Slashdot Mirror
Linus's Thoughts on Linux Security (washingtonpost.com)
Rick Zeman writes: The Washington Post has a lengthy article on Linus Torvalds and his thoughts on Linux security. Quoting: "...while Linux is fast, flexible and free, a growing chorus of critics warn that it has security weaknesses that could be fixed but haven't been. Worse, as Internet security has surged as a subject of international concern, Torvalds has engaged in an occasionally profane standoff with experts on the subject. ...
His broader message was this: Security of any system can never be perfect. So it always must be weighed against other priorities — such as speed, flexibility and ease of use — in a series of inherently nuanced trade-offs. This is a process, Torvalds suggested, poorly understood by his critics. 'The people who care most about this stuff are completely crazy. They are very black and white,' he said ... 'Security in itself is useless. The upside is always somewhere else. The security is never the thing that you really care about.'"
Of course, contradictory points of view are presented, too: "While I don't think that the Linux kernel has a terrible track record, it's certainly much worse than a lot of people would like it to be," said Matthew Garrett, principal security engineer for CoreOS, a San Francisco company that produces an operating system based on Linux. At a time when research into protecting software has grown increasingly sophisticated, Garrett said, "very little of that research has been incorporated into Linux."
His broader message was this: Security of any system can never be perfect. So it always must be weighed against other priorities — such as speed, flexibility and ease of use — in a series of inherently nuanced trade-offs. This is a process, Torvalds suggested, poorly understood by his critics. 'The people who care most about this stuff are completely crazy. They are very black and white,' he said ... 'Security in itself is useless. The upside is always somewhere else. The security is never the thing that you really care about.'"
Of course, contradictory points of view are presented, too: "While I don't think that the Linux kernel has a terrible track record, it's certainly much worse than a lot of people would like it to be," said Matthew Garrett, principal security engineer for CoreOS, a San Francisco company that produces an operating system based on Linux. At a time when research into protecting software has grown increasingly sophisticated, Garrett said, "very little of that research has been incorporated into Linux."
Linus Torvalds: ...Security of any system can never be perfect. So it always must be weighed against other priorities — such as speed, flexibility and ease of use — in a series of inherently nuanced trade-offs....
Fortunately, there are open source operating systems available where security is less of a trade-off and more of a priority, such as OpenBSD, where the developers maintain a laser focus on security.
No.
It's the very height of arrogance to not consider safety. Security isn't about paranoia, it's about bad guys, and there are a huge number of them, using coder stupidity and this sort of arrogance to rob people of real money, or ransom systems.
It's an enormous failure of engineers that don't put safety first while trying to be faster, cooler, or wittier than the next engineer. You can call it artistic creation, egalitarianism, but without the concern for the safety of others, it's boorish, arrogant, and rife for misdeed.
---- Teach Peace. It's Cheaper Than War.
Linux the OS certainly has had numerous real-world security problems that need to be addressed. I don't particularly care about the semantics of "Oh it's just a kernel!" because I could play the exact same game with Windows where Windows kernel vulnerabilities aren't super common either. Guess what: Linux and Windows both run the same web browsers these days, and that's a cross-platform security hole no matter who wrote the kernel.
Additionally, the biggest security hole I see now is Android due to the fact that it's damn near impossible to actually get upgraded software to fix the numerous holes.
However, Torvalds' direct responsibility is the kernel, so in this particular context I'm not going to give him too much grief. The Linux kernel does actually include extremely sophisticated mandatory access control systems like AppArmor, SELinux, etc. However... and this goes to his point... these systems are used sparingly because they are REALLY complex and lead to all kinds of usability issues for unsophisticated users (And "unsophisticated" here could easily mean a skilled Unix sysadmin with years of experience. These MAC systems are *not* considered "normal" in UNIX).
So basically: Yeah, Linux is not perfect. Nothing out there is perfect. However, the kernel actually does have a bunch of sophisticated security facilities. Maybe more work should go into making these sophisticated security features more accessible and useful to regular people.
AntiFA: An abbreviation for Anti First Amendment.
We are talking about securing tools. But the point is that tools do things. We want tools to help us to accomplish the things that the tools do.
A perfectly safe hammer is entirely possible. Make it out of flame-resistant, soft, synthetic materials and fill it with something equally soft. Shape it more like a ball than like a stick, so no-one can accidentally stick it in their mouth and suffocate.
Of course, now you have something that can't be used to pound in nails—but it's entirely the safest hammer on the planet.
Will anyone buy it or use it? Of course not. And they'll still need something with which to pound in nails. That's Linus' point.
STOP . AMERICA . NOW
TFS makes the article look rather balanced, but if you actually read it, it's pretty clearly FUD attempting to make the kernel team look indifferent (or even incompetent) regarding security. It blames the "towelroot" Android exploit as being the fault of Linux, and compares Linux security to car manufacturers in the 1960s willfully avoiding seat belts and other safety mechanisms. Was the author bribed by Microsoft?
He's trying to say that if people want powerful, flexible networking, they'll choose an 80% safe OS that enables this easily over a 90% safe OS that imposes lots of overhead costs to make it possible; that people will choose a 60% secure OS that runs their processing jobs in 3 hours over an 85% secure OS that runs their processing jobs in 6 hours.
He's pointing out that people like security well enough, but they want to get stuff DONE even more, and that most people will take the calculated risk to be less secure if it makes them more productive at lower costs. That if there is a less secure but more productive option, up to some arbitrary point (that is different in each case, but that can be inferred by the movement of markets and communities as a whole), they'll choose the more productive option.
And that there is no point in saying "then all of us that produce these things must get together and make highly secure, if less capable stuff, so that all choices are equally highly secure!" because as soon as that happens, a garage coder somewhere is going to have a project on github that says "I got tired of waiting for jobs to finish, so I wrote my own from scratch. It's totally insecure, but damned if it doesn't finish the job in half the time!" and that people will immediately flock to it.
In other words, his goals for Linux aren't for Linux to be the most secure OS on the planet, but to be one of the most useful and used ones.
STOP . AMERICA . NOW
It's not about Microsoft. It's about Lucky Linus not getting the message, being arrogant, and permeating a culture where loose-and-fast is better than thinking of security risks.
---- Teach Peace. It's Cheaper Than War.
Matthew Garrett again trying to remove Linus from the equation. First they tried with the rants angle, now with the "security" aspect. pure FUD
If the job was only about securing data, then security professional's would recommend destroying the data. The military has been known to do exactly this. Destroying the data creates the ultimate security.
What makes security people into security professionals, is that the professionals can design systems that allow authorized activities happen smoothly while simultaneously keeping out the bad guys. That is a much harder task than simply securing the data against unauthorized access. It requires the professional to focus on the balance between usability, security and profit.
Ahem ... I think maybe you don't fully understand, It's not that kernel security is entirely unimportant. It's that the idea that you can or should fix imaginary security problems in the kernel seems kind of ditzy. It's sort of like protecting New York City from terrorists by hiring more police and assigning them to florist shops. Yes, that would presumably discourage terrorist floral attacks. But since when are those a known or potential problem?
If you want to secure computing, then reduce attack surfaces dramatically. Don't hook everything in sight up to the same internet. Cut way back on the number of protocols in use. Lose idiocy like Javascript. Fix eccentric cookie behavior, etc, etc, etc.
If, after doing that, it turns out there are exploitable holes in the kernel -- say a flaw that allows a carefully crafted IP packet to make arbitrary changes to the system or a way for the janitor to inject a privileged process from a USB stick into people's desktop PC startup while he/she is emptying the wastebaskets -- I doubt there will be any resistance from Torvalds or anyone else to fixing them.
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
And you know what happens when some security measures make something unusable? The users create workarounds, making the whole security effort pointless.
With intel vPro or an iLO system, I can just ssh in, turn the machine on, upload a CD image, boot the machine from the virtual image and snarf everything. Being off doesn't mean it is secure these days.
Your analogy doesn't seem accurate. It's more like if you had a hammer - all hammerlike and useful, but because of the laziness of the hammer creator, can be remotely made to fly around your workshop smashing into things by anyone wishing to make it do so.
The security holes which do not affect functionality should be fixed, and commonly are not. That is the problem.
I find it highly amusing that people who worry about security tend to be those who want to shoehorn shit like kdbus into the kernel.
that doesn't inconvenience the user.
That's the real key take away, and the point people like to talk past. It's like a full harness versus a seat belt. A full harness would be objectively safer if used, but fewer people are going to go to the hassle of connecting up a full harness every time they drive and so the seatbelt from a practical standpoint is the better choice to offer to customers of the automotive industry.
XML is like violence. If it doesn't solve the problem, use more.
Depends on your definition of 'decent'.
Distributions that have made strict use of SELinux to tightly lock things down may be 'decent' to security folks, but terrible to use, causing people to just turn it off.
Distributions that have piled tons of permissive policies to make some moderately useful environment get derided by security folks as being too lax, though they at least get to enforce the restrictions they designed.
It's impossible to make both people trying to get their work done and hard core security guys happy...
XML is like violence. If it doesn't solve the problem, use more.
To further your point, unplug your computer from power and it's 100% safe from remote attacks.
What Slashdot readers hear: "Linux is not BSD."
What normal people hear: "Linux is a terribly insecure OS from some total asshole, who by the way doesn't give a shit."
Mainstream Media's message: "Better stick with Microsoft Windows; it's the only thing that's secure."
I agree that operating system engineers should not get bogged down in details of security. What they should do, however, is concentrate on those aspects of security which equate to quality, especially stability and transparency. Not crashing in response to unusual input and handling overloads gracefully are really important aspects of security. Likewise, the ability to see what is going on in your OS is fundamental to security. For example, I have argued for some time that the addition of DTrace to Mac OS X is an important security feature. The reaction I get is "That's just a debugger." No, the ability to understand what's going on is absolutely necessary to security. These things do not degrade the user experience or make an OS less usable. They make it better.
As a security expert, I fully agree. Security is something that you need to think about from the beginning, but you only ever need enough that your residual risks are acceptable.
These "critics" often do not get how to do professional risk management (Linus does) and, quite often, I get the impression they do not have any significant coding experience, as they seem to think the changes they would like are easy to implement. I run into these black vs. white people in security quite frequently. These are the amateurs that do not understand that actually building things that work is already very, very hard and if you keep changing things all the time you just end with a dysfunctional, insecure mess. Also, you want a stable product, you incorporate research results only after they have been tested out in practice for a few years and only if they bring you a significant gain.
The Linux kernel has an excellent security track record in its core. Some drivers are not that good, but that is why if you need high security, you only compile those that you really need.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.