5 ms·

Don't count on this recount to be correct but as far I've followed it: 200x? - grsecurity patchset is introduced and fixes a lot of bug-classes (!) and introd

by nisa 9y ago

Don't count on this recount to be correct but as far I've followed it: 200x? - grsecurity patchset is introduced and fixes a lot of bug-classes (!) and introduces lot's of security improvements to the kernel that are ground breaking and find their way in other systems like *BSD / Windows 200x-201x - code and trademarks of grsecurity get ripped from embbedded vendors - Linux foundations does nothing because they don't pursue GPL violations - no intent from grsecurity to upstream their work - at least without getting paid for it. 2016-2017: - Linux foundation founds KSPP and works on integrating basically PaX/grsecurity into mainline - does not even ask grsecurity or PaX if they want to get paid for helping but they are flamed at and bothered with inquiries from devs - according to grsecurity most of KSPP work is copy&paste the grsecurity code without deeper understanding - introducing even new vulns - grsecurity only publishes patchset for current mainline kernel, no more long term releases 2017: - things are escalating, grsecurity patches go dark - lot's of rants and hate from all sites. now: - this mess. I can see the point from the grsecurity guys - they produced ground breaking research and it got ripped of everywhere and Linux foundation does not protect it's interests because the corporations don't want GPL enforcement (not related to the current dark patchset) and they don't even bother offering them money for the work to integrate this stuff. The bad mouthing from Linus is quite idiotic if you consider that most, if not all kernel vulns did not affect grsecurity in the past years. It's also true that the patchset breaks code depeding on the settings in plenty of ways. Add lot's of rants and flames, big ego, personal attacks from grsecurity to Linux devs and vice versa...not exactly professional. Not sure what was/is going on beyond that. At least that's some outsider Twitter/Mailinglist perspective. It's not black and white and IMHO Linux Foundation and KSPP have some explaining to do.

gizmo686 9y ago
>they produced ground breaking research and it got ripped of everywhere. This is the part I don't get. They produced ground breaking research on a GPL platform, what did they expect to happen?
- eropple 9y ago
  This is, as I understand it, the core of the thing. They're making derivative works of a GPL work. They don't get to have it both ways. There's nothing for the Linux Foundation to go after, and they wouldn't be able to even if there was because they don't have the copyright for grsecurity's stuff.
  - nisa 9y ago
    Lot's of embedded vendors have plenty of GPL violations - Linksys and Ubiquity for instance in the case of grsecurity it was appearently Wind River. Apparently even no source code even if you purchased a device.
    - eropple 9y ago
      Sure, but--so? grsecurity has the copyright on what they've created. They don't need the Linux Foundation to enforce violations and there's no cause to force the Linux Foundation to do so if they don't feel it's best for Linux; copyright is optionally enforced in most jurisdictions (unlike trademark in the USA). On top of that, you're miffed that the Linux Foundation didn't "ask grsecurity or PaX if they want to get paid for helping", which is orthogonal to everything? Your posts don't make sense to me, and I've been observing this whole mess for a very long time. What you're saying reads as if the Linux Foundation should be the heavies for a private company that has never-not-once played by the same rules as the cooperative development community they work outside of.
      - sighsagain 9y ago
        Wind River is owned by Inter which is in the Linux Foundation funding KSPP to rip off more of grsec. It's very related wouldn't you say?
- sighsagain 9y ago
  Their research is orthogonal to the platform. Some stuff was implemented by MS and Apple into their OSes as well. They produced ground breaking research only to have the linux foundation (which includes intel which is one of the companies that messed with trademarks of grsecurity) pay someone else to copy it over so they can make grsecurity obsolete and then get called clown by the upstream.
sjellis 9y ago
"2016-2017: - Linux foundation founds KSPP and works on integrating basically PaX/grsecurity into mainline - does not even ask grsecurity or PaX if they want to get paid for helping but they are flamed at and bothered with inquiries from devs - according to grsecurity most of KSPP work is copy&paste the grsecurity code without deeper understanding" I don't follow this stuff closely, but I believe that the KSPP was started by Kees Cook because other approaches had failed: grsecurity/PaXTeam had been unwilling to cooperate to get their patches upstream for a long time, so the only way to move things forwards for everybody was to re-implement the functionality without PaXTeam.
- sighsagain 9y ago
  KSPP which is made up of a few corporations in the linux foundation pay Kees Cook to copy the grsec/pax patches basically. They never approached grsecurity about paying them to upstream their work. No one did. They are only paying people to rip off their work.
michaelmrose 9y ago
Their groundbreaking research was improvements that were directly derivative of work shipped with a license that said all derivative works must be provided under the same free license they received the work with. Your tone seems to suggest that some obligation exists that some obligation exists to do more than share the source to any improvements. This obligation is wholly and totally imaginary. Its as if someone gave another party an entire farm and in the contract specified that he could eat some of the food that grew from it and that someone threw a fit when the first party walked up and made a sandwich. Seeing as there is no sane and legal way to require anyone to pay for said patches the reasonable way to fund such an effort is to get the community to voluntarily fund such an effort with whatever platform is most useful preferably in advance. It seems that they have instead chosen to rely on a mixture of manufactured drama, illegal threats, and general unpleasantness to keep their efforts from being well integrated with mainstream. While this remains so they can offer definable value. In the long run I predict bankruptcy and irrelevance for a company that few care about now and none will care about later.
- hitekker 9y ago
  Yeah, the parent's summary is tripe and implies that the GRSecurity is somehow faultless in the drama they've vehemently instigated time and time again. I'm having trouble seeing, apart from ignorance or misinformation, why anyone would condone GRSecurity. The code is helpful but you wouldn't want the authors in a position of authority over the operating system of a billion-plus computers. Right now, most arguments in defense of GRSecurity are simply: "Two sides are arguing, therefore they're both wrong. Aren't I smarter for pointing it out?"
- sighsagain 9y ago
  Their research are in no way 'directly derivative' of the linux kernel. Their implementation was based on linux, but since then Microsoft and Apple have all adopted their RESEARCH of novel ways to eliminate entire CLASSES of bugs in their operating systems and as a result are far ahead of vanilla linux in this area. KSPP is a program started by some corporations (including Intel which is the parent company that was being talking about that messed with trademarks) and they pay some developers (such as kees cook) to rip off grsecurity/PaX code. It's funny how you talk about obligation when linus is here calling them clowns for their code which has for years protected systems which would otherwise be vulnerable such as vanilla linux kernels just because they are not in the format that the linux upstream wants? Doesn't hero worship get tiring? You make predictions about something you are seemingly ignorant about because they have customers because some people can't rely on the joke that is upstream linux security.
deleted 9y ago
[deleted]

by nisa 9y ago

gizmo686 9y ago

>they produced ground breaking research and it got ripped of everywhere. This is the part I don't get. They produced ground breaking research on a GPL platform, what did they expect to happen?

eropple 9y ago
This is, as I understand it, the core of the thing. They're making derivative works of a GPL work. They don't get to have it both ways. There's nothing for the Linux Foundation to go after, and they wouldn't be able to even if there was because they don't have the copyright for grsecurity's stuff.
- nisa 9y ago
  Lot's of embedded vendors have plenty of GPL violations - Linksys and Ubiquity for instance in the case of grsecurity it was appearently Wind River. Apparently even no source code even if you purchased a device.
  - eropple 9y ago
    Sure, but--so? grsecurity has the copyright on what they've created. They don't need the Linux Foundation to enforce violations and there's no cause to force the Linux Foundation to do so if they don't feel it's best for Linux; copyright is optionally enforced in most jurisdictions (unlike trademark in the USA). On top of that, you're miffed that the Linux Foundation didn't "ask grsecurity or PaX if they want to get paid for helping", which is orthogonal to everything? Your posts don't make sense to me, and I've been observing this whole mess for a very long time. What you're saying reads as if the Linux Foundation should be the heavies for a private company that has never-not-once played by the same rules as the cooperative development community they work outside of.
    - sighsagain 9y ago
      Wind River is owned by Inter which is in the Linux Foundation funding KSPP to rip off more of grsec. It's very related wouldn't you say?
sighsagain 9y ago
Their research is orthogonal to the platform. Some stuff was implemented by MS and Apple into their OSes as well. They produced ground breaking research only to have the linux foundation (which includes intel which is one of the companies that messed with trademarks of grsecurity) pay someone else to copy it over so they can make grsecurity obsolete and then get called clown by the upstream.

sjellis 9y ago

"2016-2017: - Linux foundation founds KSPP and works on integrating basically PaX/grsecurity into mainline - does not even ask grsecurity or PaX if they want to get paid for helping but they are flamed at and bothered with inquiries from devs - according to grsecurity most of KSPP work is copy&paste the grsecurity code without deeper understanding" I don't follow this stuff closely, but I believe that the KSPP was started by Kees Cook because other approaches had failed: grsecurity/PaXTeam had been unwilling to cooperate to get their patches upstream for a long time, so the only way to move things forwards for everybody was to re-implement the functionality without PaXTeam.

sighsagain 9y ago
KSPP which is made up of a few corporations in the linux foundation pay Kees Cook to copy the grsec/pax patches basically. They never approached grsecurity about paying them to upstream their work. No one did. They are only paying people to rip off their work.

michaelmrose 9y ago

Their groundbreaking research was improvements that were directly derivative of work shipped with a license that said all derivative works must be provided under the same free license they received the work with. Your tone seems to suggest that some obligation exists that some obligation exists to do more than share the source to any improvements. This obligation is wholly and totally imaginary. Its as if someone gave another party an entire farm and in the contract specified that he could eat some of the food that grew from it and that someone threw a fit when the first party walked up and made a sandwich. Seeing as there is no sane and legal way to require anyone to pay for said patches the reasonable way to fund such an effort is to get the community to voluntarily fund such an effort with whatever platform is most useful preferably in advance. It seems that they have instead chosen to rely on a mixture of manufactured drama, illegal threats, and general unpleasantness to keep their efforts from being well integrated with mainstream. While this remains so they can offer definable value. In the long run I predict bankruptcy and irrelevance for a company that few care about now and none will care about later.

hitekker 9y ago
Yeah, the parent's summary is tripe and implies that the GRSecurity is somehow faultless in the drama they've vehemently instigated time and time again. I'm having trouble seeing, apart from ignorance or misinformation, why anyone would condone GRSecurity. The code is helpful but you wouldn't want the authors in a position of authority over the operating system of a billion-plus computers. Right now, most arguments in defense of GRSecurity are simply: "Two sides are arguing, therefore they're both wrong. Aren't I smarter for pointing it out?"
sighsagain 9y ago
Their research are in no way 'directly derivative' of the linux kernel. Their implementation was based on linux, but since then Microsoft and Apple have all adopted their RESEARCH of novel ways to eliminate entire CLASSES of bugs in their operating systems and as a result are far ahead of vanilla linux in this area. KSPP is a program started by some corporations (including Intel which is the parent company that was being talking about that messed with trademarks) and they pay some developers (such as kees cook) to rip off grsecurity/PaX code. It's funny how you talk about obligation when linus is here calling them clowns for their code which has for years protected systems which would otherwise be vulnerable such as vanilla linux kernels just because they are not in the format that the linux upstream wants? Doesn't hero worship get tiring? You make predictions about something you are seemingly ignorant about because they have customers because some people can't rely on the joke that is upstream linux security.

deleted 9y ago

[deleted]