LWN: Comments on "Multics security, thirty years later"

Multics security, thirty years later

chorning — Tue, 12 Nov 2002 20:07:07 +0000

I'd like to say this entire article is FUD. Having worked on Multics in the early 80's at MIT and been a hardcore "hacker" (the Multics core) I can say Multics is a _lot_ larger than a Linux kernel.. The ring 0 controller is about 700k in memory, but the ring 1 and 2 controllers are huge. The Honeywell Project and Multics were started to solve any possible security problems that the engineers could think of. It ran slow as all users were alloted processor time and memory whether they were logged in or not, as this could be used as a discrete channel.

Just to give you an idea of the size of Multics, in 1982 MIT spent over 7 million dollars on storage alone for the machine the famous Rochlis tapes were archived from (last known good copy of the Multics source) and it had a little over 4 gigabytes of storage.

3 things that Linux can learn from Multics:
1) Security costs performance
2) Security is inversely proportional to useability
3) Operating Systems are not political statements, They are for running programs.

-C. Hornig, hardcore hacker '79-84

Multics security, thirty years later

Baylink — Sun, 15 Sep 2002 03:09:48 +0000

Well, I will be dipped in shit.

The Thompson hack (placing a backdoor in the *compiler*) related in "Reflections on Trusting Trust" actually came directly from the Multics project.

Who knew?

PL/I vs C++

Baylink — Sun, 15 Sep 2002 02:25:59 +0000

And, of course, there are some things that are next to impossible to achieve easily or cleanly in a language where you cannot reasonably perform real-time memory allocation and string sizing...

Multics security, thirty years later

AnswerGuy — Fri, 13 Sep 2002 10:37:07 +0000

I think the real advances in OS security have been KeyKOS and EROS. KeyKOS is dead (as far as I know). However, EROS is under active development and more can be learned about it at: http://www.eros-os.org/

PL/I vs C++

Greyfox — Thu, 12 Sep 2002 15:42:47 +0000

While it's pretty easy to code a buffer overflow in C, it is much harder to do it in C++ as long as you don't treat it as just a better C. Use the C++ features now available and it is very easy to avoid the buffer overflow issue completely.

Of course, C++ programs can easily explode in size and template programming has some very esoteric aspects. I would like to see the usual set of servers coded in C++, though. I'd be far more inclined to trust them over the current batch of C servers.

As far as "Small is Beautiful," if my memory serves me correctly, I seem to recall that there is a dicipline of Japanese painting in which the artist expresses the nature of the object in as few brush strokes as possible. Programming tends to be as artistic an exercise as it is a scientific one, and would seem to follow this form of art.

No, that's 36 bits young man.

beejaybee — Thu, 12 Sep 2002 09:37:48 +0000

Yeah, well, when I started programming seriously (about 1975) I was told in no uncertain terms that if it wouldn't run in 16K (24-bit words - NOT on multics h/w), it wasn't worth writing.

Things have moved on a bit since then, but "small is beautiful" is obviously still a worthwhile concept. Plain straightforward common sense suggests than the bigger a chunk of code is, the more likely it is to contain bugs - and security holes.

No, that's 36 bits young man.

oldtoss — Thu, 12 Sep 2002 08:07:31 +0000

Not that bitness should have a great deal of influence on code size, but FYI Multics used 36 bit hardware (4 9-bit bytes). It isn't clear whether the authors allowed for the difference in byte width, so let's make that 706.5K to err on the safe side. Multics still comes out vastly less bloated. Remember also the Multics hardcore needed much *more* memory management code (relative to i386) to work with a much more primitive MMU. So, now you all know the facts, please don't perpetuate the old FUD about bloat.

16bit versus 32bit?

smoogen — Thu, 12 Sep 2002 03:34:08 +0000

I was wondering about one line quoted above:

...the ring 0 supervisor of Multics of 1973 occupied about 628K bytes of executable code and read-only data. This was considered to be a very large system. By comparison, the size of the SELinux module with the example policy code and read-only data has been estimated to be 1767K bytes.

I am not sure if this is an apples and oranges comparison. One the two architectures used different instruction widths. Second, the number of instructions are comparable. If they were able to code the Multics code for an Intel processor/hardware and get the same size then I think the comparison would be valid.

LWN: Comments on "Multics security, thirty years later"

Multics security, thirty years later

Multics security, thirty years later

PL/I vs C++

Multics security, thirty years later

PL/I vs C++

No, that's *36* bits young man.

No, that's *36* bits young man.

16bit versus 32bit?

No, that's 36 bits young man.

No, that's 36 bits young man.