5 ms·

Wait, so when Theo says 'Some BPF-style approaches have showed up. So you need to write a program to observe your program, to keep things secure? That is insane

Wait, so when Theo says 'Some BPF-style approaches have showed up. So you need to write a program to observe your program, to keep things secure? That is insane.' That is fine and dandy, but when someone criticizes Theo's work in the same scornful manner, it's suddenly 'narrow-minded', 'willfully ignorant' and part of a 'vendetta'. Pot meet kettle.

amyjess 11y ago
Yeah, stuff like this reminds me of why OpenBSD even exists: because Theo got kicked out of NetBSD for being unable to stop making personal attacks on the mailing lists.
justin66 11y ago
> That is fine and dandy, but when someone criticizes Theo's work in the same scornful manner, it's suddenly 'narrow-minded', 'willfully ignorant' and part of a 'vendetta'. Attacks on Theo are the opposite of interesting but that spender guy lashes out at his follow commenters: Oh sorry, I forgot LWN readers require me to do all their homework for them And so on. I'm not sure what is going on when a guy who is apparently a professional pulls a from my parents basement in Wyoming I stab at thee! but it's not atypical of LWN comments. On the other hand, there is plenty of useful stuff there sometimes. You take the bad with the good.
- gillianseed 11y ago
  >I'm not sure what is going on when a guy who is apparently a professional pulls a from my parents basement in Wyoming I stab at thee! While 'Oh sorry, I forgot LWN readers require me to do all their homework for them' comes across as a petty remark (though hardly as hateful as you try to paint it), I've read a lot worse from for example Theo who is also 'apparently a professional', and of course from countless other 'apparently professionals', in countless places beyond LWN, like right here on Hacker News (yes, really!). Vezzy-fnord totally disregarded the tone in which Theo characterised existing solutions while painting this spender guy as some bully driven by narrow-mindedness because he came from a 'Linux bubble' and I assume therefore could not accept the brilliance of Theo's solution or something like that. To me it seems like this spender guy is providing strong criticism against this solution from a practical perspective, and vezzy-fnord chose to paint him as a 'narrow-minded' and 'wilfully-ignorant' through his tone (again totally disregarding Theo's same tone) in order to sweep the technical criticism under the rug (don't listen to him, he is on a 'vendetta'!) .
  - justin66 11y ago
    > Vezzy-fnord totally disregarded the tone in which Theo characterised existing solutions Vezzy-fnord was commenting on the quality of LWN comments. It's as if you do not understand that Theo did not comment on that LWN page...
    - gillianseed 11y ago
      Sorry for late reply! >It's as if you do not understand that Theo did not comment on that LWN page... The comments in question where in large responses to Theo's claim, which in turn was part of the article on which the comments are based. Vezzy-fnord used this to paint LWN comment section as being populated by narrow-minded, Linux-centric people with vendetta's, totally ignoring that the comments by 'spender' were perfectly in line with the comments typically uttered by Theo, whose solution was under discussion. And as to further underline how this was all bs from start to finish on Vezzy-fnord's part, the guy in question (spender) who was making the aggressive criticism is not some Linux zealot, he is criticizing Linux security solutions in exactly the same manner.
glass- 11y ago
Because Theo is right, having to write programs to observe programs is insane. While spender is wrong for multiple reasons. Such as that /var is mounted nosuid on OpenBSD by default so their hypothetical "httpd chmod'ing to setuid" doesn't work ("nix" points this out to them but isn't aware of OpenBSD's defaults in this area). The other reason is they are decrying the whole system because of a fairly weak attack scenario (requires a local user account) and it's not like that attack isn't possible now, so while tame() doesn't protect against that specific thing it protects against others but spender is just saying nope, it doesn't protect against this specific scenario therefore it's useless. Also if you keep reading spender's commenters they go on to claim OpenBSD's devs are delusional plagiarists so "vendetta" does seem appropriate.
- _yy 11y ago
  Spender's point is that a capabilities-based approach does not really work for real-world scenarios, and he probably has a point. The setuid thing was more an example as I understood it. While Spender's criticism isn't usually very diplomatic, he's often right. Here's an example, this is QEMU's seccomp whitelist: http://git.qemu.org/?p=qemu.git;a=blob_plain;f=qemu-seccomp.c;hb=HEAD http://git.qemu.org/?p=qemu.git;a=blob_plain;f=qemu-seccomp.... As you can see, it's mostly worthless since QEMU has to do lots of potentially-dangerous operations by design (even reading/writing to raw devices). A proper mandatory access control framework actually restricts which device files it can access, for example - as implemented in the AppArmor/SELinux sVirt drivers. Theo's approach is similarly flawed.
  - vezzy-fnord 11y ago
    capabilities-based approach tame() isn't a capabilities-based approach. Don't confuse POSIX capabilities with actual capability-based security. The former hijacked an existing term to refer to a different thing. It's pretty obviously a limited API, but it also makes privilege dropping absolutely trivial. Which is the point.

amyjess 11y ago

Yeah, stuff like this reminds me of why OpenBSD even exists: because Theo got kicked out of NetBSD for being unable to stop making personal attacks on the mailing lists.

justin66 11y ago

> That is fine and dandy, but when someone criticizes Theo's work in the same scornful manner, it's suddenly 'narrow-minded', 'willfully ignorant' and part of a 'vendetta'. Attacks on Theo are the opposite of interesting but that spender guy lashes out at his follow commenters: Oh sorry, I forgot LWN readers require me to do all their homework for them And so on. I'm not sure what is going on when a guy who is apparently a professional pulls a from my parents basement in Wyoming I stab at thee! but it's not atypical of LWN comments. On the other hand, there is plenty of useful stuff there sometimes. You take the bad with the good.

gillianseed 11y ago
>I'm not sure what is going on when a guy who is apparently a professional pulls a from my parents basement in Wyoming I stab at thee! While 'Oh sorry, I forgot LWN readers require me to do all their homework for them' comes across as a petty remark (though hardly as hateful as you try to paint it), I've read a lot worse from for example Theo who is also 'apparently a professional', and of course from countless other 'apparently professionals', in countless places beyond LWN, like right here on Hacker News (yes, really!). Vezzy-fnord totally disregarded the tone in which Theo characterised existing solutions while painting this spender guy as some bully driven by narrow-mindedness because he came from a 'Linux bubble' and I assume therefore could not accept the brilliance of Theo's solution or something like that. To me it seems like this spender guy is providing strong criticism against this solution from a practical perspective, and vezzy-fnord chose to paint him as a 'narrow-minded' and 'wilfully-ignorant' through his tone (again totally disregarding Theo's same tone) in order to sweep the technical criticism under the rug (don't listen to him, he is on a 'vendetta'!) .
- justin66 11y ago
  > Vezzy-fnord totally disregarded the tone in which Theo characterised existing solutions Vezzy-fnord was commenting on the quality of LWN comments. It's as if you do not understand that Theo did not comment on that LWN page...
  - gillianseed 11y ago
    Sorry for late reply! >It's as if you do not understand that Theo did not comment on that LWN page... The comments in question where in large responses to Theo's claim, which in turn was part of the article on which the comments are based. Vezzy-fnord used this to paint LWN comment section as being populated by narrow-minded, Linux-centric people with vendetta's, totally ignoring that the comments by 'spender' were perfectly in line with the comments typically uttered by Theo, whose solution was under discussion. And as to further underline how this was all bs from start to finish on Vezzy-fnord's part, the guy in question (spender) who was making the aggressive criticism is not some Linux zealot, he is criticizing Linux security solutions in exactly the same manner.

glass- 11y ago

Because Theo is right, having to write programs to observe programs is insane. While spender is wrong for multiple reasons. Such as that /var is mounted nosuid on OpenBSD by default so their hypothetical "httpd chmod'ing to setuid" doesn't work ("nix" points this out to them but isn't aware of OpenBSD's defaults in this area). The other reason is they are decrying the whole system because of a fairly weak attack scenario (requires a local user account) and it's not like that attack isn't possible now, so while tame() doesn't protect against that specific thing it protects against others but spender is just saying nope, it doesn't protect against this specific scenario therefore it's useless. Also if you keep reading spender's commenters they go on to claim OpenBSD's devs are delusional plagiarists so "vendetta" does seem appropriate.

_yy 11y ago
Spender's point is that a capabilities-based approach does not really work for real-world scenarios, and he probably has a point. The setuid thing was more an example as I understood it. While Spender's criticism isn't usually very diplomatic, he's often right. Here's an example, this is QEMU's seccomp whitelist: http://git.qemu.org/?p=qemu.git;a=blob_plain;f=qemu-seccomp.c;hb=HEAD http://git.qemu.org/?p=qemu.git;a=blob_plain;f=qemu-seccomp.... As you can see, it's mostly worthless since QEMU has to do lots of potentially-dangerous operations by design (even reading/writing to raw devices). A proper mandatory access control framework actually restricts which device files it can access, for example - as implemented in the AppArmor/SELinux sVirt drivers. Theo's approach is similarly flawed.
- vezzy-fnord 11y ago
  capabilities-based approach tame() isn't a capabilities-based approach. Don't confuse POSIX capabilities with actual capability-based security. The former hijacked an existing term to refer to a different thing. It's pretty obviously a limited API, but it also makes privilege dropping absolutely trivial. Which is the point.