3 ms·

Written in C, huge codebase, decades of alienating security researchers, etc.

throwaway894345 5y ago
Is this "Linux is garbage" opinion shared broadly by security researchers? I did some Googling around about opinions, and I didn't find anything that suggested that this view is widely shared by security researchers (I found some claims that security researchers held Linux in high regard, but those claims themselves didn't seem particularly authoritative). Also, what is "alienating"? (I don't have much of a view into interactions between kernel maintainers and security researchers) As for "written in C", what production-grade kernels aren't written in C?
- staticassertion 5y ago
  > Is this "Linux is garbage" opinion shared broadly by security researchers? Everyone I know would agree, yeah. I think the infosec world is probably more or less aligned on this, as much as anything, although that's a low bar and there is no single infosec community. > what is "alienating" Decades of Linus and Greg insulting or attacking security researchers in various ways. It's become pretty antagonistic on both sides I think. > As for "written in C", what production-grade kernels aren't written in C? None afaik. It just all jumbles together to paint the 'garbage' picture.
  - throwaway894345 5y ago
    Fair enough. While I understand that there may not be any body which perfectly represents the infosec community, I would be curious if there are any surveys or even statements by somewhat authoritative bodies (something like NIST?). No doubt that Linus is antagonistic. I haven't heard anything that suggests security researchers as a collective have taken it personally (I would expect they, like most people, understand that this is a personality quirk). > None afaik. It just all jumbles together to paint the 'garbage' picture. It seems pretty meaningless and unhelpful to categorize all C software as "garbage". Programming language isn't the only factor in the number or severity of vulnerabilities, and indeed you could have a Rust (or whatever) kernel which has more numerous and/or severe vulnerabilities than the Linux kernel. To deserve the "garbage" designation, I would expect some supporting evidence that the Linux kernel development process lacks rigor. Moreover, "secure" is relative, so if you're going to call the Linux kernel "garbage" then it seems like you should have some kernel which is not "garbage" (and personally my minimum qualification for a "non-garbage" kernel is "production grade" i.e., not a research project).
    - staticassertion 5y ago
      > I would be curious if there are any surveys or even statements by somewhat authoritative bodies (something like NIST?). Hmmm, I'm not sure if anything like that exists, certainly nothing from a standards body. The closest might be recommendations to not rely on things like Linux containers, or to be wary of kernel vulnerabilities. But usually official bodies don't make comments like "this software is bad". > I haven't heard anything that suggests security researchers as a collective have taken it personally I assure you that they do, I know many people who have been active in Linux kernel security for decades. > It seems pretty meaningless and unhelpful to categorize all C software as "garbage". Oh yeah, what I meant is that all of these things are factors. I'm sort of hand-wavingly justifying the "garbage" description. There's a lot of problems that are all interwoven. C is one of those problems. > To deserve the "garbage" designation, I would expect some supporting evidence that the Linux kernel development process lacks rigor. That's fair. I would probably point to the lack of testing/ coverage, the lack of code review, the huge LOC:maintainer ratio. > Moreover, "secure" is relative, so if you're going to call the Linux kernel "garbage" then it seems like you should have some kernel which is not "garbage" I'd have to disagree here. I don't believe I need to have an example of something better in order to point out that there's something bad.

Is this "Linux is garbage" opinion shared broadly by security researchers? I did some Googling around about opinions, and I didn't find anything that suggested that this view is widely shared by security researchers (I found some claims that security researchers held Linux in high regard, but those claims themselves didn't seem particularly authoritative). Also, what is "alienating"? (I don't have much of a view into interactions between kernel maintainers and security researchers) As for "written in C", what production-grade kernels aren't written in C?

staticassertion 5y ago
> Is this "Linux is garbage" opinion shared broadly by security researchers? Everyone I know would agree, yeah. I think the infosec world is probably more or less aligned on this, as much as anything, although that's a low bar and there is no single infosec community. > what is "alienating" Decades of Linus and Greg insulting or attacking security researchers in various ways. It's become pretty antagonistic on both sides I think. > As for "written in C", what production-grade kernels aren't written in C? None afaik. It just all jumbles together to paint the 'garbage' picture.
- throwaway894345 5y ago
  Fair enough. While I understand that there may not be any body which perfectly represents the infosec community, I would be curious if there are any surveys or even statements by somewhat authoritative bodies (something like NIST?). No doubt that Linus is antagonistic. I haven't heard anything that suggests security researchers as a collective have taken it personally (I would expect they, like most people, understand that this is a personality quirk). > None afaik. It just all jumbles together to paint the 'garbage' picture. It seems pretty meaningless and unhelpful to categorize all C software as "garbage". Programming language isn't the only factor in the number or severity of vulnerabilities, and indeed you could have a Rust (or whatever) kernel which has more numerous and/or severe vulnerabilities than the Linux kernel. To deserve the "garbage" designation, I would expect some supporting evidence that the Linux kernel development process lacks rigor. Moreover, "secure" is relative, so if you're going to call the Linux kernel "garbage" then it seems like you should have some kernel which is not "garbage" (and personally my minimum qualification for a "non-garbage" kernel is "production grade" i.e., not a research project).
  - staticassertion 5y ago
    > I would be curious if there are any surveys or even statements by somewhat authoritative bodies (something like NIST?). Hmmm, I'm not sure if anything like that exists, certainly nothing from a standards body. The closest might be recommendations to not rely on things like Linux containers, or to be wary of kernel vulnerabilities. But usually official bodies don't make comments like "this software is bad". > I haven't heard anything that suggests security researchers as a collective have taken it personally I assure you that they do, I know many people who have been active in Linux kernel security for decades. > It seems pretty meaningless and unhelpful to categorize all C software as "garbage". Oh yeah, what I meant is that all of these things are factors. I'm sort of hand-wavingly justifying the "garbage" description. There's a lot of problems that are all interwoven. C is one of those problems. > To deserve the "garbage" designation, I would expect some supporting evidence that the Linux kernel development process lacks rigor. That's fair. I would probably point to the lack of testing/ coverage, the lack of code review, the huge LOC:maintainer ratio. > Moreover, "secure" is relative, so if you're going to call the Linux kernel "garbage" then it seems like you should have some kernel which is not "garbage" I'd have to disagree here. I don't believe I need to have an example of something better in order to point out that there's something bad.