3 ms·

I don't think he's exploding at all ('cept for maybe the comments about the OpenBSD crowd). He has a very valid point: all the boring normal bugs are _way_ mor

by dominik 18y ago

I don't think he's exploding at all ('cept for maybe the comments about the OpenBSD crowd). He has a very valid point: all the boring normal bugs are _way_ more important. Security bugs are just a special case of normal bugs, a test condition unaddressed.

delano 18y ago
Part of the problem is that the term "security" has taken on a very narrow meaning. A bug that crashes a word processor has just as much to do with security as one that allows an escalation of privileges.
- tptacek 18y ago
  Exactly how is it that you figure that a Word'07 crasher is "just as bad" as Word'07 remote code execution? Losing my most important document is still far less damaging to me than losing all my browser cookies, which is what the attacker in the latter scenario wins.
  - delano 18y ago
    Ya I agree, if you compare the two directly but you have to consider the chance of either event occurring. A highly likely crash that destroys my most important document is more serious to than the much less likely event that an attacker would specifically choose my computer. My point is to broaden the notion of security, not to attenuate concern over remote attacks.
    - tptacek 18y ago
      Huge numbers of people have their machines drafted into botnet by drive-by clientside document vulnerabilities like this. Nobody has to choose you as a specific target to make that happen.
tptacek 18y ago
That's not a very valid point. None of the boring normal bugs cost my mom her credit score or, for the months it takes to resolve the problem, her savings account balance. There has also never ever ever been an X11 bug that took down the Internet. There is also a CS-theoretic difference between "all the boring normal bugs" that emerge during variations of normal use cases, and the much larger, much harder to model class of byzantine failures that occur only when components of the system are forced to operate at odds with the the system as a whole. Security failures are byzantine failures. They are, at the very least, extremely difficult to predict and plan for.
- dominik 18y ago
  From what I've seen, most security bugs chain a few normal bugs together. One oversight here, another there, combine them and you have an exploit. The valid point I think Linus is getting at (perhaps I'm reading too much into it) is that if you solve normal, boring bugs, you prevent the much trumpeted security bugs from ever coming out. By heaping praise on the security team and ignoring the careful programmer who writes good code and eliminates bugs before they exist, Linus sees the community move towards a crisis-solving mode rather than a crisis-prevention mode. His view is that it's far better to focus on writing good, solid code that tests robustly rather than hyper-focusing on security at the cost of everything else. This is not to dismiss the importance of security; instead, it is a fundamental focus shift -- thus the example of OpenBSD, where Linus sees security paranoia has subsumed everything else.
  - tptacek 18y ago
    The valid point you're making is not Linus', it's Theo's. It's OpenBSD's approach --- and they pioneered it --- that "all bugs are eventually exploitable". That dogma, which some people say has served them well, contributes to the impression that OpenBSD is (1) fascistic about technical matters that at first glance seem more about vanity than about security, and (2) hypocritical in the extreme about what actually happens in their codebase. What Linus is saying really doesn't have anything to do with security. What he's saying is, "my job is to improve Linux, and if you give me a valid bugfix, I will treat it the same way I treat any other important bug".

by dominik 18y ago

delano 18y ago

Part of the problem is that the term "security" has taken on a very narrow meaning. A bug that crashes a word processor has just as much to do with security as one that allows an escalation of privileges.

tptacek 18y ago
Exactly how is it that you figure that a Word'07 crasher is "just as bad" as Word'07 remote code execution? Losing my most important document is still far less damaging to me than losing all my browser cookies, which is what the attacker in the latter scenario wins.
- delano 18y ago
  Ya I agree, if you compare the two directly but you have to consider the chance of either event occurring. A highly likely crash that destroys my most important document is more serious to than the much less likely event that an attacker would specifically choose my computer. My point is to broaden the notion of security, not to attenuate concern over remote attacks.
  - tptacek 18y ago
    Huge numbers of people have their machines drafted into botnet by drive-by clientside document vulnerabilities like this. Nobody has to choose you as a specific target to make that happen.

tptacek 18y ago

That's not a very valid point. None of the boring normal bugs cost my mom her credit score or, for the months it takes to resolve the problem, her savings account balance. There has also never ever ever been an X11 bug that took down the Internet. There is also a CS-theoretic difference between "all the boring normal bugs" that emerge during variations of normal use cases, and the much larger, much harder to model class of byzantine failures that occur only when components of the system are forced to operate at odds with the the system as a whole. Security failures are byzantine failures. They are, at the very least, extremely difficult to predict and plan for.

dominik 18y ago
From what I've seen, most security bugs chain a few normal bugs together. One oversight here, another there, combine them and you have an exploit. The valid point I think Linus is getting at (perhaps I'm reading too much into it) is that if you solve normal, boring bugs, you prevent the much trumpeted security bugs from ever coming out. By heaping praise on the security team and ignoring the careful programmer who writes good code and eliminates bugs before they exist, Linus sees the community move towards a crisis-solving mode rather than a crisis-prevention mode. His view is that it's far better to focus on writing good, solid code that tests robustly rather than hyper-focusing on security at the cost of everything else. This is not to dismiss the importance of security; instead, it is a fundamental focus shift -- thus the example of OpenBSD, where Linus sees security paranoia has subsumed everything else.
- tptacek 18y ago
  The valid point you're making is not Linus', it's Theo's. It's OpenBSD's approach --- and they pioneered it --- that "all bugs are eventually exploitable". That dogma, which some people say has served them well, contributes to the impression that OpenBSD is (1) fascistic about technical matters that at first glance seem more about vanity than about security, and (2) hypocritical in the extreme about what actually happens in their codebase. What Linus is saying really doesn't have anything to do with security. What he's saying is, "my job is to improve Linux, and if you give me a valid bugfix, I will treat it the same way I treat any other important bug".