Slashdot Mirror
Linus's Thoughts on Linux Security (washingtonpost.com)
Rick Zeman writes: The Washington Post has a lengthy article on Linus Torvalds and his thoughts on Linux security. Quoting: "...while Linux is fast, flexible and free, a growing chorus of critics warn that it has security weaknesses that could be fixed but haven't been. Worse, as Internet security has surged as a subject of international concern, Torvalds has engaged in an occasionally profane standoff with experts on the subject. ...
His broader message was this: Security of any system can never be perfect. So it always must be weighed against other priorities — such as speed, flexibility and ease of use — in a series of inherently nuanced trade-offs. This is a process, Torvalds suggested, poorly understood by his critics. 'The people who care most about this stuff are completely crazy. They are very black and white,' he said ... 'Security in itself is useless. The upside is always somewhere else. The security is never the thing that you really care about.'"
Of course, contradictory points of view are presented, too: "While I don't think that the Linux kernel has a terrible track record, it's certainly much worse than a lot of people would like it to be," said Matthew Garrett, principal security engineer for CoreOS, a San Francisco company that produces an operating system based on Linux. At a time when research into protecting software has grown increasingly sophisticated, Garrett said, "very little of that research has been incorporated into Linux."
His broader message was this: Security of any system can never be perfect. So it always must be weighed against other priorities — such as speed, flexibility and ease of use — in a series of inherently nuanced trade-offs. This is a process, Torvalds suggested, poorly understood by his critics. 'The people who care most about this stuff are completely crazy. They are very black and white,' he said ... 'Security in itself is useless. The upside is always somewhere else. The security is never the thing that you really care about.'"
Of course, contradictory points of view are presented, too: "While I don't think that the Linux kernel has a terrible track record, it's certainly much worse than a lot of people would like it to be," said Matthew Garrett, principal security engineer for CoreOS, a San Francisco company that produces an operating system based on Linux. At a time when research into protecting software has grown increasingly sophisticated, Garrett said, "very little of that research has been incorporated into Linux."
'The people who care most about this stuff are completely crazy. They are very black and white,' he said ... 'Security in itself is useless. The upside is always somewhere else. The security is never the thing that you really care about.'"
This nails it entirely on the head, and is why a lot of security and privacy nutters gain so little traction when dealing with the masses. Security and privacy are important, but they need to be balanced pragmatically with what people actually want to do with the system.
Linus Torvalds: ...Security of any system can never be perfect. So it always must be weighed against other priorities — such as speed, flexibility and ease of use — in a series of inherently nuanced trade-offs....
Fortunately, there are open source operating systems available where security is less of a trade-off and more of a priority, such as OpenBSD, where the developers maintain a laser focus on security.
Linux the OS certainly has had numerous real-world security problems that need to be addressed. I don't particularly care about the semantics of "Oh it's just a kernel!" because I could play the exact same game with Windows where Windows kernel vulnerabilities aren't super common either. Guess what: Linux and Windows both run the same web browsers these days, and that's a cross-platform security hole no matter who wrote the kernel.
Additionally, the biggest security hole I see now is Android due to the fact that it's damn near impossible to actually get upgraded software to fix the numerous holes.
However, Torvalds' direct responsibility is the kernel, so in this particular context I'm not going to give him too much grief. The Linux kernel does actually include extremely sophisticated mandatory access control systems like AppArmor, SELinux, etc. However... and this goes to his point... these systems are used sparingly because they are REALLY complex and lead to all kinds of usability issues for unsophisticated users (And "unsophisticated" here could easily mean a skilled Unix sysadmin with years of experience. These MAC systems are *not* considered "normal" in UNIX).
So basically: Yeah, Linux is not perfect. Nothing out there is perfect. However, the kernel actually does have a bunch of sophisticated security facilities. Maybe more work should go into making these sophisticated security features more accessible and useful to regular people.
AntiFA: An abbreviation for Anti First Amendment.
We are talking about securing tools. But the point is that tools do things. We want tools to help us to accomplish the things that the tools do.
A perfectly safe hammer is entirely possible. Make it out of flame-resistant, soft, synthetic materials and fill it with something equally soft. Shape it more like a ball than like a stick, so no-one can accidentally stick it in their mouth and suffocate.
Of course, now you have something that can't be used to pound in nails—but it's entirely the safest hammer on the planet.
Will anyone buy it or use it? Of course not. And they'll still need something with which to pound in nails. That's Linus' point.
STOP . AMERICA . NOW
It's not that black and white at all. The OSHA-like examples of stupidity in motion don't apply here. What is present is an enormous crime effort to make money from other's computing misery. Look at what's happened, in terms of breaches, thefts, extortion, and just plain misery.
The problem starts with every coder everywhere, every sysadmin, network engineer, and web designer. The culture of security starts at the top, and here, at the Top of Linux, Linus brushes it off. These aren't nutters or nutjobs, these are the wounded, the broke/bankrupt, and those rapidly looking at systems infrastructure as if it's a joke.
---- Teach Peace. It's Cheaper Than War.
TFS makes the article look rather balanced, but if you actually read it, it's pretty clearly FUD attempting to make the kernel team look indifferent (or even incompetent) regarding security. It blames the "towelroot" Android exploit as being the fault of Linux, and compares Linux security to car manufacturers in the 1960s willfully avoiding seat belts and other safety mechanisms. Was the author bribed by Microsoft?
I have to say that if this is his position:
He's absolutely dead right and more people in the security profession need to understand what their job is really about. Security is a support role. Our job is to make someone else's stuff work better. Even if you're secret service protecting the president, the core value in your job isn't security for it's own sake, it's making sure the guy in the suit is able to do his job tomorrow.
Yeah, Linux has now become a commercial, almost for-profit operating system. That's why I'm switching to a Mac.
Fight for your bitcoins!
I've been involved in IT security in one guise or another since 2002. The single most important thing I have learned about IT security was learned attending a security conference where Bruce Schneider was one of the speakers. His one-sentence line has always stuck with me: "Security is a process, not a product." This one sentence changed the entire way I see security and, as a result, I am free to make better decisions about what I'm doing and why because I'm not focused on say, a firewall, or a router, but how everything in the LAN/WAN works together, balancing the needs of everyone from HR to the nerds in the darkened basement.
He's trying to say that if people want powerful, flexible networking, they'll choose an 80% safe OS that enables this easily over a 90% safe OS that imposes lots of overhead costs to make it possible; that people will choose a 60% secure OS that runs their processing jobs in 3 hours over an 85% secure OS that runs their processing jobs in 6 hours.
He's pointing out that people like security well enough, but they want to get stuff DONE even more, and that most people will take the calculated risk to be less secure if it makes them more productive at lower costs. That if there is a less secure but more productive option, up to some arbitrary point (that is different in each case, but that can be inferred by the movement of markets and communities as a whole), they'll choose the more productive option.
And that there is no point in saying "then all of us that produce these things must get together and make highly secure, if less capable stuff, so that all choices are equally highly secure!" because as soon as that happens, a garage coder somewhere is going to have a project on github that says "I got tired of waiting for jobs to finish, so I wrote my own from scratch. It's totally insecure, but damned if it doesn't finish the job in half the time!" and that people will immediately flock to it.
In other words, his goals for Linux aren't for Linux to be the most secure OS on the planet, but to be one of the most useful and used ones.
STOP . AMERICA . NOW
Were this true, a culture of security would have indeed stanched many of the problems found. Certainly the Linux kernels have been well-thought through. They are not immune.
---- Teach Peace. It's Cheaper Than War.
Matthew Garrett again trying to remove Linus from the equation. First they tried with the rants angle, now with the "security" aspect. pure FUD
With intel vPro or an iLO system, I can just ssh in, turn the machine on, upload a CD image, boot the machine from the virtual image and snarf everything. Being off doesn't mean it is secure these days.
Security in Linux has been looked at as something you bolt-on after the fact. It was not designed from the ground-up with security in mind. Look at OpenBSD as an example:
Uh no. OpenBSD is based on legacy BSD code. It's not designed from the ground up for security. It's being implemented after the fact.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Your analogy doesn't seem accurate. It's more like if you had a hammer - all hammerlike and useful, but because of the laziness of the hammer creator, can be remotely made to fly around your workshop smashing into things by anyone wishing to make it do so.
The security holes which do not affect functionality should be fixed, and commonly are not. That is the problem.
I find it highly amusing that people who worry about security tend to be those who want to shoehorn shit like kdbus into the kernel.
To further your point, unplug your computer from power and it's 100% safe from remote attacks.
goals, this is close to what happens. Where truly "hard" computing is necessary, resources are disconnected from networks, etc. People know which side their bread is buttered on, they're not fools. Sure, security is an important "nice to have" but it's not bigger than the task at hand in most cases.
Witness how the public continues to use cloud services, social media services, online commerce, and mag-stripe credit cards, despite regular breaches. They'll bitch and moan, but they're not going to stop doing their stuff.
Similarly, notice how Linux effectively rules the world as THE key component of network and mobile space infrastructure, even dominating big chunks of consumer space (i.e. Android). And meanwhile, OpenBSD is an asterisk.
People want security, sure, but they're not going to choose to martyr themselves (or their projects or tasks) to it. Linus is a pretty smart guy at the end of the day.
STOP . AMERICA . NOW
What Slashdot readers hear: "Linux is not BSD."
What normal people hear: "Linux is a terribly insecure OS from some total asshole, who by the way doesn't give a shit."
Mainstream Media's message: "Better stick with Microsoft Windows; it's the only thing that's secure."
I trained network guys on installing our company's firewall (hardened Linux OS) for 18 years. I started every class by asking this question: "Is the purpose of the network security?" A few guys would nod, after all I'm the security guy, that must be the answer I wanted, right? NO! The purpose of the network is *getting work done*. Security is a feature, and it must be balanced against other features with one goal in mind: getting the work done at a level of productivity acceptable to management. Perfect security is an illusion. Doesn't exist, won't ever exist. You do the best you can in the environment you work in, and that's all you can do.
I agree that operating system engineers should not get bogged down in details of security. What they should do, however, is concentrate on those aspects of security which equate to quality, especially stability and transparency. Not crashing in response to unusual input and handling overloads gracefully are really important aspects of security. Likewise, the ability to see what is going on in your OS is fundamental to security. For example, I have argued for some time that the addition of DTrace to Mac OS X is an important security feature. The reaction I get is "That's just a debugger." No, the ability to understand what's going on is absolutely necessary to security. These things do not degrade the user experience or make an OS less usable. They make it better.
Incompetent and unaware of it. This person qualifies. For these idiots, it is always others that make the mistakes, never they themselves, and hence they never produce anything good because they do not learn.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
He's pointing out that people like security well enough, but they want to get stuff DONE even more, and that most people will take the calculated risk to be less secure if it makes them more productive at lower costs.
Also, too much security can backfire. I call this the Garbage Compacter Rule: In Star Wars it was too difficult to shut down all the garbage compacters on the detention level, so R2-D2 just shut them all down. Similarly, when you run up against a security system that's stopping you doing what you want, but it's hard to poke a hole in it, you sometimes just "shut them all down" to get some work done. You're left with less security than if the original block wasn't there.
You make it sound like no one has ever hacked a hypervisor.