Linus thinks security people are morons. He's right. I explain the latest reason here: blog.erratasec.com/2017/11/w…
13
51
3
116
He's wrong, and so are you (but neither are new). Even if you agree with his wrong position, should acknowledge that it's adhered to incredibly inconsistently. Look at the implementation of VMAP_STACK, or even git.kernel.org/pub/scm/linux… from Linus himself. Do as I say, not as I do
1
1
1
9
and you are missing a critical datapoint: the whole USERCOPY breakage is due to the KSPP "devs" forgetting to copy+paste some code from us that had been there since 2011:
grsecurity @grsecurity
20 Oct 2017
It's hard to believe this patchset was tested extensively if KVM breaking completely wasn't discovered for 4 months: openwall.com/lists/kernel-ha…
2
1
I'm also very uncomfortable with their initial marketing of security features where they then end up watering them down to the point where they offer no security at all. WARN_ON() does not prevent exploitation, and they are very quiet about the watering down
1
3
You didn't read my post. What Linus is saying is that adding bounds-checking to a codebase will uncover latent bugs. Thus, it should be WARN_ON for a year so that such bugs can be cleaned up before killing things.
3
1
Replying to @ErrataRob @grsecurity
dude, you have NO idea what you're talking about. the problem was NOT with the bounds checking feature per se but how the KSPP botched up their attempt to rip off some code i wrote a year ago which has none of these issues.

Nov 20, 2017 · 8:42 PM UTC
2
2