User: Password:
|
|
Subscribe / Log in / New account

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 6:10 UTC (Mon) by px43 (guest, #89407)
In reply to: How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com) by clopez
Parent article: How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

I'm pretty sure spender doesn't work on grsec professionally for the same reason that Linus doesn't work on Linux professionally. If he had to declare loyalty to one company, it would create a conflict of interest. I'm sure any of those places would hire him in a heartbeat if he actually showed any interest. We really do need people like him though, not worrying about politics and doing the shit that needs to be done. Others like bliss and kees can do the rest and work on getting things upstreamed :-)


(Log in to post comments)

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 6:26 UTC (Mon) by dlang (subscriber, #313) [Link]

> ..for the same reason that Linus doesn't work on Linux professionally.

Umm, Linus does work on Linux as his full-time paid job, he has for quite a few years.

He avoided working at any distro, but he is one of several people who are paid by the Linux Foundation to work on Linux full-time.

creating fixes that almost nobody runs isn't a very effective thing to be doing. if they produced 1/10 as many fixes, but those fixes got into the upstream kernel their effect on the world would be much larger.

The problem is that they want to just say "security says we need to do this" and have whatever they have provided accepted.

the kernel people want to understand what the problem is, look at the impact of doing things, and try to find a solution that both solves the problem and doesn't hurt performance. That's not what Spender and Paxteam want, they seem to want people to accept and run whatever they provide.

There are other developers who work this way, and a few of them do have an impact (Theo, djb, and Jörg Schilling are three examples), but they end up fading from relevance over time as other people who work better with others are more effective.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 7:32 UTC (Mon) by imitev (guest, #60045) [Link]

> the kernel people want to understand what the problem is, look at the impact of doing things, and try to find a solution that both solves the problem and doesn't hurt performance.

My feeling with kernel security is that performance and compatibility with broken stuff gets the priority over security. LWN's fine editors have been outlining the lack of focus on security - albeit with diplomacy and subtlety - for quite some time, so it's not just me.

grsecurity is GPL, so the personality of developers isn't relevant: whatever they think of Spender's behavior, any of the kernel people you mention could rip and push gresecurity solutions/concepts upstream. But this doesn't happen. So 1/ either kernel people who have enough "power" to push for such changes are not interested in security, or 2/ they won't look at spender's work just because they don't like him, or 3/ grsecurity features are useless. Kernel devs are not in kindergarten and if we assume that security-conscious companies who use grsecurity know what they are doing, that leaves us with 1/

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 7:56 UTC (Mon) by dlang (subscriber, #313) [Link]

Well, he would have to make a case that he needed to be paid by them.

And as part of the application, he would need to show that he can work with the community, which would be a fairly hard thing to do given his current attitude

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 8:06 UTC (Mon) by dlang (subscriber, #313) [Link]

or 4, they respond when someone points out a problem and work to close that problem, but are not willing to sacrifice performance based on theoretical problems that they see no possible way to exploit.

They are also far too busy reviewing and accepting code where the author wants it to be part of the kernel to go hunting around for code that may exist, may or may not have bugs, may or may not apply to the core kernel without problems, and may or may not even be legally released.

one of the side effects of the SCO fiasco is that they require that people attest that they have the right to contribute the code that they submit. Just saying 'someone slapped a GPL tag on it' isn't going to be good enough

The kernel developers have removed code that they had the legal right to include in the kernel because the author of the code wanted them to. They aren't about to go hunting for code who's author may oppose what they do with it.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 10:20 UTC (Mon) by imitev (guest, #60045) [Link]

> or 4, they respond when someone points out a problem and work to close that problem, but are not willing to sacrifice performance based on theoretical problems that they see no possible way to exploit

Well the *class* of exploits that grsecurity prevents looks rather practical to me (and if it was only theoretical why would security companies even bother using it?), so we'll have to agree to disagree.

> The kernel developers have removed code that they had the legal right to include in the kernel because the author of the code wanted them to.

Code != concepts. So OK, the problem is then with patents.
Let's have a look at virtualization: one would think that it's a patent minefield compared to security, but we continue to enjoy a steady rate of improvements and new features in that area. Maybe it's just that it's more fun and interesting to develop than security. Or not: companies make money selling virtualization products, or save money buying them to optimize their computing resources. Meanwhile, security is not only costly, with no immediate benefits, but it also prevents your employees from getting the work done in a quick&dirty way, it makes users yell at sysadmins, and a few other dozen complaints. You just realize how nice it would have been when your systems are compromised. And on the other side, if you invested in it, you might not see any effect since you effectively decreased the chance somebody would manage to hack you. I'm wandering too far, but the point is that security is a difficult sell, I don't think it has anything to do with legal stuff. People are just not interested.

> Well, he would have to make a case that he needed to be paid by them

I don't understand how your comment relates to what I've written.
There seems to be an assumption that Spender needs money and should be paid to push features upstream; I hope for him he's already well paid between sponsoring, consulting, and (maybe) selling exploits. I anticipate you'll ask why he's then bothering trying to advertise his superior features, maybe he's just trying to prove a point and have some recognition for the work he's doing - very human, after all. Granted, with a complete lack of diplomacy.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 7:15 UTC (Mon) by anselm (subscriber, #2796) [Link]

I'm pretty sure spender doesn't work on grsec professionally for the same reason that Linus doesn't work on Linux professionally. If he had to declare loyalty to one company, it would create a conflict of interest.

If that were the case, the obvious move would be for the Linux Foundation to pay him a stipend just like they're paying Linus.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds