6 ms·
Linus Torvalds on the "security circus" (2008)
- raz0r 16y agoOh, the The Linus Circus is in town again. Good times.
- KonradKlause 16y agoWhy are you down-voting this?
- socillion 16y agofrom HN comment guidelines (http://ycombinator.com/newsguidelines.html http://ycombinator.com/newsguidelines.html) "That is an idiotic thing to say; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3." Parent comment can be shortened to "". Please avoid introducing classic flamewar topics unless you have something genuinely new to say about them. Resist complaining about being downmodded. It never does any good, and it makes boring reading.
- KonradKlause 16y agoAnd which rule is "Oh, the The Linus Circus is in town again. Good times." violating? It's a funny statement. I like it. I cannot see any flamewar topic in it...
- socillion 16y agoA good litmus test for knowing whether to post a comment on HN: is it useful? If it is merely funny, trolling, or otherwise flippant, there are many other sites where such posts are at least tacitly encouraged.
- KonradKlause 16y agoSorry, this is exactly why HN sucks. Am I not even allowed to criticize you or ask questions?
- JoeAltmaier 16y agoSure, asked and answered. But this question in particular is discouraged. Follow HN for any length of time and you see the answer. If you want a meta-thread about posting, create one. But this thread is (was) about security.
- nollidge 16y ago> Am I not even allowed to criticize you or ask questions? Sure you are. You're also welcome to leave if the community norms for voting are not in line with your own.
- ascendant 16y agoAll communities have some degree of self policing. Those that allow any commentary to go by usually end up embroiled in vitriol and snark. HN strives to keep a specific level of intelligence (to varying degrees of success). As was stated elsewhere, and I mean no disrespect by this, if the community-enforced standards of comment quality do not appeal to you, you have the choices of (A) not commenting, (B) spending more time asking yourself if your comments will be deemed acceptable by the community or (C) leaving. I too like to fire off witty, snarky comments. But after a few of them got torn apart vote-wise, I now spend more time asking myself if I will be adding anything useful to the discussion. While I try to refuse the allure of groupthink just so I can get the rush of seeing my karma count move up, I do attempt to at least find a way to state my opinion in a way that is palatable and intelligent.
- raz0r 16y agoYeah, sorry, I don't agree with that because I don't give a fuck about my rating, or karma or whatever the fuck you're calling it on HN, so I comment anyway. You should do that too instead of "spending more time asking yourself if you will be adding anything useful to the discussion". ;) My point was that Linus is an idiot and it can be as informative as any other comment for people who don't already know that. My two cents.
- ori_b 16y agoHe's wrong. Security bugs affect people who might not be using the system at the time, while ordinary bugs only affect the one user. If a server with credit card information permanently corrupts the filesystem, and bricks all the hardware, and more or less does the worst that a non-security related software failure can do, the server gets reimaged or replaced. It costs maybe a few thousand dollars to replace. Nobody is really affected because failures are expected. If a server with credit card information has a security bug, then credit card fraud and it's associated costs have to be dealt with, identities might have been stolen, and in general, large numbers of people are affected, possibly severely.
- nonUser 16y agoTell him.
- acqq 16y agoPlease read this, here is the point of the discussion, I think this more informative text should have been linked: http://lkml.org/lkml/2008/7/15/498 http://lkml.org/lkml/2008/7/15/498 He simply doesn't want to make it easier for "exploitz searchers" to recognize which bug patches are "easy to make an exploit."
- CrLf 16y agoThe thing is, ordinary bugs can also be security bugs. People that fix ordinary bugs then also end up fixing many security bugs that are not classified as such. These are the unsung "heroes". I think his point is that the important part is working on fixing bugs, and not making a show out of finding security ones.
- fmx 16y agoAgreed. His broader point about not "glorifying" security researchers is valid, but he goes way too far when he says security bugs aren't more important. There is no point in telling him he's wrong, either. He'll just call you a "masturbating monkey".
- jasonlotito 16y ago
- BasDirks 16y agotl;dr: Linus thinks "the OpenBSD crowd is a bunch of masturbating monkeys"
- nasmorn 16y agoIt is so sad that Wikipedia doesn't feature IMDB style quotations in its bios. This one would really make Linus' read less drab.
- michael_dorfman 16y agoCan someone edit the title to add "(2008)"?
- TheBoff 16y agoI think perhaps he is slightly over reacting to get his point across. Whilst security bugs may well be worse than a lock up (due to stolen data etc.), they aren't the be all and end all of the system. I think he thinks that perhaps the security people won't pay any attention to his point unless he is very ... blunt about it.
- Tharkun 16y agoWhy exactly is this is on HN? It's not only very old, but it's also just plain stupid.
- JoachimSchipper 16y agoThis won't be popular, but: Linus' attitude is part of why Linux sucks at security. Go to e.g. osvdb.org, search for 'Linux kernel': 878 results. Search for 'Solaris', which includes many non-kernel vulnerabilities: 595 results; search for 'freebsd': 171, including e.g. ftpd issues; search for 'OpenBSD': 93, again including stuff like an XSS in OpenBGPD's bgplg (very much not part of the kernel!) This is not merely historical; Full-Disclosure readers get a "vulnerabilities in Linux kernel: 20 issues fixed" every month or so. Yes, Linux has some really nifty stuff, lots of people are looking at it, and things like GrSecurity can be useful. But it also has a lot of (local) kernel-level vulnerabilities compared to similar pieces of software.
- ema 16y agoJust because more linux security bugs are found dosn't mean that linux has more security bugs. I think there are far more linux boxen connected to the internet than solaris and *BSD, so the incentive to search for vulnerabilities should also be greater.
- iuguy 16y agoLinux has more security bugs because it's a tangled mess of spaghetti code, large sections of which aren't particularly well maintained. Seriously, try looking for dangling pointer bugs, there's tons, you can just pluck them from the trees. Here's a comment I posted a while back that might be of interest: http://news.ycombinator.com/item?id=2301830 http://news.ycombinator.com/item?id=2301830
- KonradKlause 16y agoThen please start fixing all these bugs and submit patches!
- tptacek 16y agoSpent much time crawling through BSD driver code, have you?
- tptacek 16y agoAncient. I stand by my response the first time this appeared on HN: http://news.ycombinator.com/item?id=247753 http://news.ycombinator.com/item?id=247753
- BrandonM 16y agoThanks for that link... the context and information there is very good. As an aside: Holy crap! Reading that thread reminded me how high signal/noise used to be on HN. Quite sad.
- tptacek 16y agoI blame story selection. There is a pronounced unmistakable bias towards bullshit controversies on HN.
- ajross 16y agoIndeed. I flagged this. Digging up 3-year-old flames? Is that really the level of discourse we want?
- tptacek 16y agoUnfortunately, because HN is markedly bigger now than it was in 2008, this story is already over 80 votes and the flags aren't going to do anything. The flag weights need tuning.
- Vivtek 16y agoWell, nobody ever said Linus Torvalds kept his opinions a closely held secret.
- udoprog 16y agoThe week would not be complete w/o a Linus rant.
- josefresco 16y agoIt's the old academic vs. real world dilema just re-framed around operating systems. Is it worth securing the OS to the detriment of bug fixes? Will users be happy with a secure but buggy OS? The answer is always a balance between the two, but I think Linus is right to knock 'security' off the pedestal as the most noble of pursuits. Security alone isn't enough.
- protomyth 16y ago"I think the OpenBSD crowd is a bunch of masturbating monkeys, in that they make such a big deal about concentrating on security to the point where they pretty much admit that nothing else matters to them." - Linus Torvalds http://www.openbsd.org/goals.html http://www.openbsd.org/goals.html - OpenBSD goals (security is #3). I still think it was a cheap shot and not representative of the project. Goal #2 seems to get a lot more play in heat from the OpenBSD project.
- sedachv 16y agoLinus likes to run his mouth about things he doesn't know, and unfortunately, people listen. OpenBSD is great because of everyone's obsessive focus on quality. This means fixing bugs (all security exploits are bugs), providing clean interfaces, and keeping garbage out of the system. Linux development tends to be a lot more "pragmatic," which in practice means trying to hide bugs (http://seclists.org/fulldisclosure/2008/Jul/276 http://seclists.org/fulldisclosure/2008/Jul/276), being ok with providing a crapload of weird, incompatible, non-unixy interfaces to do things (compare Linux wireless configuration vs. OpenBSD's ifconfig), including binary blob garbage with the kernel, and relying on bloatware like Gnome.
- ciupicri 16y agoI must say that Linux managed to beat them at goal #1 ("including the ability to look at CVS tree changes directly") by using git instead of CVS.
- protomyth 16y agoI don't think choice of git over CVS really has anything to do with the goal or history of why it is a goal.
- ciupicri 16y agogit is easier to use than CVS and more practical because of its speed and distributed nature. Add the (controversial) topic branches to the mix and you have an easy way to contribute the project or make your own custom fork. Sure if you look just at the source code, I agree that the one for OpenBSD looks better than the one for Linux.
- InclinedPlane 16y agoLikely scenarios resulting from various system defects: Non-security defect: system goes down for a while, company loses money, possibly data, reputation suffers. Companies using sensible redundancy and backup procedures are able to recover. Security defect: system is compromised, user data stolen, internal company secrets stolen, financial data stolen, financial instruments (CC data) stolen. Massive impact on the company and on the customers, much higher potential for the destruction of the company due to damage to its brand and its business.