Stories
Slash Boxes
Comments

SoylentNews is people

posted by mrpg on Tuesday November 21 2017, @05:00AM   Printer-friendly
from the yes-but-be-nice dept.

Linux overlord Linus Torvalds has offered some very choice words about different approaches security, during a discussion about whitelisting features proposed for version 4.15 of the Linux kernel. Torvalds' ire was directed at open software aficionado and member of Google's Pixel security team Kees Cook, who he has previously accused of idiocy. Cook earned this round of shoutiness after he posted a request to "Please pull these hardened usercopy changes for v4.15-rc1."

[...] Torvalds has long been unafraid to express himself in whatever language he chooses on the kernel and has earned criticism for allowing it to become a toxic workplace. He's shrugged off those accusations with an argument that his strong language is not personal, as he is defending Linux rather than criticising individuals. On this occasion his strong language is directed at a team and Cook's approach to security, rather than directly at Cook himself. It's still a nasty lot of language to have directed at anyone.

Some 'security people are f*cking morons' says Linus Torvalds

[Reference]: [GIT PULL] usercopy whitelisting for v4.15-rc1
[Linus' Response]: Re: [GIT PULL] usercopy whitelisting for v4.15-rc1


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 5, Insightful) by Anonymous Coward on Tuesday November 21 2017, @05:45AM (14 children)

    by Anonymous Coward on Tuesday November 21 2017, @05:45AM (#599552)

    They are not just some random coders, without much experience, but ones suposedly in charge of security from a vendor proud of making people jump all kind of hops to get recruited (you must have heard about Google questions). Maybe they have a primadonna mentality? Well, they found the one that kicks donnas' asses. And the email has details of why the patch is rejected, not just insults. Next time they may prefer a plain "no, wrong, redo it but this time correctly... you figure what I mean, until you get it right or you give up, no more explanations from me, enjoy the quiz, keep on guessing".

    Read Linus' email yourself: https://lkml.org/lkml/2017/11/17/767 [lkml.org]

    IT IS NOT ACCEPTABLE when security people set magical new rules, and
    then make the kernel panic when those new rules are violated.

    That is pure and utter bullshit. We've had more than a quarter century
    _without_ those rules, you don't then suddenly walz in and say "oh,
    everbody must do this, and if you haven't, we will kill the kernel".

    The fact that you "introduced the fallback mode" late in that series
    just shows HOW INCREDIBLY BROKEN the series started out.

    ...

    Because honestly, the kind of security person who doesn't accept that
    security problems are primarily just bugs, I don't want to work with.
    If you don't see your job as "debugging first", I'm simply not
    interested.

    So I think the hardening project needs to really take a good look at
    itself in the mirror.

    Because the primary focus should be "debugging". The primary focus
    should be "let's make sure the kernel released in a year is better
    than the one released today".

    And the primary focus right now seems to be "let's kill things for
    bugs". That's wrong.

    ...

    And we had this exact issue with the _previous_ user mode access
    hardening. People apparently didn't learn a goddamn thing.

    That's thin skin if with all the details about where the problem comes from (over and over it seems), you get pissed (see what I did there) about words like shit, bullshit, moron or idiotic. In other places, they will be named as "fired!!! you are fired!!!" and no need of more words.

    But seems all now is about back stabbing will in public keeping a good baby face. Linus just puts some colorful words while asking for solutions.

    Starting Score:    0  points
    Moderation   +5  
       Insightful=5, Total=5
    Extra 'Insightful' Modifier   0  

    Total Score:   5  
  • (Score: 4, Interesting) by Anonymous Coward on Tuesday November 21 2017, @05:55AM (8 children)

    by Anonymous Coward on Tuesday November 21 2017, @05:55AM (#599556)

    Maybe it's time Google just built their own, de novo, ground-up closed source kernel.

    I'm serious. They have the people, they have the chops, they have the cash. They want a kernel? They can have one. And they can make it as robust and demanding as they like. Hell, if they really wanted, and didn't mind it all being open sourced, they could fork Linux.

    Then they could stop having to make excuses for putting important stuff in blobs, among other factors. What's not to like?

    Not being evil? That ship sailed years ago, my friend. Years ago.

    • (Score: 0) by Anonymous Coward on Tuesday November 21 2017, @06:15AM (2 children)

      by Anonymous Coward on Tuesday November 21 2017, @06:15AM (#599560)

      Now that would be truly moronic. And they do have a kernel and OS of their own https://en.wikipedia.org/wiki/Google_Fuchsia [wikipedia.org]

      Don't use google products, they're bad for your health.

      • (Score: 0) by Anonymous Coward on Tuesday November 21 2017, @07:04AM (1 child)

        by Anonymous Coward on Tuesday November 21 2017, @07:04AM (#599568)

        Do you know why they called it "Google"? Old joke, but apropos: "Skynet" was already trademarked, in a movie.

    • (Score: 2) by crafoo on Tuesday November 21 2017, @01:27PM

      by crafoo (6639) on Tuesday November 21 2017, @01:27PM (#599627)

      I would argue they really don't have the people or the skills organized in a manner that would produce a successful kernel in a reasonable amount of time. I think the incompetence of the pixel security team illustrates this somewhat.

    • (Score: 4, Insightful) by WillR on Tuesday November 21 2017, @02:41PM

      by WillR (2012) on Tuesday November 21 2017, @02:41PM (#599652)

      they could fork Linux

      They *did* fork Linux, and it diverged enough from mainline that bug fixes couldn't be backported. That's one of many reasons Android kernel updates are a shitshow.
      They're trying to unfork themselves by upstreaming as much as they can now.

    • (Score: 3, Interesting) by Wootery on Tuesday November 21 2017, @02:42PM

      by Wootery (2341) on Tuesday November 21 2017, @02:42PM (#599654)

      closed source

      How would that help? Apple don't seem to mind the open state of Darwin, even if no-one particularly cares.

    • (Score: 2) by DannyB on Tuesday November 21 2017, @04:37PM (1 child)

      by DannyB (5839) Subscriber Badge on Tuesday November 21 2017, @04:37PM (#599714) Journal

      Maybe it's time Google just built their own, de novo, ground-up closed source kernel.

      Even poor stupid evil Microsoft has begun to recognize that open source can actually be in one's best business interest. Google realized that long ago.

      How about: Google build a ground-up1 new open source kernel. If it mostly kept user space compatibility it could end up replacing Linux.

      A newer more modern kernel would be a huge gift to the world.

      1 not as in to grind up, as in ground up kernels

      --
      When trying to solve a problem don't ask who suffers from the problem, ask who profits from the problem.
      • (Score: 2) by letssee on Tuesday November 21 2017, @09:47PM

        by letssee (2537) on Tuesday November 21 2017, @09:47PM (#599895)

        They are doing that. It's called fuchsia irrc. I wouldn't want to depend my life on it though, considering google's track record for dropping projects as soon as they deem them unprofitable.

  • (Score: 0) by Anonymous Coward on Tuesday November 21 2017, @06:01AM (3 children)

    by Anonymous Coward on Tuesday November 21 2017, @06:01AM (#599557)

    Oops.

    Sorry, so feed up about how many times the "Linus used some swear words" keeps hitting the news. I guess some have to "sell tabloids" (The Register) or nobody has found something "dirty" to get rid of Linus and take over the kernel like other projects are going corporate with their "we know better than you, be happy we still let you see the source, but don't ever dream dictating the path from now, punny pleb coder".

    • (Score: 2) by Thexalon on Tuesday November 21 2017, @03:10PM (2 children)

      by Thexalon (636) on Tuesday November 21 2017, @03:10PM (#599672)

      I agree that part of the motivation for the occasional "Waaaaaa! Linus said something mean to me!" story is that there are people who would like Linus to go away forever. Even though in those cases where I examined the story, the chewing out was entirely deserved.

      I mean, let's just say for the sake of argument that there were somebody who thought they had a better idea for how Linux should work, and let's say that person is trying to implement their vision by forcing all other major projects to become a part of it like it or not, and let's say that Linus is preventing that vision from including the kernel in exactly the way this person would like. I could imagine somebody like that trying to push stories like this one in an attempt to undermine Linus' authority.

      * Any resemblance in the above paragraph to actual persons, living or dead, is purely intentional.

      --
      The only thing that stops a bad guy with a compiler is a good guy with a compiler.
      • (Score: 2) by DECbot on Tuesday November 21 2017, @05:21PM (1 child)

        by DECbot (832) on Tuesday November 21 2017, @05:21PM (#599733) Journal

        You leave systemd out of this!

        --
        cats~$ sudo chown -R us /home/base
        • (Score: 2) by Azuma Hazuki on Tuesday November 21 2017, @10:06PM

          by Azuma Hazuki (5086) on Tuesday November 21 2017, @10:06PM (#599911) Journal

          Would heaven that we could! Debian and RHEL both use it now, which means virtually all of Linux does. I'm sitting here with Artix (think "Arch with OpenRC" here) well content, but how many people even know other-than-systemd is even an option?

          SystemD is to init systems what early Gnome 3 was to DEs, and for most of the same reasons.

          --
          I am "that girl" your mother warned you about...
  • (Score: 2, Touché) by Anonymous Coward on Tuesday November 21 2017, @07:23AM

    by Anonymous Coward on Tuesday November 21 2017, @07:23AM (#599570)

    Worked for Pottering...