue is that it's breaking compatibility with major applications, which is no good.
- vacri 9y ago
  > When the authorities issue new fire safety regulations for buildings, then that is breaking compatibility to the older building standard. Do the old buildings automagically get updated to the new standard everyone is using? Does the city shut down every business in a building that doesn't match standard (= break software) until that building is retrofitted (which is time-consuming and costly)? That's what breaking backwards compatability does, it stops people from doing their thing until someone fixes it (sometimes it's on them, sometimes it's on you). And not everyone can afford a 'drop everything now to fix the issues brought up by the kernel release'. In any case, a good way to get people to not use your product is to keep breaking it. > Sometimes even old buildings need to be retrofitted, and that is then what is done. Is it? There was a very famous fire in London just a couple of weeks ago, of a building which wasn't up to standard, yet filled with people. Dozens of people died.
  - madez 9y ago
    The example of the recent fire in London strengthens my point. If we neglect security, then there is a price to pay for it. And now in London they do fix up buildings, because it's what makes sense. Linux including a breaking change to increase security does not stop any business. If you are not patched to the new version, don't upgrade. The breaking change could be announced well ahead, and people would have time to fix their stuff. That would be akin to the government releasing a new regulation but not forcing anybody to upgrade directly, but by offering tax relieve to anybody who did.
amluto 9y ago
Crikey! I seem to have set off this flame war, and I didn't even know about it until I saw it here.
yuhong 9y ago
So I wonder what happened in the end in the Wind River debacle.
dkarapetyan 9y ago
Guess you lack the level of abstraction capabilities I expect. Sure. The parable is just about lies and not signals and noises. All Linus rants are full of information. He is a brilliant programmer. Everything he screams and shouts about is always correct. He has never confused a raccoon with a wolf.
- cyphar 9y ago
  You're not using the term "crying wolf" correctly[1]. It has a very specific meaning in English, and that is what my complaint is in relation to. No amount of personal derision about how I "lack the level of abstraction capabilities" (whatever that means) will change that you are using the phrase incorrectly. I even specifically said that I agree that we need less difficult personalities in kernel development. It's quite ironic that you then followed up the way you did. [1]: https://en.m.wiktionary.org/wiki/cry_wolf https://en.m.wiktionary.org/wiki/cry_wolf
  - dkarapetyan 9y ago
    Let me break it down for you with all the necessary substitutions > (idiomatic) To raise a false alarm; to constantly warn others about an imagined threat, thereby failing to get assistance when a real threat appears. The imagined threat is the level of quality in patches. He consistently raises false alarms about the quality of patches. The false part being the absolute terms he uses about the character of the people that proposed the patches. Calling someone an infantile moron qualifies as falsehood in my book and counts as raising a false alarm. Now that he is complaining about grsecurity I'm not inclined to listen because the level of alarm he has used previously has been incommensurate with reality, as in he has said "here is a wolf" (this patch is the worst thing ever and the person that wrote it is a moron) when in reality there was no wolf (patch was actually fine and the person was not a moron). Less alarmism would have helped everyone involved get along better and make a more secure kernel. Instead I'm arguing about how comparing his alarmism to crying wolf is or isn't idiomatic. FML
    - qb45 9y ago
      > The imagined threat is the level of quality in patches. No, it often is a real threat. > The false part being the absolute terms he uses about the character of the people that proposed the patches. So feel free to disregard his opinions about the characters of other people, but don't be surprised that barely anyone treats you seriously when you suggest that the above somehow invalidates his technical analyses. > Now that he is complaining about grsecurity I'm not inclined to listen Which is fine because it's clearly not your job.
deleted 9y ago
[deleted]
bubblethink 9y ago
How are the Linux Foundation's funds allocated, and how much say does Linus have in it ? Most of this boils down to lack of money and attribution for grsec. Why didn't the Linux Foundation or Linus try to officially fund grsec to upstream their patches ? KSPP is still costing money. How much would it have cost to pay grsec directly instead ?
- dm319 9y ago
  As far as I understand that is the opposite of how it works. The linux foundation was set up to receive funds from big business contributors - like Intel, Microsoft etc, who have an interest in the continuation of the linux kernel and wish to pay for jobs which didn't have a source of funding (i.e. Linus's job and other maintainer) and who wished to remain non-partisan. So these companies provide both code and money. That money isn't meant to be kicked back to profit-making companies as far as I understand.
  - KGIII 9y ago
    Also, probably because grsec's code doesn't meet the standards. By almost all accounts, it pretty much sucks. I am unqualified to opine, but I trust the opinions of who are qualified - by being the people who try to implement it.
  - sighsagain 9y ago
    That money is being used to pay Kees Cook to rip off grsecurity.
bitmapbrother 9y ago
After reading the entire exchange between Torvalds and Spengler I must say Torvalds was thoroughly trounced. It was like watching a child argue with an adult. Spengler provided facts, justification, reasoning and proof while Torvalds acted like a child and called him names and his work garbage. If you're going to call someone out then at least have the decency to properly address their reply instead of completely ignoring what they said and just saying what you want to say.
noncoml 9y ago
Linus is a bully.
romanovcode 9y ago
I don't get it. Who would want to continue work with him with this attitude?
vectorEQ 9y ago
grsecurity, i like it. pretty secure for my machine. never had any breakage... i think Linus should probarbly pay more attention to security issues in 'his' os instead of being ratty about people taking it in their own hands to fix it... if u want to know: you can increase the stack guard page for grsecurity too, as theirs is also way small... On the otherhand i dont see why a kernel doesn't track it's stack pointers and heap allocations to see if there is overlap, its basic idea and stupid that they ever dared to say this is not exploitable. Even though not many ppl seem to have looked at it and/or done it, its plainly obvious there is an issues with there being a possibility of overlap;. The stack guard page is a stupid mechanism which at best causes an application crash (fking handle that shit properly??) masked as 'security incident'.... that being said, linux, grsecurity, still my main choice, still much love for linus and grsecurity folks. whish they could get along better and perhaps someday think of actual solutions instead of infinite bandaids!
- majewsky 9y ago
  > grsecurity, i like it. pretty secure for my machine. never had any breakage... Pretty weak argument. I'm running stock Linux without grsec and I've never had any breakage either. > i think Linus should probably pay more attention to security issues What makes you think that he doesn't? Also, there is a whole separate team (the Kernel Self Protection Project) working on the issue.
  - sighsagain 9y ago
    > What makes you think that he doesn't? Also, there is a whole separate team (the Kernel Self Protection Project) working on the issue. the fact that all the KSSP has been doing is copying grsecurity code is a pretty good indication that he doesn't because the same code they are copy pasting is the code he is calling garbage. And he's saying to not bother with the patchset that has made it so no public linux vulnerability affected my kernel in at least a year. Let me repeat that. My kernel has not had one public reported security vulnerability in a year.
mercymichael 9y ago
hi my girlfriend and I been dating for about 8 to 10 months and we live together for about 4 months we recently broke uo because I was being selfish wanted to control her didn’t appreciate her didn’t show much affection but I really do love her fought a lot and I was stuck I was hurt I had to go home every night knowing shes in the other room sleeping without a care in the world I hate it I begged her back open my heart to her and nothing all she kept saying is I love you but I don’t want to be with you I have another man in my life now, I talked with the popular Dr. Akin and he prayed for my relationship and I got her back in two days. If you are hurt in your relationship,get in touch with him(prayerstosavemarriage@hotmail.com)cos I promised him I will talk about him on the internet,and now we plan of getting married next month :)
mercymichael 9y ago
hi my girlfriend and I been dating for about 8 to 10 months and we live together for about 4 months we recently broke uo because I was being selfish wanted to control her didn’t appreciate her didn’t show much affection but I really do love her fought a lot and I was stuck I was hurt I had to go home every night knowing shes in the other room sleeping without a care in the world I hate it I begged her back open my heart to her and nothing all she kept saying is I love you but I don’t want to be with you I have another man in my life now, I talked with the popular Dr. Akin and he prayed for my relationship and I got her back in two days. If you are hurt in your relationship,get in touch with him(prayerstosavemarriage@hotmail.com)cos I promised him I will talk about him on the internet,and now we plan of getting married next month :)
mercymichael 9y ago
hi my girlfriend and I been dating for about 8 to 10 months and we live together for about 4 months we recently broke uo because I was being selfish wanted to control her didn’t appreciate her didn’t show much affection but I really do love her fought a lot and I was stuck I was hurt I had to go home every night knowing shes in the other room sleeping without a care in the world I hate it I begged her back open my heart to her and nothing all she kept saying is I love you but I don’t want to be with you I have another man in my life now, I talked with the popular Dr. Akin and he prayed for my relationship and I got her back in two days. If you are hurt in your relationship,get in touch with him(prayerstosavemarriage@hotmail.com)cos I promised him I will talk about him on the internet,and now we plan of getting married next month :)

146 points by enedil 9y ago

Strong words. Usually when Linus ways in so strongly on a topic he's pretty certain of his take on it-it'll be interesting to see if there's further discussion on both ends.

bitmapbrother 9y ago
>How could they know that calling people clowns and their work garbage wasn't payment enough? >With no technical content coming from your end, there's no need to discuss anything further -- don't waste your time because I won't reply. I don't think there will be any further discussion.
deleted 9y ago
[deleted]

dkarapetyan 9y ago

Linus has cried wolf too many times. His outbursts about garbage patches are no longer believable.

_e 9y ago
Can you point to specific times? I want to dig into this more.
- dkarapetyan 9y ago
  Google Linus rant. There are many examples.
  - cyphar 9y ago
    Crying wolf requires him to have been wrong (or lied). I think that GP was asking you for evidence of _that_, not of evidence that Linus has ranted in the past. From memory, I can't recall a time where his ranting was not justified, but he has been wrong a couple of times. Unless I'm missing something blatant, that doesn't constitute "crying wolf" to me.
    - dkarapetyan 9y ago
      The parable of the boy crying wolf is not about lies but about desensitizing your audience to what you are saying. I've read enough of the rants to know there is very little signal to all the noise he makes. The grsecurity stuff could be bad but I sure as hell am not gonna get my analysis from Linus. If he acted more like a grown up then maybe but he doesn't. He character assassinates and then says you are doing silly pointer arithmetic. Can just mention the pointer stuff without shouting and screaming at author of the patch. The drama in kernel dev is a direct result of his abrasive approach. He screams and shouts so grsecurity screams and shouts. Everyone else loses. The kernel dev space needs less drama and more grown ups.
      - cyphar 9y ago
        > The parable of the boy crying wolf is not about lies but about desensitizing your audience to what you are saying. ... Because the little boy was lying. If there really was a wolf every time he said there was they would consider him a brilliant scout rather than an untrustworthy source of information. It's strange that it's necessary to explain children's parables on HN. > The kernel dev space needs less drama and more grown ups. I don't disagree with that, I just don't agree with saying that Linus is crying wolf. Because you don't appear to understand what it means.
      - deleted 9y ago
        [deleted]
  - abritinthebay 9y ago
    A rant is different to "crying wolf". Be specific.
  - djrogers 9y ago
    The term “Crying Wolf” implies the very specific and extreme accusation of lying. Ranting, or even ranting then reversing course are very different from lying. Words have meaning, be careful how you use them.
    - dkarapetyan 9y ago
      Words have meaning? ffs. Was there a shitpost memo sent out I didn't get. thx cpt obvious

doe88 9y ago

For all his unfortunate abrasiveness one strength of Linus is and has always been his capacity to see the big picture, e.g. that usually compatibility/API,ABI stability/performances trumps extreme security measures and also he has always been able to accomodate with big players/corps in the industry.

ajarmst 9y ago
I kind of find Linus refreshing, although I'm not sure that would survive working directly with him. I think you're begging the question though: surely compatibility/ABI stability/performance trumps extreme security (for some values of 'extreme') for people and in cases where that is true. I happen to agree with you and Linus on this (baring a known exploit of an unpatched security bug), but that heirarchy is nowhere engraven in stone. If I always recompiled a critical codebase, I wouldn't care as much about ABI compatibility. If I'm always targetting a very specific platform, I don't care about compatibility. If I'm sitting on millions of unused cycles in a single-threaded realtime environment, I only care about performance to a certain point. If I'm working on software to control a medical device or nuclear reactor, my priorites around extreme security change. You're right about that priority for the vast majority of the Linux user-base, but that's a characteristic of those users and developers, not of kernel software in general.
- KGIII 9y ago
  I have never even tried to read the kernel source, but I read the mailing lists - quite frequently. Linus runs a tight ship. It is funniest when someone does something that will break userspace. He sets high standards. Meet them. I don't believe any forks have really done well. His method works, as abrasive as it may appear.
- vacri 9y ago
  I've always found it weird that de Raadt is admired for being abrasive, and Torvalds is pilloried. I've always wondered, if the grsec people are such believers of 'security above all else', why they just don't work with OpenBSD instead.

topkeker 9y ago

Grsecurity wouldn't exist if Linux made security a priority. It doesn't, because backwards compatibility and features is more important to them. It doesn't mean because Linus says something so strongly on a subject is right or wrong, he is generally abusive and rants and has for years. Grsecurity is important to some people, not all, and vice versa for the features and backwards compatibility crowd. Personally I'd hope someone in Linus position would see both sides of the fence, but he doesn't and always has some mouthy outrageous opinion. So this is zero surprise.

taeric 9y ago
To be even weakly fair, access is a component of security. If their patches break software, they would be breaking someone's security. That is, backwards compatibility deserves that high bar. Ideally, you could get security without breaking things. If you can't, at least use care and take incremental steps to get things in.
hacknat 9y ago
And without backwards compatibility you would have never heard of Linux.
- geofft 9y ago
  That's a very strong claim. Some evidence in favor is that, at least in the early days of Linux, Microsoft took the same strategy of prioritizing backwards compatibility over security - and reaped the rewards by becoming extremely popular and extremely full of security holes. So clearly the strategy worked for MS. On the other hand, MS did respond and prioritize security, and was able to pull it off without compromising backwards compatibility too much. (For instance, last week's stack-clash vulnerability straight up doesn't exist on Windows because MSVC and the NT kernel have been doing the right thing with stack probes for years.) But some real evidence against is that this whole backwards-compatibility thing is a kernel policy, not a userspace policy; no distro cares nearly as much. With the a.out to ELF transition and libc5 to libc6 transition back in the day, and to this day with OpenSSL versions, the GCC 5 libstdc++ ABI change, etc., there's not a ton of backwards compatibility in what binaries you can actually run on a real-world Linux system. It seems hard to believe that the kernel-to-userspace compatibility story is what made Linux popular, given the vast amount of userspace-to-other-userspace incompatibility.

ivanbakel 9y ago

It's a struggle to respect the security opinions of someone who has actively admitted that he thinks "[security] bugs are just bugs". [0] Personally, I find it quite hard to respect Linus generally - his offensive personality is clearly not something that would be appropriate coming from anyone else in any community, but for some reason he gets a free ride for being a difficult genius. 0. http://www.washingtonpost.com/sf/business/2015/11/05/net-of-insecurity-the-kernel-of-the-argument/ http://www.washingtonpost.com/sf/business/2015/11/05/net-of-... N.B. The article is a bit deep in technical inaccuracies - it calls Linux an OS, for example.

ajarmst 9y ago
Nooooooo! Now we have to listen to the "what is an OS?" semantic flamewar!
- mercymichael 9y ago
  hi my girlfriend and I been dating for about 8 to 10 months and we live together for about 4 months we recently broke uo because I was being selfish wanted to control her didn’t appreciate her didn’t show much affection but I really do love her fought a lot and I was stuck I was hurt I had to go home every night knowing shes in the other room sleeping without a care in the world I hate it I begged her back open my heart to her and nothing all she kept saying is I love you but I don’t want to be with you I have another man in my life now, I talked with the popular Dr. Akin and he prayed for my relationship and I got her back in two days. If you are hurt in your relationship,get in touch with him(prayerstosavemarriage@hotmail.com)cos I promised him I will talk about him on the internet,and now we plan of getting married next month :)
pyroinferno 9y ago
>For Linux, the operating system that Torvalds created Stopped reading right there. First of all, Linux is not an operating unto itself, but rather another free component of a fully functioning GNU system made useful by the GNU corelibs, shell utilities and vital system components comprising a full OS. Because of that, the Operating System is not Linux, but rather GNU/Linux (or GNU + Linux which I recently have been calling it).

peterwwillis 9y ago

This is just celebrity gossip/hype/flaming. Nothing new, interesting, or intellectually curious here.

CalChris 9y ago
I have to agree with this given the post. If Linus had a concrete example rather than just his sweeping condemnation, it would be different.
- moxious 9y ago
  If there had been concrete examples and such, rational argument (hopefully) would have ensued, and HN would not have been notified about a completely normal engineering discussion down in the weeds. But seeing condemnation and drama works better for post material I suppose.

rhblake 9y ago

See Linus' follow-up http://seclists.org/oss-sec/2017/q2/596 http://seclists.org/oss-sec/2017/q2/596 for clarification: > They aren't split up, there has never been any effort by you to make them palatable to upstream, and when somebody else dioes try to make them palatable to upstream, you start crying about how people are taking advantage of your work (hah), and try to make them private instead. ... > It's literally less work for people to re-implement things than look at your mixed-up patches, and YOU SEEM TO BE DOING THAT ON PURPOSE. > Now, prove me wrong. Start trying to integrate your work upstream, and send individual patches with commit logs that can be integrated.

uhhfcuvv 9y ago
And the other guy's reply: http://seclists.org/oss-sec/2017/q2/597 http://seclists.org/oss-sec/2017/q2/597
- microcolonel 9y ago
  > Just like you spend your time focusing on versions of Linux nobody actually uses (they use stable kernels or distro kernels) but which benefits your corporate sponsors and maintains the churn you want to force everyone to contribute to. The days of Linux being a community project are long gone, it's a fairy tale at this point. Clearly a load of crap. I think they should quit being spicy and think about what they should be doing instead.
- moxious 9y ago
  "Days of our lives" Linux kernel edition. Do many people have a taste for kernel drama and Linus antics? I mostly just want the software.
  - btian 9y ago
    Then write your own? Why bother commenting here.
  - benchaney 9y ago
    Then just use the software. You get the same version whether you read lkml or not.

ajdlinux 9y ago

The grsecurity team does have some valid criticisms of the upstream community, and of course they've done some brilliant technical work, but spender is unfortunately a pretty toxic community member who puts many upstream kernel devs to shame when it comes to ability to flame. It's a shame - there's a lot of good stuff in grsec/PaX, but I think the upstream community is better off without the people involved. The KSPP effort to upstream grsec/PaX features is, of course, a good thing. [disclaimer: upstream developer who lurks on kernel-hardening]

technion 9y ago
Similarly, I used to run grsec on RedHat once upon a time. But the whole thing just got too hard. When a critical update came, I could get a stock kernel running "yum update", or I could play around building a whole new grsec kernel. I wish there was a way to take personalities out of this and let mainline merge the useful parts of grsec.
OJFord 9y ago
Your bio isn't a disclaimer.

windows_lover 9y ago

Linus, and this stubborn attitude of his, is the reason that Linux will always lag behind Windows in kernel security. With the vast security improvements Microsoft are putting into their operating system year on year, it's a shame to see Linux failing to keep up.

motoboi 9y ago
I'm upcoming you for good comedy.
chronoGloat 9y ago
Bleh. There are enough NSA backdoors in implanted within Windows to the point that any sane person regards Microsoft security as pure theater. Secrets aren't actually secrets in Windows at all.
- deleted 9y ago
  [deleted]
- windows_lover 9y ago
  Now that's just silliness. I invite you to provide solid technical evidence of these supposed "NSA backdoors" in Windows.
tbodt 9y ago
With a username of "windows_lover", what can I say?
whoami_nr 9y ago
>Linux will always lag behind Windows in kernel security Are you serious about that statement ?
- snuxoll 9y ago
  I'm not going to agree or disagree on this, but Microsoft's choice to shove all syscalls into a DLL where a defined ABI is easier to maintain certainly makes dramatic security improvements to the kernel easier without breaking userspace.

chrissnell 9y ago

I'm an Arch user and I have no idea what's going on with security-focused kernels these days. I was running the grsecurity kernel package but that was recently replaced by a "linux-hardened" package that I had never heard of. Then, a pacman update tonight installed a plain Linux kernel. It's very confusing. Not unexpected for Arch but there is so little on the wiki about this.

cyphar 9y ago
The grsecurity patches have been made private. Although they are under the GPL (because they are a derivative work of the Linux kernel), the company that produces grsecurity engages in the unethical (and potentially illegal) business practice of threatening to terminate customer subscriptions if they exercise their right to distribute the patches. In other words, no customer is going to distribute the patches because they will have wasted money and lost access to updates. This is very reminiscent of free speech chilling effects, and I'm surprised none of the copyright holders in Linux (myself included) have teamed up to sue them. Long story short, the general community (including distributions) no longer has access to new patches making grsecurity useless for the community.
- snuxoll 9y ago
  > the company that produces grsecurity engages in the unethical (and potentially illegal) Unethical, probably - illegal, probably not. The GPL dictates what you can do once code hits your hands (or binaries compiled with), it doesn't prevent companies from selling it to you or what contract they do it under.
  - skymt 9y ago
    That depends on how you read section 6 of the GPL2. It states in part: > You may not impose any further restrictions on the recipients' exercise of the rights granted herein. The central right granted under the GPL is, of course, the right to modify and redistribute the source. I'm not a lawyer, and I'm certain that Grsecurity could find a number of legal arguments that what they're doing is allowed (likely starting with the claim that terminating a relationship with a customer isn't legally imposing a restriction on that customer's actions), but the idea that they're in violation of the GPL isn't pulled from thin air.

someonewhocar3s 9y ago

I'm going out on a limb here, and say grsecurity is probably more bad than it is good. Then again, I don't see Linus getting really hyped about making linux work less well.

known 9y ago

BSD is more liberal than GNU/Linus

43224gg252 9y ago
Why do you think this? Because they let people fork the kernel, patch it, close the source, sell it, and never contribute anything back?
KGIII 9y ago
The BSD license protects different freedoms than the GPL. The GPL ensures the code is free, that it can never be taken away.
flukus 9y ago
It sounds like the GPL is the only reason these patches are available at all.

protomyth 9y ago

Reading one of the follow-up e-mail http://seclists.org/oss-sec/2017/q2/586 http://seclists.org/oss-sec/2017/q2/586 Wouldn't it be nice if you didn't demand free work of us in our free time? seems an odd line, but is there some context for the non-Linux person on what is going on?

nisa 9y ago
Don't count on this recount to be correct but as far I've followed it: 200x? - grsecurity patchset is introduced and fixes a lot of bug-classes (!) and introduces lot's of security improvements to the kernel that are ground breaking and find their way in other systems like *BSD / Windows 200x-201x - code and trademarks of grsecurity get ripped from embbedded vendors - Linux foundations does nothing because they don't pursue GPL violations - no intent from grsecurity to upstream their work - at least without getting paid for it. 2016-2017: - Linux foundation founds KSPP and works on integrating basically PaX/grsecurity into mainline - does not even ask grsecurity or PaX if they want to get paid for helping but they are flamed at and bothered with inquiries from devs - according to grsecurity most of KSPP work is copy&paste the grsecurity code without deeper understanding - introducing even new vulns - grsecurity only publishes patchset for current mainline kernel, no more long term releases 2017: - things are escalating, grsecurity patches go dark - lot's of rants and hate from all sites. now: - this mess. I can see the point from the grsecurity guys - they produced ground breaking research and it got ripped of everywhere and Linux foundation does not protect it's interests because the corporations don't want GPL enforcement (not related to the current dark patchset) and they don't even bother offering them money for the work to integrate this stuff. The bad mouthing from Linus is quite idiotic if you consider that most, if not all kernel vulns did not affect grsecurity in the past years. It's also true that the patchset breaks code depeding on the settings in plenty of ways. Add lot's of rants and flames, big ego, personal attacks from grsecurity to Linux devs and vice versa...not exactly professional. Not sure what was/is going on beyond that. At least that's some outsider Twitter/Mailinglist perspective. It's not black and white and IMHO Linux Foundation and KSPP have some explaining to do.
- gizmo686 9y ago
  >they produced ground breaking research and it got ripped of everywhere. This is the part I don't get. They produced ground breaking research on a GPL platform, what did they expect to happen?

EGreg 9y ago

The man doesn't mince words

Aeolun 9y ago

So, just to confirm I see this correctly: Grsecurity creates patches for issues in upstream, but their patches are too fucking big/ugly, so nobody upstream really wants to merge them, and when someone tries to fix em (take the important bits out), grsecurity complains about them using their work. Grsecurity then say they don't feel like doing a lot of work on their patches when they're not paid to do it.

simcop2387 9y ago
Along with that Grsec then says that if while the patch is GPLv2 if you distribute them they'll never let you subscribe again to get the patch in the future.
- clhodapp 9y ago
  That's a pretty interesting loophole in the GPL: apparently (at least with V2), it might be fine to impose consequences for exercising your rights while technically giving them to you. It certainly violates the spirit of the GPL even if it doesn't violate the letter.
  - AstralStorm 9y ago
    It does not impose amy restrictions on getting the code. You need to write a bot to get status updates though. Mailing list is not the code. If he starts filtering on the web server or rejecting direct source requests, he starts violating the letter of GPL 2.
    - clhodapp 9y ago
      I'm not sure that your claim about where the line is holds up: the GPLv2 never requires you to give your source to anyone unless you first give them binaries. That's why web sites don't have to give out their sources to everyone who visits their site if they use a GPL library for instance. In any case, if what you say is correct, the grsecurity team are still trying to hold the threat of a more annoying experience over their users in order up prevent them from exercising their rights under the GPLv2.

43224gg252 9y ago

The reddit thread is better: https://www.reddit.com/r/linux/comments/6j7saq/linus_torvalds_opinion_on_grsecurity/ https://www.reddit.com/r/linux/comments/6j7saq/linus_torvald...

pawadu 9y ago
I found the reddit thread much more interesting than the NH discussion...

madez 9y ago

A genuine question: Why isn't it perfectly reasonable to accept to break compatibility in order to increase security? Isn't that what we do in our lifes all the time? When the authorities issue new fire safety regulations for buildings, then that is breaking compatibility to the older building standard. We still do it because there is good reason. Sometimes even old buildings need to be retrofitted, and that is then what is done. I don't get Linus in this point, and suspect so far that he is wrong, or that I didn't get it yet.

amluto 9y ago
It is acceptable to break compatibility to fix a security problem, but it needs to be a minimal break. The problem with this particular issue is that it's breaking compatibility with major applications, which is no good.
vacri 9y ago
> When the authorities issue new fire safety regulations for buildings, then that is breaking compatibility to the older building standard. Do the old buildings automagically get updated to the new standard everyone is using? Does the city shut down every business in a building that doesn't match standard (= break software) until that building is retrofitted (which is time-consuming and costly)? That's what breaking backwards compatability does, it stops people from doing their thing until someone fixes it (sometimes it's on them, sometimes it's on you). And not everyone can afford a 'drop everything now to fix the issues brought up by the kernel release'. In any case, a good way to get people to not use your product is to keep breaking it. > Sometimes even old buildings need to be retrofitted, and that is then what is done. Is it? There was a very famous fire in London just a couple of weeks ago, of a building which wasn't up to standard, yet filled with people. Dozens of people died.
- madez 9y ago
  The example of the recent fire in London strengthens my point. If we neglect security, then there is a price to pay for it. And now in London they do fix up buildings, because it's what makes sense. Linux including a breaking change to increase security does not stop any business. If you are not patched to the new version, don't upgrade. The breaking change could be announced well ahead, and people would have time to fix their stuff. That would be akin to the government releasing a new regulation but not forcing anybody to upgrade directly, but by offering tax relieve to anybody who did.

amluto 9y ago

Crikey! I seem to have set off this flame war, and I didn't even know about it until I saw it here.

yuhong 9y ago

So I wonder what happened in the end in the Wind River debacle.

dkarapetyan 9y ago

Guess you lack the level of abstraction capabilities I expect. Sure. The parable is just about lies and not signals and noises. All Linus rants are full of information. He is a brilliant programmer. Everything he screams and shouts about is always correct. He has never confused a raccoon with a wolf.

cyphar 9y ago
You're not using the term "crying wolf" correctly[1]. It has a very specific meaning in English, and that is what my complaint is in relation to. No amount of personal derision about how I "lack the level of abstraction capabilities" (whatever that means) will change that you are using the phrase incorrectly. I even specifically said that I agree that we need less difficult personalities in kernel development. It's quite ironic that you then followed up the way you did. [1]: https://en.m.wiktionary.org/wiki/cry_wolf https://en.m.wiktionary.org/wiki/cry_wolf
- dkarapetyan 9y ago
  Let me break it down for you with all the necessary substitutions > (idiomatic) To raise a false alarm; to constantly warn others about an imagined threat, thereby failing to get assistance when a real threat appears. The imagined threat is the level of quality in patches. He consistently raises false alarms about the quality of patches. The false part being the absolute terms he uses about the character of the people that proposed the patches. Calling someone an infantile moron qualifies as falsehood in my book and counts as raising a false alarm. Now that he is complaining about grsecurity I'm not inclined to listen because the level of alarm he has used previously has been incommensurate with reality, as in he has said "here is a wolf" (this patch is the worst thing ever and the person that wrote it is a moron) when in reality there was no wolf (patch was actually fine and the person was not a moron). Less alarmism would have helped everyone involved get along better and make a more secure kernel. Instead I'm arguing about how comparing his alarmism to crying wolf is or isn't idiomatic. FML
  - qb45 9y ago
    > The imagined threat is the level of quality in patches. No, it often is a real threat. > The false part being the absolute terms he uses about the character of the people that proposed the patches. So feel free to disregard his opinions about the characters of other people, but don't be surprised that barely anyone treats you seriously when you suggest that the above somehow invalidates his technical analyses. > Now that he is complaining about grsecurity I'm not inclined to listen Which is fine because it's clearly not your job.

deleted 9y ago

[deleted]

bubblethink 9y ago

How are the Linux Foundation's funds allocated, and how much say does Linus have in it ? Most of this boils down to lack of money and attribution for grsec. Why didn't the Linux Foundation or Linus try to officially fund grsec to upstream their patches ? KSPP is still costing money. How much would it have cost to pay grsec directly instead ?

dm319 9y ago
As far as I understand that is the opposite of how it works. The linux foundation was set up to receive funds from big business contributors - like Intel, Microsoft etc, who have an interest in the continuation of the linux kernel and wish to pay for jobs which didn't have a source of funding (i.e. Linus's job and other maintainer) and who wished to remain non-partisan. So these companies provide both code and money. That money isn't meant to be kicked back to profit-making companies as far as I understand.
- KGIII 9y ago
  Also, probably because grsec's code doesn't meet the standards. By almost all accounts, it pretty much sucks. I am unqualified to opine, but I trust the opinions of who are qualified - by being the people who try to implement it.
- sighsagain 9y ago
  That money is being used to pay Kees Cook to rip off grsecurity.

bitmapbrother 9y ago

After reading the entire exchange between Torvalds and Spengler I must say Torvalds was thoroughly trounced. It was like watching a child argue with an adult. Spengler provided facts, justification, reasoning and proof while Torvalds acted like a child and called him names and his work garbage. If you're going to call someone out then at least have the decency to properly address their reply instead of completely ignoring what they said and just saying what you want to say.

noncoml 9y ago

Linus is a bully.

romanovcode 9y ago

I don't get it. Who would want to continue work with him with this attitude?

vectorEQ 9y ago

grsecurity, i like it. pretty secure for my machine. never had any breakage... i think Linus should probarbly pay more attention to security issues in 'his' os instead of being ratty about people taking it in their own hands to fix it... if u want to know: you can increase the stack guard page for grsecurity too, as theirs is also way small... On the otherhand i dont see why a kernel doesn't track it's stack pointers and heap allocations to see if there is overlap, its basic idea and stupid that they ever dared to say this is not exploitable. Even though not many ppl seem to have looked at it and/or done it, its plainly obvious there is an issues with there being a possibility of overlap;. The stack guard page is a stupid mechanism which at best causes an application crash (fking handle that shit properly??) masked as 'security incident'.... that being said, linux, grsecurity, still my main choice, still much love for linus and grsecurity folks. whish they could get along better and perhaps someday think of actual solutions instead of infinite bandaids!

majewsky 9y ago
> grsecurity, i like it. pretty secure for my machine. never had any breakage... Pretty weak argument. I'm running stock Linux without grsec and I've never had any breakage either. > i think Linus should probably pay more attention to security issues What makes you think that he doesn't? Also, there is a whole separate team (the Kernel Self Protection Project) working on the issue.
- sighsagain 9y ago
  > What makes you think that he doesn't? Also, there is a whole separate team (the Kernel Self Protection Project) working on the issue. the fact that all the KSSP has been doing is copying grsecurity code is a pretty good indication that he doesn't because the same code they are copy pasting is the code he is calling garbage. And he's saying to not bother with the patchset that has made it so no public linux vulnerability affected my kernel in at least a year. Let me repeat that. My kernel has not had one public reported security vulnerability in a year.

mercymichael 9y ago

hi my girlfriend and I been dating for about 8 to 10 months and we live together for about 4 months we recently broke uo because I was being selfish wanted to control her didn’t appreciate her didn’t show much affection but I really do love her fought a lot and I was stuck I was hurt I had to go home every night knowing shes in the other room sleeping without a care in the world I hate it I begged her back open my heart to her and nothing all she kept saying is I love you but I don’t want to be with you I have another man in my life now, I talked with the popular Dr. Akin and he prayed for my relationship and I got her back in two days. If you are hurt in your relationship,get in touch with him(prayerstosavemarriage@hotmail.com)cos I promised him I will talk about him on the internet,and now we plan of getting married next month :)

mercymichael 9y ago