5 ms·

Reading one of the follow-up e-mail http://seclists.org/oss-sec/2017/q2/586 http://seclists.org/oss-sec/2017/q2/586 Wouldn't it be nice if you didn't demand fr

Reading one of the follow-up e-mail http://seclists.org/oss-sec/2017/q2/586 http://seclists.org/oss-sec/2017/q2/586 Wouldn't it be nice if you didn't demand free work of us in our free time? seems an odd line, but is there some context for the non-Linux person on what is going on?

nisa 9y ago
Don't count on this recount to be correct but as far I've followed it: 200x? - grsecurity patchset is introduced and fixes a lot of bug-classes (!) and introduces lot's of security improvements to the kernel that are ground breaking and find their way in other systems like *BSD / Windows 200x-201x - code and trademarks of grsecurity get ripped from embbedded vendors - Linux foundations does nothing because they don't pursue GPL violations - no intent from grsecurity to upstream their work - at least without getting paid for it. 2016-2017: - Linux foundation founds KSPP and works on integrating basically PaX/grsecurity into mainline - does not even ask grsecurity or PaX if they want to get paid for helping but they are flamed at and bothered with inquiries from devs - according to grsecurity most of KSPP work is copy&paste the grsecurity code without deeper understanding - introducing even new vulns - grsecurity only publishes patchset for current mainline kernel, no more long term releases 2017: - things are escalating, grsecurity patches go dark - lot's of rants and hate from all sites. now: - this mess. I can see the point from the grsecurity guys - they produced ground breaking research and it got ripped of everywhere and Linux foundation does not protect it's interests because the corporations don't want GPL enforcement (not related to the current dark patchset) and they don't even bother offering them money for the work to integrate this stuff. The bad mouthing from Linus is quite idiotic if you consider that most, if not all kernel vulns did not affect grsecurity in the past years. It's also true that the patchset breaks code depeding on the settings in plenty of ways. Add lot's of rants and flames, big ego, personal attacks from grsecurity to Linux devs and vice versa...not exactly professional. Not sure what was/is going on beyond that. At least that's some outsider Twitter/Mailinglist perspective. It's not black and white and IMHO Linux Foundation and KSPP have some explaining to do.
- gizmo686 9y ago
  >they produced ground breaking research and it got ripped of everywhere. This is the part I don't get. They produced ground breaking research on a GPL platform, what did they expect to happen?
  - eropple 9y ago
    This is, as I understand it, the core of the thing. They're making derivative works of a GPL work. They don't get to have it both ways. There's nothing for the Linux Foundation to go after, and they wouldn't be able to even if there was because they don't have the copyright for grsecurity's stuff.
    - nisa 9y ago
      Lot's of embedded vendors have plenty of GPL violations - Linksys and Ubiquity for instance in the case of grsecurity it was appearently Wind River. Apparently even no source code even if you purchased a device.
      - eropple 9y ago
        Sure, but--so? grsecurity has the copyright on what they've created. They don't need the Linux Foundation to enforce violations and there's no cause to force the Linux Foundation to do so if they don't feel it's best for Linux; copyright is optionally enforced in most jurisdictions (unlike trademark in the USA). On top of that, you're miffed that the Linux Foundation didn't "ask grsecurity or PaX if they want to get paid for helping", which is orthogonal to everything? Your posts don't make sense to me, and I've been observing this whole mess for a very long time. What you're saying reads as if the Linux Foundation should be the heavies for a private company that has never-not-once played by the same rules as the cooperative development community they work outside of.
        sighsagain 9y ago
        Wind River is owned by Inter which is in the Linux Foundation funding KSPP to rip off more of grsec. It's very related wouldn't you say?
cyphar 9y ago
> Wouldn't it be nice if you didn't demand free work of us in our free time? seems an odd line, but is there some context for the non-Linux person on what is going on? Spender (and PaXTeam) has consistently claimed for many years that although he owns a software company whose sole product is a kernel patchset (and they are the only people who develop that patchset) that all grsecurity work is done in their free time. Which means that nobody (including their paying customers) is paying them for grsecurity development. This usually comes up when Spender wants to claim that Linux has a lot of money in its development and that it is unreasonable that he, the poor developer he is, should work on upstreaming his patches. Personally it always struck me as dishonest. I recently had an argument with them about this, which was "fun"[1]. [1]: https://news.ycombinator.com/item?id=14210140 https://news.ycombinator.com/item?id=14210140

nisa 9y ago

Don't count on this recount to be correct but as far I've followed it: 200x? - grsecurity patchset is introduced and fixes a lot of bug-classes (!) and introduces lot's of security improvements to the kernel that are ground breaking and find their way in other systems like *BSD / Windows 200x-201x - code and trademarks of grsecurity get ripped from embbedded vendors - Linux foundations does nothing because they don't pursue GPL violations - no intent from grsecurity to upstream their work - at least without getting paid for it. 2016-2017: - Linux foundation founds KSPP and works on integrating basically PaX/grsecurity into mainline - does not even ask grsecurity or PaX if they want to get paid for helping but they are flamed at and bothered with inquiries from devs - according to grsecurity most of KSPP work is copy&paste the grsecurity code without deeper understanding - introducing even new vulns - grsecurity only publishes patchset for current mainline kernel, no more long term releases 2017: - things are escalating, grsecurity patches go dark - lot's of rants and hate from all sites. now: - this mess. I can see the point from the grsecurity guys - they produced ground breaking research and it got ripped of everywhere and Linux foundation does not protect it's interests because the corporations don't want GPL enforcement (not related to the current dark patchset) and they don't even bother offering them money for the work to integrate this stuff. The bad mouthing from Linus is quite idiotic if you consider that most, if not all kernel vulns did not affect grsecurity in the past years. It's also true that the patchset breaks code depeding on the settings in plenty of ways. Add lot's of rants and flames, big ego, personal attacks from grsecurity to Linux devs and vice versa...not exactly professional. Not sure what was/is going on beyond that. At least that's some outsider Twitter/Mailinglist perspective. It's not black and white and IMHO Linux Foundation and KSPP have some explaining to do.

gizmo686 9y ago
>they produced ground breaking research and it got ripped of everywhere. This is the part I don't get. They produced ground breaking research on a GPL platform, what did they expect to happen?
- eropple 9y ago
  This is, as I understand it, the core of the thing. They're making derivative works of a GPL work. They don't get to have it both ways. There's nothing for the Linux Foundation to go after, and they wouldn't be able to even if there was because they don't have the copyright for grsecurity's stuff.
  - nisa 9y ago
    Lot's of embedded vendors have plenty of GPL violations - Linksys and Ubiquity for instance in the case of grsecurity it was appearently Wind River. Apparently even no source code even if you purchased a device.
    - eropple 9y ago
      Sure, but--so? grsecurity has the copyright on what they've created. They don't need the Linux Foundation to enforce violations and there's no cause to force the Linux Foundation to do so if they don't feel it's best for Linux; copyright is optionally enforced in most jurisdictions (unlike trademark in the USA). On top of that, you're miffed that the Linux Foundation didn't "ask grsecurity or PaX if they want to get paid for helping", which is orthogonal to everything? Your posts don't make sense to me, and I've been observing this whole mess for a very long time. What you're saying reads as if the Linux Foundation should be the heavies for a private company that has never-not-once played by the same rules as the cooperative development community they work outside of.
      - sighsagain 9y ago
        Wind River is owned by Inter which is in the Linux Foundation funding KSPP to rip off more of grsec. It's very related wouldn't you say?

cyphar 9y ago

> Wouldn't it be nice if you didn't demand free work of us in our free time? seems an odd line, but is there some context for the non-Linux person on what is going on? Spender (and PaXTeam) has consistently claimed for many years that although he owns a software company whose sole product is a kernel patchset (and they are the only people who develop that patchset) that all grsecurity work is done in their free time. Which means that nobody (including their paying customers) is paying them for grsecurity development. This usually comes up when Spender wants to claim that Linux has a lot of money in its development and that it is unreasonable that he, the poor developer he is, should work on upstreaming his patches. Personally it always struck me as dishonest. I recently had an argument with them about this, which was "fun"[1]. [1]: https://news.ycombinator.com/item?id=14210140 https://news.ycombinator.com/item?id=14210140