The details on loading rootkits via /dev/mem [LWN.net]

The details on loading rootkits via /dev/mem

Posted Apr 29, 2009 2:40 UTC (Wed) by dersteppenwolf (guest, #58226) [Link]

I fear part of my comment might be understandable only to a small subset of the readers here, or, the person itself who has been referred. It wasn't just IRIX by the way, although that's likely the least useful of his "achievements". Whether you believe this or not, sir, is moot.

Regarding your "I don't want to use your code" claim, I'll start a short run down on other offensive, troubled and criminal twerps that have successfully contributed to the Linux source code in the past decade:

- Hans Reiser (developer of the reiserfs filesystem, among other things), convicted of second degree murder of his wife, Nina Reiser, mother of two. He further argued she was involved in BSDM sexual activities and made the kids aware of them. Also, argued she was an alcoholic, besides having an affair with another man.Not only he murdered the mother of his children, he also tried to tarnish her reputation even after she was dead. One cool dude.

- Jon "maddog" Hall (instrumental on providing hardware and resources for Linus to finish the very first stable milestones of the kernel), with severe anger management issues which got him his nickname.

- The dozens of other political activists in there who could have an agenda of their own.

The list goes on.

The details on loading rootkits via /dev/mem

Posted Apr 29, 2009 3:09 UTC (Wed) by dlang (✭ supporter ✭, #313) [Link]

Hans Reiser's contributions to the kernel were before his criminal actions (or do you claim that everyone should have known what he would do years later?)

but his attitude and actions had a _lot_ to do with the fact that his later work didn't make it into the kernel (sound familiar here?)

Maddog has been very nice and polite in my interactions with him, so whatever anger management issues that he has don't affect his interactions with the community.

as far as political activists, they keep their politics out of their techinical discussions (and when they don't they get slapped down)

of these examples, Hans is the only one who was really bad in his discussions, and that caused significant delays in any of his work getting added.

the examples that you guys are giving are as bad as Hans at his worst, and you think that people don't want to deal with you or your code (which would mean dealing with you as a maintainer) because they want linux to be insecure????? get real, they just don't want to deal with the abuse.

The details on loading rootkits via /dev/mem

Posted Apr 29, 2009 7:27 UTC (Wed) by nix (subscriber, #2304) [Link]

Actually dersteppenwolf is substantially worse. I've never seen any kernel
contributor act like dersteppenwolf is (maybe he's drunk?)

Hans's problem (er, contribution-related problem, not murder-related
problem) was the same as spender's, as far as I can tell: great
intelligence coupled with an inability to communicate with others without
being/appearing condescending and arrogant, or to adjust one's own
behaviour in response to feedback. It's a real shame... well, again it's
sort of moot in Hans's case, but in spender's, grsecurity is stuck in its
little bubble which rarely improves anyone else's code quality and isn't
very heavily used, when it *could* have improved the security of the
mainstream kernel for everyone. Unfortunately paxteam and spender blur
together in my mind, so I can't recall which of them it was who was
actually *complaining* on l-k, after the last marathon LWN thread, about
people taking ideas from his project and incorporating them into the
kernel while daring not to take the rest in one gigantic unreviewable
lump: no surprise that whichever project *that* was remains largely
ghettoized, then. (Doubtless I'll now get followups from both of them
saying "it wasn't me": guys, I don't care which of you it was.)

The details on loading rootkits via /dev/mem

Posted Apr 29, 2009 8:17 UTC (Wed) by dersteppenwolf (guest, #58226) [Link]

I'm krunk, not drunk. It's just too good that I've got diarrhea, so I can reply to all your substantially meaningless responses from the comfort of my toilet. Otherwise I wouldn't even bother replying.

Thanks sir, for proving yourself to be such an useless entertainment in my days of stomach infection solitude.

Meanwhile, could we get back to the topic at issue? Or choose some other one equally entertaining. How about talking about why kernel developers obscure vulnerabilities as denial of service issues when they are perfectly exploitable?

Regarding splitting up grsecurity and submitting patches to the maintainers, I think it was done in the past with hopeless results, but great attitude.

You know what, I just hope your personal information ends up splattered on some public site someday so we can all look back to this moment and laugh at your utter disregard and arrogance. You read that right. You most likely can't even grasp the nature of PaX or any of its concepts, yet you are here making claims about it. Guess that's why you resort to second guess and criticize the alleged attitude of its maintainer, who has more acumen in this area than any of us, and could possibly papa you about any system internals question.

With all due respect, please go fuck yourself. Now I'm gonna wipe my ass with pages printed from this thread and pray this diarrhea gets sorted out soon or I'll feel too tempted to delve deep into your innuendo. You goddamn pseudo grown up with the maturity and self stem of a 12 year old baboon.

The details on loading rootkits via /dev/mem

Posted Apr 29, 2009 9:01 UTC (Wed) by hppnq (guest, #14462) [Link]

How about talking about why kernel developers obscure vulnerabilities as denial of service issues when they are perfectly exploitable?

If you mean the SCTP one referenced on this page, it looks serious, but it is not "perfectly exploitable" in the real world. You may not (want) to understand this, but in general, people will try to make a realistic assessment of the actual threat -- developers, distributors and also a few serious security researchers.

In any case, security should be discussed and handled by people with at least some grasp of reality. Thinking that anyone can be on the right side of the thin line between right and wrong is part of the problem. It is typical that you don't understand this.

(The patch for the SCTP vulnerability was available last year, by the way. My distribution was updated some weeks ago.)

The details on loading rootkits via /dev/mem

Posted Apr 29, 2009 9:17 UTC (Wed) by nix (subscriber, #2304) [Link]

OK, so as well as being pointlessly insulting you can't read. I never said
that either PaX nor grsecurity were bad. I've used both and think they're
excellent pieces of work and that both the anonymous PaXteam and spender
are superb at spotting holes. They're just hopeless at the social-oil part
which makes it even slightly plausible that anyone else will pick up what
they do in any larger project.

(And, well, I had a dig. One comment during the 2.6 freeze, obviously
hopeless. An attempt by Valdis to split up the non-duplicative-of-LSM,
non-ASLR stuff in 2004: James Morris thought most the remaining bits were
of minimal security benefit (I agree with Valdis here: it's an extra bar,
so what if it's low, the cost is low too), but the thing had a BSD
advertising clause at the time so couldn't possibly go in. A thread in
2005 which foundered in flames, disagreements over worthwhile tradeoffs,
and claims (from a third party) that grsecurity was intrinsically
impossible to split up, which at a then size of 700K would make it
intrinsically impossible to ever merge. I've looked at every archived l-k
message ever to mention grsecurity, and there's no sign that anyone other
than Valdis ever tried to split it up at all.)

... sheesh, why am I even responding to someone whose idea of cogent
argument is poo jokes and threats of identity disclosure? I must be bored.

ENOUGH

Posted Apr 29, 2009 12:49 UTC (Wed) by corbet (editor, #1) [Link]

OK, this thread has gone well beyond anything useful. Please stop here. Now.

"dersteppenwolf": this is not the sort of commentary that is welcome on LWN. You are not the only offender here, but you've been pushing the boundaries. Please stop.

ENOUGH

Posted Apr 29, 2009 17:44 UTC (Wed) by nix (subscriber, #2304) [Link]

*Thank* you.

(I'll admit I suck at knowing when to stop, too. I'll shut up in this
thread as well.)

ENOUGH

Posted May 1, 2009 12:45 UTC (Fri) by dersteppenwolf (guest, #58226) [Link]

Corbet, please accept my most sincere apologies. I couldn't help it but defend myself against the obvious libelous and disrespectful attitude of this person and others, and felt morally obliged to comply with my ethical duties and present my personal perspective on these matters.

I did my best to try to get along and have a well mannered discussion here, but these people aren't the least interested on a civilized interaction. They come here with lies and banter, meaningless follow-ups which don't add anything of interest, but project their flaws and personal views in such a fascist way that any attempt to communicate with them ends in failure.

In addition, when they've been left out of arguments to support their claims, they resort to insulting people and calling them out as 'trolls'. I don't even know what they mean by 'troll' in this sense. Are they trying to make jokes about my physical appearance or disabilities?

Sigh, I had a better opinion of the Linux fan base until today.

ENOUGH

Posted May 1, 2009 13:26 UTC (Fri) by Los__D (guest, #15263) [Link]

o_O

Hats off. That must be the best "fake hurt"-playing I ever saw.

ENOUGH

Posted May 1, 2009 13:28 UTC (Fri) by corbet (editor, #1) [Link]

You're still doing it. I'm honestly uninterested in assigning blame for the direction of this discussion. Please let's just stop.

ENOUGH

Posted May 1, 2009 14:06 UTC (Fri) by dersteppenwolf (guest, #58226) [Link]

OK, I'm done with it as well. Like I said, I tried my best to get along.

BTW, is there any possibility in the future of allowing images to be included in comments? It would be quite beneficial in threads like this and some time ago It was impossible to put some diagrams on a SELinux related thread. Without those it's quite difficult to give proper explanations about some of the security models implemented (including MLS).

Keep up the great work with the site.