Re: [openbsd] fwd: [deraadt lt;atgt; cvs.openbsd.org: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/]
Haters please go off-list, identity is not relevant on a discussion list, I do not need attention nor personal implication. I'd be delighted to speak about privacy and stuff with my detractors, off-list. SELinux is another debate, I don't want to waste your time with it. Thanks for your participation, I was still able to get some clever answers. It's frightening to see how easy it is to lie to people and make them believe you're right and the others are wrong, god bless demagogy. But I'm relieved to see that Internet is not only a place where liars and fools can speak but also a place where truth can be unveiled. Regards.
Re: [openbsd] fwd: [dera...@cvs.openbsd.org: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/]
On Tue, 22 Jun 2010 21:39:10 +0200 Aaron Glenn aaron.gl...@gmail.com wrote: On Tue, Jun 22, 2010 at 7:26 PM, pourl...@hushmail.com wrote: I do not wish to begin a troll-like thread, I just want the truth. yes you do; no you don't. no one cares; please go away. You are wrong, if you are unable to reply properly to my request, go away. I don't know, go out, do some sports. Didn't you just want to appear on misc@, if not you would not have kept misc in the discussion. There will always be OpenBSD haters, I want to be able to have a constructive, fact based discussion with them. Staying ignorant and saying go away just prove yourself ignorant and childish. If someone HAS valuable information, they can reply directly, without replying to misc. Thank you.
Re: [openbsd] fwd: [dera...@cvs.openbsd.org: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/]
On Thursday 24 June 2010 12:52:35 pourl...@hushmail.com wrote: On Tue, 22 Jun 2010 21:39:10 +0200 Aaron Glenn aaron.gl...@gmail.com wrote: On Tue, Jun 22, 2010 at 7:26 PM, pourl...@hushmail.com wrote: I do not wish to begin a troll-like thread, I just want the truth. yes you do; no you don't. no one cares; please go away. You are wrong, if you are unable to reply properly to my request, go away. I don't know, go out, do some sports. Didn't you just want to appear on misc@, if not you would not have kept misc in the discussion. There will always be OpenBSD haters, I want to be able to have a constructive, fact based discussion with them. Staying ignorant and saying go away just prove yourself ignorant and childish. If someone HAS valuable information, they can reply directly, without replying to misc. Thank you. The fact of the matter is that N groups of people can think of much the same things quite independantly of one another. This being the case, trying to claim 'we did it first!' is much like digging a hole in water. It's great exercise, amsuing for others to watch, but utterly useless. --STeve Andre'
Re: [openbsd] fwd: [dera...@cvs.openbsd.org: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/]
2010/6/24 STeve Andre' and...@msu.edu On Thursday 24 June 2010 12:52:35 pourl...@hushmail.com wrote: On Tue, 22 Jun 2010 21:39:10 +0200 Aaron Glenn aaron.gl...@gmail.com wrote: On Tue, Jun 22, 2010 at 7:26 PM, pourl...@hushmail.com wrote: I do not wish to begin a troll-like thread, I just want the truth. yes you do; no you don't. no one cares; please go away. You are wrong, if you are unable to reply properly to my request, go away. I don't know, go out, do some sports. Didn't you just want to appear on misc@, if not you would not have kept misc in the discussion. There will always be OpenBSD haters, I want to be able to have a constructive, fact based discussion with them. Staying ignorant and saying go away just prove yourself ignorant and childish. If someone HAS valuable information, they can reply directly, without replying to misc. Thank you. The fact of the matter is that N groups of people can think of much the same things quite independantly of one another. This being the case, trying to claim 'we did it first!' is much like digging a hole in water. It's great exercise, amsuing for others to watch, but utterly useless. --STeve Andre' Life is pretty simple: You do some stuff. Most fails. Some works. You do more of what works. If it works big, others quickly copy it. Then you do something else. The trick is the doing something else. Leonardo da Vinci -- Atentamente Andris Genovez Tobar / Sistemas http://www.crice.org
Re: [openbsd] fwd: [dera...@cvs.openbsd.org: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/]
pourl...@hushmail.com wrote: There will always be OpenBSD haters, I want to be able to have a constructive, fact based discussion with them. If someone HAS valuable information, they can reply directly, without replying to misc. Thank you. fact: you are some douchebag who is late to the argument fact: i am an openbsd supporter and user who does not want to listen to your whining valuable information: reallocate your time doing something that does not expose you to be a douchebag who is too worried about being painted a douchebag to use a real identity. posting from anonymous hushmail accounts is no longer such a great idea, have a look into how untrustworthy hushmail.com is when it comes to the authorities.
Re: [openbsd] fwd: [dera...@cvs.openbsd.org: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/]
* pourl...@hushmail.com pourl...@hushmail.com [2010-06-22 21:31]: Their official explanation sorry, but we have vacancies in our PR department, expect no official explanations anytime soon -- Henning Brauer, h...@bsws.de, henn...@openbsd.org BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, Application Hosting
Re: [openbsd] fwd: [dera...@cvs.openbsd.org: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/]
Hello misc, I was wondering if these accusations against OpenBSD were true, I doubt he is lying, maybe he is just not telling the whole truth. http://www.uaoug.org.ua/archive/msg01088.html The first part is irrelevant, Linux may have implemented the sysctl switch before OpenBSD. However, their min_map_addr was set to 0 by default for a long time. Which did lead to vulnerabilities in Linux. hey keep coming up with the same exact innovations others came up with years before them. Their official explanation for where they got the W^X/ASLR ideas was a drunk guy came into their tent at one of their hack-a-thons and started talking about the idea. They had never heard of PaX when we asked them in 2003. I do not wish to begin a troll-like thread, I just want the truth. Regards. Michel Antoine User
Re: [openbsd] fwd: [dera...@cvs.openbsd.org: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/]
On Tue, Jun 22, 2010 at 7:26 PM, pourl...@hushmail.com wrote: I do not wish to begin a troll-like thread, I just want the truth. yes you do; no you don't. no one cares; please go away.
Re: [openbsd] fwd: [dera...@cvs.openbsd.org: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/]
Quote from theo : - our kernels have no bugs On Tue, 22 Jun 2010 21:26:18 +0200, pourl...@hushmail.com wrote: Hello misc, I was wondering if these accusations against OpenBSD were true, I doubt he is lying, maybe he is just not telling the whole truth. http://www.uaoug.org.ua/archive/msg01088.html The first part is irrelevant, Linux may have implemented the sysctl switch before OpenBSD. However, their min_map_addr was set to 0 by default for a long time. Which did lead to vulnerabilities in Linux. hey keep coming up with the same exact innovations others came up with years before them. Their official explanation for where they got the W^X/ASLR ideas was a drunk guy came into their tent at one of their hack-a-thons and started talking about the idea. They had never heard of PaX when we asked them in 2003. I do not wish to begin a troll-like thread, I just want the truth. Regards. Michel Antoine User -- @plus
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On Sun, Nov 08, 2009 at 11:19:39PM -0500, Steve Shockley wrote: On 11/8/2009 1:17 PM, Dave Wilson wrote: An ARM laptop would be especially win :-) http://www.6ave.com/shop/Product.aspx?sku=VSLVL760-4GB Was on sale recently for $150 shipped. No clue if it sucks. I would love to see a decent (cortex based?) arm laptop/netbook. But this one isn't: 64MB ram, 800x480 resolution, unmentioned arm processor at unmentioned MHz, WindowsCE instead of linux? Dale Rahn dr...@dalerahn.com
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Dale Rahn wrote: On Sun, Nov 08, 2009 at 11:19:39PM -0500, Steve Shockley wrote: On 11/8/2009 1:17 PM, Dave Wilson wrote: An ARM laptop would be especially win :-) http://www.6ave.com/shop/Product.aspx?sku=VSLVL760-4GB Was on sale recently for $150 shipped. No clue if it sucks. I would love to see a decent (cortex based?) arm laptop/netbook. But this one isn't: 64MB ram, 800x480 resolution, unmentioned arm processor at unmentioned MHz, WindowsCE instead of linux? The Always Innovating Touch Book maybe? http://www.alwaysinnovating.com/home/index.htm
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On Mon, Nov 9, 2009 at 12:40 PM, Laurens Vets laur...@daemon.be wrote: Dale Rahn wrote: But this one isn't: 64MB ram, 800x480 resolution, unmentioned arm processor at unmentioned MHz, WindowsCE instead of linux? The Always Innovating Touch Book maybe? http://www.alwaysinnovating.com/home/index.htm My current laptop also weighs three pounds, same as the touch book, but has a 113% bigger screen with 110% more pixels, 12 times as much RAM, 10 times as much storage, a keyboard that works, and probably about 16 times the processing power. OK, I get that I'm not in the market for a netbook, but that's exactly the point. For people who want a real computer, suggesting they use arm chips is a joke. This is not the first time the issue has come up, nor is it the first time that someone has posted a link to a company selling a product nobody has actually ever seen.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Dave Wilson wrote: Toni Mueller wrote: It's not like I was in love with x86/amd64, but it's *really*hard* to go for something else. Further to this, if anyone is aware of any non-x86/x64 machines which are of similar bang-for-buck as off-the-shelf PCs, I for one would be *very* interested to know about them. An ARM laptop would be especially win :-) Dave, The Netbooked website does a good job of keeping up with the latest developments in netbooks, including those with ARM processors, which are usually referred to as Smartbooks. Run a search on arm or smartbook to find plenty of articles: http://netbooked.net/home/ Expect to see more ARM powered netbooks in the coming year. And eventually I expect, laptops. Asus seems to be slowly re-committing to ARM based netbooks. Other companies are moving more quickly - I found the following article: http://netbooked.net/blog/tegra-powered-mobinnova-smartbook-launches-early-jaunary-2010/ Also, digging around in the ARM Powered Products links on the following page will turn up some smartbooks/netbooks/small laptops: http://www.arm.com/markets/ Cheers, Luke Seubert
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Ted Unangst wrote: On Mon, Nov 9, 2009 at 12:40 PM, Laurens Vets laur...@daemon.be wrote: Dale Rahn wrote: But this one isn't: 64MB ram, 800x480 resolution, unmentioned arm processor at unmentioned MHz, WindowsCE instead of linux? The Always Innovating Touch Book maybe? http://www.alwaysinnovating.com/home/index.htm My current laptop also weighs three pounds, same as the touch book, but has a 113% bigger screen with 110% more pixels, 12 times as much RAM, 10 times as much storage, a keyboard that works, and probably about 16 times the processing power. OK, I get that I'm not in the market for a netbook, but that's exactly the point. For people who want a real computer, suggesting they use arm chips is a joke. This is not the first time the issue has come up, nor is it the first time that someone has posted a link to a company selling a product nobody has actually ever seen. But it's not ARM, is it? :) Tbh, I was just replying to Dale's comment: I would love to see a decent (cortex based?) arm laptop/netbook.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
2009/11/9 Laurens Vets laur...@daemon.be: Tbh, I was just replying to Dale's comment: I would love to see a decent (cortex based?) arm laptop/netbook. Anybody tried porting OBSD to the Nokia N800++? Best Martin
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On Mon, Nov 09, 2009 at 08:59:55PM +0100, Martin Schr?der wrote: 2009/11/9 Laurens Vets laur...@daemon.be: Tbh, I was just replying to Dale's comment: I would love to see a decent (cortex based?) arm laptop/netbook. Anybody tried porting OBSD to the Nokia N800++? I wanted to try at one point in the past. However, not being able to find out how to wire up the serial port (plus NDA documentation), kind of put a halt on that (over 2 years ago). Now with Qemu supporting it as a target, that effort could be worked on, however I have too many other projects on newer faster hardware that dont get my time. The base code for the beagle port was actually derived from the early 2420 code I had written, if one checks the copyrights. I was careful to make certain that all of the remaining bits corresponded to beagle docs... Dale Rahn dr...@dalerahn.com
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On 11/9/2009 11:38 AM, Dale Rahn wrote: I would love to see a decent (cortex based?) arm laptop/netbook. But this one isn't: 64MB ram, 800x480 resolution, unmentioned arm processor at unmentioned MHz, WindowsCE instead of linux? There's also no evidence of its existence on the manufacturer's web site. It's probably just an mp3 player with a keyboard so they can call it a netbook.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Hi, On Fri, 06.11.2009 at 13:41:13 +0200, Lars Nooden lars.cura...@gmail.com wrote: Unless you aren't running shit-for-architecture x86 systems still. It is 2009 and there are sparc, mips, freescale and arm on the market. now you only need to educate us about how such machines can be used in an economic fashion. Blaming people for not running PDA cpus for core routers or not shelling out $40k for Niagara machines (supported by OpenBSD???) when these are even outperformed by $4k PCs in almost all practical scenarios, just doesn't cut it. Much less so if you take the rest of the supply chain into account. It's not like I was in love with x86/amd64, but it's *really*hard* to go for something else. Kind regards, --Toni++
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Toni Mueller wrote: now you only need to educate us about how such machines can be used in an economic fashion. Blaming people for not running PDA cpus for core routers or not shelling out $40k for Niagara machines (supported by OpenBSD???) when these are even outperformed by $4k PCs in almost all practical scenarios, just doesn't cut it. Much less so if you take the rest of the supply chain into account. It's not like I was in love with x86/amd64, but it's *really*hard* to go for something else. Further to this, if anyone is aware of any non-x86/x64 machines which are of similar bang-for-buck as off-the-shelf PCs, I for one would be *very* interested to know about them. An ARM laptop would be especially win :-) Dave W
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Then here it is http://www.alwaysinnovating.com/touchbook/ On Sun, Nov 8, 2009 at 7:17 PM, Dave Wilson richard.wil...@senokian.com wrote: Toni Mueller wrote: now you only need to educate us about how such machines can be used in an economic fashion. Blaming people for not running PDA cpus for core routers or not shelling out $40k for Niagara machines (supported by OpenBSD???) when these are even outperformed by $4k PCs in almost all practical scenarios, just doesn't cut it. Much less so if you take the rest of the supply chain into account. It's not like I was in love with x86/amd64, but it's *really*hard* to go for something else. Further to this, if anyone is aware of any non-x86/x64 machines which are of similar bang-for-buck as off-the-shelf PCs, I for one would be *very* interested to know about them. An ARM laptop would be especially win :-) Dave W
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On 11/8/2009 1:17 PM, Dave Wilson wrote: An ARM laptop would be especially win :-) http://www.6ave.com/shop/Product.aspx?sku=VSLVL760-4GB Was on sale recently for $150 shipped. No clue if it sucks.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
2009/11/5 Justin Smith odnomz...@gmail.com: By default, Ubuntu 8.04 and later with a non-zero /proc/sys/vm/mmap_min_addr setting were not vulnerable. Ubuntu 8.04 released in 2008 april. They've moved on from this then... http://ubuntuforums.org/showthread.php?t=143334
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
2009/11/5 Tobias Ulmer tobi...@tmux.org: Dear sweetheart, On Thu, Nov 05, 2009 at 01:12:58AM +0100, Claire beuserie wrote: Yes, I know, I was present in the room when Illja gave the talk in 2006 at the CCC Kongress and the two OpenBSD developers in the room decided to completely ignore the exploit he showed until Miod reproduced it two weeks later... http://events.ccc.de/congress/2006/Fahrplan/day_4.en.html: Schedule Day 4: 30.12.2006 11:30 Unusual bugs Ilja http://openbsd.org/errata39.html: 017: SECURITY FIX: January 3, 2007 i386 only Insufficient validation in vga(4) may allow an attacker to gain root privileges if the kernel is compiled with option PCIAGP and the actual device is not an AGP device. The PCIAGP option is present by default on i386 kernels only. http://blogs.23.nu/ilja/2007/01/: So one of the things I noticed after my unusual bugs talk, the OpenBSD guys fix bugs _FAST_. I mean really fast ! bugfix and announcement within a few days. Not many vendors can pull that off. Two weeks, eh? Want it in a black frame with a white caption reading EPIC FAIL? I'd start gimp for that. Way ahead of you here: http://imgur.com/f5UZ9.jpg
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
From http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/ : or desktop environments such as Wine For some definitions of desktop environments.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
Claire beuserie claire.beuse...@gmail.com writes: That came out a bit weird: are you saying you knew about the bug for 2 years but did not fix it? Yes. Because the solution sucks. And all others we tried were just not workable. Just like we knew that executable stacks can be used for exploits and didn't fix that for many years. //art
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
On Wed, Nov 04, 2009 at 02:57:59AM +0100, Claire beuserie wrote: Hi, On Wed, Nov 4, 2009 at 12:58 AM, Theo de Raadt dera...@cvs.openbsd.orgwrote: 2) At least three of our developers were aware of this exploitation method going back perhaps two years before than the commit, but we gnashed our teeth a lot to try to find other solutions. Clever cpu architectures don't have this issue because the virtual address spaces are seperate, so i386/amd64 are the ones with the big impact. We did think long and hard about tlb bashing page 0 everytime we switch into the kernel, but it still does not look attractive from a performance standpoint. I'm confused. That came out a bit weird: are you saying you knew about the bug for 2 years but did not fix it? Allowing a mapping at address zero is not a bug per se, but it opens a door for other bugs to be exploited more effectively. This door has been closed, but only after hard thinking went into how to close it. -Otto
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
On Wed, 4 Nov 2009 at 1:46 PM, Aaron Mason simplersolut...@gmail.com wrote: On Wed, Nov 4, 2009 at 1:04 PM, Gonzalo Lionel Rodriguez gonz...@sepp0.com.ar wrote: 2009/11/3 Claire beuserie claire.beuse...@gmail.com: Hi, On Wed, Nov 4, 2009 at 12:58 AM, Theo de Raadt dera...@cvs.openbsd.orgwrote: 2) At least three of our developers were aware of this exploitation method going back perhaps two years before than the commit, but we gnashed our teeth a lot to try to find other solutions. Clever cpu architectures don't have this issue because the virtual address spaces are seperate, so i386/amd64 are the ones with the big impact. We did think long and hard about tlb bashing page 0 everytime we switch into the kernel, but it still does not look attractive from a performance standpoint. I'm confused. That came out a bit weird: are you saying you knew about the bug for 2 years but did not fix it? c.b- Linux way. What a knob. It makes me sad to say I used his crap now if he has that much contempt for those who value security before practicality. It's good to see Theo et al stick to their guns on this issue. I'd rather have a machine that is secure than one that can run Windows binaries. Wine is a good idea, but it's stifling an even better idea - making applications compatible across multiple OSes, something that hasn't needed to be done in the M$ world because of the stranglehold they had/have over the consumer market. Let's put this into perspective: Linux would absolutely jump in popularity if Valve ported Steam and the Source engine to it, meaning games like the Half Life series, Left 4 Dead and Team Fortress 2 could run natively - not to mention that it would prompt other games that sell their wares through the Steam CDS to port their games as well - but since most of the games run just fine in Wine these days, there's no incentive. Linus is shooting himself in the foot and he has no idea. Linux tries to be everything to everyone, and by doing it the way is does, it greatly limits its potential. OpenBSD does one thing and does it well - being secure. That's all there is to it. I think that sells OpenBSD unintentionally short. Yes, the attention to security is of enormous value, but the care and intelligence that characterizes the whole effort results in a system that is extremely stable, very easy to administer, and very well documented. It is the only system I know of, and I've tried almost all of them, that pays attention to the things that really matter. The result is an environment where you do your work, rather than fighting with your tools. I replaced Linux on three laptops and a workstation with OpenBSD (after a quick divorce from FreeBSD -- too many bugs) that I use for general computing tasks including a lot of software development and database work, and you couldn't pay me to go back. I realize that I'm preaching to the choir -- you know all this. But I think it's a mistake for (especially) the OpenBSD community to speak of OpenBSD as just about security, when it's so much more than that. /Don Allen -- Aaron Mason - Programmer, open source addict - Oh, why does everything I whip leave me?
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Theo wrote: For the record, this particular problem was resolved in OpenBSD a while back, in 2008. Nice, but: Since 2.6.23, it has been possible to prevent applications from mapping low pages (to prevent null pointer dereferencing in the kernel) via the /proc/sys/vm/mmap_min_addr sysctl, which sets the minimum address allowed for such mappings. 2.6.23 released: Tue, 9 Oct 2007 Ref: http://lkml.org/lkml/2007/10/9/241 http://james-morris.livejournal.com/26303.html -- JS
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On Wed, Nov 04, 2009 at 03:45:33PM +0100, Justin Smith wrote: Theo wrote: For the record, this particular problem was resolved in OpenBSD a while back, in 2008. Nice, but: Since 2.6.23, it has been possible to prevent applications from mapping low pages (to prevent null pointer dereferencing in the kernel) via the /proc/sys/vm/mmap_min_addr sysctl, which sets the minimum address allowed for such mappings. 2.6.23 released: Tue, 9 Oct 2007 Ref: http://lkml.org/lkml/2007/10/9/241 http://james-morris.livejournal.com/26303.html -- JS Optional prevention is not worth a lot. -Otto
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Otto Moerbeek wrote: On Wed, Nov 04, 2009 at 03:45:33PM +0100, Justin Smith wrote: Theo wrote: For the record, this particular problem was resolved in OpenBSD a while back, in 2008. Nice, but: Since 2.6.23, it has been possible to prevent applications from mapping low pages (to prevent null pointer dereferencing in the kernel) via the /proc/sys/vm/mmap_min_addr sysctl, which sets the minimum address allowed for such mappings. 2.6.23 released: Tue, 9 Oct 2007 Ref: http://lkml.org/lkml/2007/10/9/241 http://james-morris.livejournal.com/26303.html -- JS Optional prevention is not worth a lot. not exactly on topic but Pope Benedict XVI would likely agree with otto. see, even the pope doesn't like linus.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Penned by Justin Smith on 20091104 15:45.33, we have: | Theo wrote: | | For the record, this particular problem was resolved in OpenBSD a | while back, in 2008. | | Nice, but: | | Since 2.6.23, it has been possible to prevent applications from | mapping low pages (to prevent null pointer dereferencing in the | kernel) via the /proc/sys/vm/mmap_min_addr sysctl, which sets the | minimum address allowed for such mappings. | | 2.6.23 released: Tue, 9 Oct 2007 | | Ref: | http://lkml.org/lkml/2007/10/9/241 | http://james-morris.livejournal.com/26303.html | | -- | JS And now we get into the fun stuff. Ever heard of 'secure by default' ? This knob is set to '0' by default. How many Linux installations actually read the above paragraph, understood what value it could have to set to something other than zero, and changed it accordingly. 'Nuff said. -- Todd Fries .. t...@fries.net _ | \ 1.636.410.0632 (voice) | Free Daemon Consulting, LLC \ 1.405.227.9094 (voice) | http://FreeDaemonConsulting.com \ 1.866.792.3418 (FAX) | ..in support of free software solutions. \ sip:freedae...@ekiga.net | \ sip:4052279...@ekiga.net \\ 37E7 D3EB 74D0 8D66 A68D B866 0326 204E 3F42 004A http://todd.fries.net/pgp.txt
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
For the record, this particular problem was resolved in OpenBSD a while back, in 2008. Nice, but: Since 2.6.23, it has been possible to prevent applications from mapping low pages (to prevent null pointer dereferencing in the kernel) via the /proc/sys/vm/mmap_min_addr sysctl, which sets the minimum address allowed for such mappings. 2.6.23 released: Tue, 9 Oct 2007 Ref: http://lkml.org/lkml/2007/10/9/241 http://james-morris.livejournal.com/26303.html And that knob was turned off.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On Wed, Nov 4, 2009 at 4:14 PM, Todd T. Fries t...@fries.net wrote: Penned by Justin Smith on 20091104 15:45.33, we have: | Theo wrote: | | For the record, this particular problem was resolved in OpenBSD a | while back, in 2008. | | Nice, but: | | Since 2.6.23, it has been possible to prevent applications from | mapping low pages (to prevent null pointer dereferencing in the | kernel) via the /proc/sys/vm/mmap_min_addr sysctl, which sets the | minimum address allowed for such mappings. | | 2.6.23 released: Tue, 9 Oct 2007 | | Ref: | http://lkml.org/lkml/2007/10/9/241 | http://james-morris.livejournal.com/26303.html | | -- | JS And now we get into the fun stuff. Ever heard of 'secure by default' ? This knob is set to '0' by default. How many Linux installations actually read the above paragraph, understood what value it could have to set to something other than zero, and changed it accordingly. 'Nuff said. By default, Ubuntu 8.04 and later with a non-zero /proc/sys/vm/mmap_min_addr setting were not vulnerable. Ubuntu 8.04 released in 2008 april. -- JS
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
-Urspr|ngliche Nachricht- Von: Donald Allen donaldcal...@gmail.com Gesendet: 04.11.09 14:23:04 An: misc@openbsd.org Betreff: Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/ Don Allen wrote ... I realize that I'm preaching to the choir -- you know all this. But I think it's a mistake for (especially) the OpenBSD community to speak of OpenBSD as just about security, when it's so much more than that. I second that - it is the attitude of how the devs (and Theo in particular) strive for a clean code and fight the temptation to implement a 'twist' only to allow some poorly written app to run on OpenBSD. Remember the outcry some years ago when a change broke backward compatibility disabling some poorly written apps to run under OpenBSD since then? 'Security' is just another result out of this firm stand for their believes. BTW: Anyone around who has not yet bought his set of CDs? Believe me - this is a clever investment in future development and a fine way saying THANK YOU! STEFAN Mail: ste...@wollny.de GnuPG-Key ID: 0x9C26F1D0
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On Wed, Nov 4, 2009 at 10:55 AM, Justin Smith odnomz...@gmail.com wrote: By default, Ubuntu 8.04 and later with a non-zero /proc/sys/vm/mmap_min_addr setting were not vulnerable. Ubuntu 8.04 released in 2008 april. Ubuntu 8 also ships with a setuid pulseaudio by default, which renders the mmap_min_addr protection useless.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On Wed, Nov 4, 2009 at 5:54 PM, Theo de Raadt dera...@cvs.openbsd.org wrote: For the record, this particular problem was resolved in OpenBSD a while back, in 2008. Nice, but: Since 2.6.23, it has been possible to prevent applications from mapping low pages (to prevent null pointer dereferencing in the kernel) via the /proc/sys/vm/mmap_min_addr sysctl, which sets the minimum address allowed for such mappings. 2.6.23 released: B Tue, 9 Oct 2007 Ref: http://lkml.org/lkml/2007/10/9/241 http://james-morris.livejournal.com/26303.html And that knob was turned off. Actually no it was turned on. Fedora 8 was released in Nov 2007 and to run certain Wine applications as non-root you had to disable the vm.mmap_min_addr sysctl. By default it was set to a value of 65536 and you had to change this to 0. This is well documented all over the Wine forums. I know because this drove me up the bend when they introduced this patch. -- Opportunity is most often missed by people because it is dressed in overalls and looks like work. Thomas Alva Edison Inventor of 1093 patents, including: The light bulb, phonogram and motion pictures.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On Wed, Nov 04, 2009 at 04:55:58PM +0100, Justin Smith wrote: And now we get into the fun stuff. Ever heard of 'secure by default' ? This knob is set to '0' by default. How many Linux installations actually read the above paragraph, understood what value it could have to set to something other than zero, and changed it accordingly. 'Nuff said. By default, Ubuntu 8.04 and later with a non-zero /proc/sys/vm/mmap_min_addr setting were not vulnerable. Ubuntu 8.04 released in 2008 april. And if you install something like wine, the knob is set back to 0, probably without any notice (at least in ubuntu-8.10). You don't even have to run it, just installing it is enough, if I understand the mechanism correctly. But more important is the fact that the original kernel sources have the knob set to 0 by default. Ciao, Kili
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
On Wed, Nov 04, 2009 at 04:55:58PM +0100, Justin Smith wrote: On Wed, Nov 4, 2009 at 4:14 PM, Todd T. Fries t...@fries.net wrote: Penned by Justin Smith on 20091104 15:45.33, we have: | Theo wrote: | | For the record, this particular problem was resolved in OpenBSD a | while back, in 2008. | | Nice, but: | | Since 2.6.23, it has been possible to prevent applications from | mapping low pages (to prevent null pointer dereferencing in the | kernel) via the /proc/sys/vm/mmap_min_addr sysctl, which sets the | minimum address allowed for such mappings. | | 2.6.23 released: Tue, 9 Oct 2007 | | Ref: | http://lkml.org/lkml/2007/10/9/241 | http://james-morris.livejournal.com/26303.html | | -- | JS And now we get into the fun stuff. Ever heard of 'secure by default' ? This knob is set to '0' by default. How many Linux installations actually read the above paragraph, understood what value it could have to set to something other than zero, and changed it accordingly. 'Nuff said. By default, Ubuntu 8.04 and later with a non-zero /proc/sys/vm/mmap_min_addr setting were not vulnerable. Ubuntu 8.04 released in 2008 april. quote from the article in the subject: The latest bug is mitigated by default on most Linux distributions, thanks to their correct implementation of the mmap_min_addr feature. But to make RHEL compatible with a larger body of applications, that distribution is vulnerable to attack even when the OS shows the feature is enabled, Spengler said. so, on RedHat, one can't even turn it on? doesn't Linus work for RedHat? -- jake...@sdf.lonestar.org SDF Public Access UNIX System - http://sdf.lonestar.org
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
And it is totally on on *all* 90239490234873984 distros right? On Wed, Nov 04, 2009 at 06:43:14PM +0200, Ross Cameron wrote: On Wed, Nov 4, 2009 at 5:54 PM, Theo de Raadt dera...@cvs.openbsd.org wrote: For the record, this particular problem was resolved in OpenBSD a while back, in 2008. Nice, but: Since 2.6.23, it has been possible to prevent applications from mapping low pages (to prevent null pointer dereferencing in the kernel) via the /proc/sys/vm/mmap_min_addr sysctl, which sets the minimum address allowed for such mappings. 2.6.23 released: B Tue, 9 Oct 2007 Ref: http://lkml.org/lkml/2007/10/9/241 http://james-morris.livejournal.com/26303.html And that knob was turned off. Actually no it was turned on. Fedora 8 was released in Nov 2007 and to run certain Wine applications as non-root you had to disable the vm.mmap_min_addr sysctl. By default it was set to a value of 65536 and you had to change this to 0. This is well documented all over the Wine forums. I know because this drove me up the bend when they introduced this patch. -- Opportunity is most often missed by people because it is dressed in overalls and looks like work. Thomas Alva Edison Inventor of 1093 patents, including: The light bulb, phonogram and motion pictures.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Ross Cameron wrote: Actually no it was turned on. This is from the commit to the Linux kernel: The amount of space protected is indicated by the new proc tunable proc/sys/vm/mmap_min_addr and defaults to 0, preserving existing behavior. It was turned off, 0 means no protection.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability
Matthias Kilian wrote: And if you install something like wine, the knob is set back to 0, probably without any notice (at least in ubuntu-8.10). That can explain why it's off on my system (karmic koala). By the way, this is from the debian wiki: Debian 5.0.3 ships with a default mmap_min_addr of '0'. This means that the Debian system, by default, is susceptible to these NULL-pointer privilege escalation techniques. Unless you know that you have applications that require this functionality, it is recommended that you increase the value of mmap_min_addr on your system. Off by default.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
On Wed, Nov 4, 2009 at 5:18 AM, Donald Allen donaldcal...@gmail.com wrote: [SNIP] I realize that I'm preaching to the choir -- you know all this. But I think it's a mistake for (especially) the OpenBSD community to speak of OpenBSD as just about security, when it's so much more than that. I think I would rephrase that - OpenBSD is just about security, and security implies far more than simply patching holes. Stability, administrative transparency, and thorough documentation are all critical and overly neglected aspects of security. If you don't know the proper way to configure feature X, you cannot be sure it is configured securely. OpenBSD simply looks at security in a holistic fashion, while every other OS I have to suffer through views security as a 'feature'.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
On Wed, Nov 4, 2009 at 1:48 PM, Henry Sieff henry.si...@gmail.com wrote: On Wed, Nov 4, 2009 at 5:18 AM, Donald Allen donaldcal...@gmail.com wrote: [SNIP] I realize that I'm preaching to the choir -- you know all this. But I think it's a mistake for (especially) the OpenBSD community to speak of OpenBSD as just about security, when it's so much more than that. I think I would rephrase that - OpenBSD is just about security, and security implies far more than simply patching holes. Stability, administrative transparency, and thorough documentation are all critical and overly neglected aspects of security. If you don't know the proper way to configure feature X, you cannot be sure it is configured securely. OpenBSD simply looks at security in a holistic fashion, while every other OS I have to suffer through views security as a 'feature'. Perhaps. I don't presume to know enough about what Theo and the other developers think or how the development is done to have an opinion on that. But my point is that whether your assertion is true or not, the net result is the best platform for general computing that I know of, and not just in situations where security concerns are (or should be) paramount. OpenBSD has been a type-cast as a smart choice in high-vulnerability situations (where you certainly wouldn't dare use Windows or Linux), which is true, but the problem is that the descriptions tend to *limit* its usefulness or applicability to such situations, leading to questions like does OpenBSD run on a laptop?. My point is that OpenBSD is also the best choice (except if you care a lot about Flash :-) in situations where you *would* dare to use Windows or Linux . If I were doing software development on a machine located in a bank vault with no network connection, that machine would be running OpenBSD. /Don
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
On Wed, 4 Nov 2009 13:46:26 +1100 Aaron Mason simplersolut...@gmail.com wrote: Wine is a good idea, but it's stifling an even better idea - making applications compatible across multiple OSes, something that hasn't needed to be done in the M$ world because of the stranglehold they had/have over the consumer market. Microsoft will not follow free standanrds, Linux will follow Microsoft/IBM/Intel/W3C/bullshit_human_slaving_private standards. And I believe that is not portability in no way. That is just assassinating legacy and freedom. Let's put this into perspective: Linux would absolutely jump in popularity if Valve ported Steam and the Source engine to it, meaning games like the Half Life series, Left 4 Dead and Team Fortress 2 could run natively - not to mention that it would prompt other games that sell their wares through the Steam CDS to port their games as well - but since most of the games run just fine in Wine these days, there's no incentive. This will happen. We just have to wait for Linus/Redhat/Suse/etc to sign more NDAs. Look after your kids. -- Egon E. Braun Filho egonbr...@gmail.com
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
On Wed, 4 Nov 2009 13:46:26 +1100 Aaron Mason simplersolut...@gmail.com wrote: Wine is a good idea, but it's stifling an even better idea - making applications compatible across multiple OSes, something that hasn't needed to be done in the M$ world because of the stranglehold they had/have over the consumer market. Microsoft will not follow free standanrds, Linux will follow Microsoft/IBM/Intel/W3C/bullshit_human_slaving_private standards. And I believe that is not portability in no way. That is just assassinating legacy and freedom. Let's put this into perspective: Linux would absolutely jump in popularity if Valve ported Steam and the Source engine to it, meaning games like the Half Life series, Left 4 Dead and Team Fortress 2 could run natively - not to mention that it would prompt other games that sell their wares through the Steam CDS to port their games as well - but since most of the games run just fine in Wine these days, there's no incentive. This will happen. We just have to wait for Linus/Redhat/Suse/etc to sign more NDAs. Look after your kids. -- Egon E. Braun Filho mundoa...@gmail.com
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
Ok to add more idiotic ideas to debate about Linux/MS and interoperability and so on why not add this one? http://www.computerworlduk.com/community/blogs/index.cfm?entryid=2620blogid= 14 EU Wants to Re-define b Closedb as b Nearly Openb '.While there is a correlation between openness and interoperability, it is also true that interoperability can be obtained without openness, for example via homogeneity of the ICT systems, which implies that all partners use, or agree to use, the same solution to implement a European Public Service..' On Wed, Nov 4, 2009 at 5:39 PM, Egon E. Braun Filho egonbr...@gmail.com wrote: On Wed, 4 Nov 2009 13:46:26 +1100 Aaron Mason simplersolut...@gmail.com wrote: Wine is a good idea, but it's stifling an even better idea - making applications compatible across multiple OSes, something that hasn't needed to be done in the M$ world because of the stranglehold they had/have over the consumer market. Microsoft will not follow free standanrds, Linux will follow Microsoft/IBM/Intel/W3C/bullshit_human_slaving_private standards. And I believe that is not portability in no way. That is just assassinating legacy and freedom. Let's put this into perspective: Linux would absolutely jump in popularity if Valve ported Steam and the Source engine to it, meaning games like the Half Life series, Left 4 Dead and Team Fortress 2 could run natively - not to mention that it would prompt other games that sell their wares through the Steam CDS to port their games as well - but since most of the games run just fine in Wine these days, there's no incentive. This will happen. We just have to wait for Linus/Redhat/Suse/etc to sign more NDAs. Look after your kids. -- Egon E. Braun Filho egonbr...@gmail.com -- http://www.openbsd.org/lyrics.html
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
Dear sweetheart, On Thu, Nov 05, 2009 at 01:12:58AM +0100, Claire beuserie wrote: Yes, I know, I was present in the room when Illja gave the talk in 2006 at the CCC Kongress and the two OpenBSD developers in the room decided to completely ignore the exploit he showed until Miod reproduced it two weeks later... http://events.ccc.de/congress/2006/Fahrplan/day_4.en.html: Schedule Day 4: 30.12.2006 11:30 Unusual bugs Ilja http://openbsd.org/errata39.html: 017: SECURITY FIX: January 3, 2007 i386 only Insufficient validation in vga(4) may allow an attacker to gain root privileges if the kernel is compiled with option PCIAGP and the actual device is not an AGP device. The PCIAGP option is present by default on i386 kernels only. http://blogs.23.nu/ilja/2007/01/: So one of the things I noticed after my unusual bugs talk, the OpenBSD guys fix bugs _FAST_. I mean really fast ! bugfix and announcement within a few days. Not many vendors can pull that off. Two weeks, eh? Want it in a black frame with a white caption reading EPIC FAIL? I'd start gimp for that. If you are not an OpenBSD developer, don't make public statements like that, if OpenBSD developers decide to sit on a bug for a couple of months, it does not justify their full disclosure conflict where bugs are swept under the carpet Newsflash: I decide what I write on a public mailinglist. The rest of the sentence doesn't even parse, but i think it's something like Theo once hurt my feelings on the internets. What i always wanted to know, how do I join the secret Facebook group of people that have been flamed by Theo or another OpenBSD developer? Do you have an IRC channel? Is an emo haircut and a pic from weird angles really required in the application? I should have roasted you in the first reply like my guts told me to, instead i gave you the benefit of the doubt, my mistake. Doesn't happen again. Promise. Misc'ed for entertainment On Thu, Nov 5, 2009 at 12:55 AM, Tobias Ulmer tobi...@tmux.org wrote: On Wed, Nov 04, 2009 at 01:46:52PM +0100, Claire beuserie wrote: Dear Tobias, what you stated contradicts what Otto and Art posted. Ehm, no it doesn't. There are two different components, the actual null pointer dereference and the ability to map a page to address zero. What i'm pointing out is that mapping a page at adress 0 isn't new. It's also not a bug (this is true for the executable stack as well, as Art points out with some sarcasm). The ability for a programm to do so was recognised in 2006 by some developers, and prevented by a change to the kernel in 2008. It only becomes a problem once someone finds a NULL pointer dereference in the kernel. One such problem was discovered recently, and was fixed asap. If you had done some research for the file i linked to, you would find that Ilja gave a talk in 2006, called unusual bugs, where he demonstrated this class of vulnerabilities on OpenBSD. I'm sure plenty of Linux developers were sitting in the audience as well, laughing about us... Again, the bug was fixed asap: ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.9/i386/017_agp.patch Are you to be quoted as an OpenBSD developer on this? Certainly not, since I'm no OpenBSD developer. Salutions, Claire On Wed, Nov 4, 2009 at 3:46 AM, Tobias Ulmer tobi...@tmux.org wrote: On Wed, Nov 04, 2009 at 02:57:59AM +0100, Claire beuserie wrote: Hi, On Wed, Nov 4, 2009 at 12:58 AM, Theo de Raadt dera...@cvs.openbsd.org wrote: 2) At least three of our developers were aware of this exploitation method going back perhaps two years before than the commit, but we gnashed our teeth a lot to try to find other solutions. Clever cpu architectures don't have this issue because the virtual address spaces are seperate, so i386/amd64 are the ones with the big impact. We did think long and hard about tlb bashing page 0 everytime we switch into the kernel, but it still does not look attractive from a performance standpoint. I'm confused. That came out a bit weird: are you saying you knew about the bug for 2 years but did not fix it? It's not the bug, it's a class of vulnerabilities that allows to exploit a NULL pointer dereference under certain circumstances. http://packetstorm.linuxsecurity.com/poisonpen/8lgm/ptchown.c is commonly cited as the oldest public source (1994). Use google for more. c.b- -- Sent from my noname server. -- Sent from my noname server. -- Sent from my noname server.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
Hi, On Wed, Nov 4, 2009 at 12:58 AM, Theo de Raadt dera...@cvs.openbsd.orgwrote: 2) At least three of our developers were aware of this exploitation method going back perhaps two years before than the commit, but we gnashed our teeth a lot to try to find other solutions. Clever cpu architectures don't have this issue because the virtual address spaces are seperate, so i386/amd64 are the ones with the big impact. We did think long and hard about tlb bashing page 0 everytime we switch into the kernel, but it still does not look attractive from a performance standpoint. I'm confused. That came out a bit weird: are you saying you knew about the bug for 2 years but did not fix it? c.b-
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
2009/11/3 Claire beuserie claire.beuse...@gmail.com: Hi, On Wed, Nov 4, 2009 at 12:58 AM, Theo de Raadt dera...@cvs.openbsd.orgwrote: 2) At least three of our developers were aware of this exploitation method going back perhaps two years before than the commit, but we gnashed our teeth a lot to try to find other solutions. Clever cpu architectures don't have this issue because the virtual address spaces are seperate, so i386/amd64 are the ones with the big impact. We did think long and hard about tlb bashing page 0 everytime we switch into the kernel, but it still does not look attractive from a performance standpoint. I'm confused. That came out a bit weird: are you saying you knew about the bug for 2 years but did not fix it? c.b- Linux way.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
On Wed, Nov 04, 2009 at 02:57:59AM +0100, Claire beuserie wrote: Hi, On Wed, Nov 4, 2009 at 12:58 AM, Theo de Raadt dera...@cvs.openbsd.orgwrote: 2) At least three of our developers were aware of this exploitation method going back perhaps two years before than the commit, but we gnashed our teeth a lot to try to find other solutions. Clever cpu architectures don't have this issue because the virtual address spaces are seperate, so i386/amd64 are the ones with the big impact. We did think long and hard about tlb bashing page 0 everytime we switch into the kernel, but it still does not look attractive from a performance standpoint. I'm confused. That came out a bit weird: are you saying you knew about the bug for 2 years but did not fix it? It's not the bug, it's a class of vulnerabilities that allows to exploit a NULL pointer dereference under certain circumstances. http://packetstorm.linuxsecurity.com/poisonpen/8lgm/ptchown.c is commonly cited as the oldest public source (1994). Use google for more. c.b- -- Sent from my noname server.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
My interpretation is that yes, they identified it as a possibility, but due to limitations of the Intel platform, there wasn't an obvious, clean, correct way to fix it. I don't think this is a primary exploit, however. You would have to have a buffer overflow or something in some other app first. Fixing this, as someone stated, mitigates the consequences of other primary exploits. But feel free to correct me if I'm wrong (do I really need to say that? :) C2 Claire beuserie wrote: Hi, On Wed, Nov 4, 2009 at 12:58 AM, Theo de Raadt dera...@cvs.openbsd.orgwrote: 2) At least three of our developers were aware of this exploitation method going back perhaps two years before than the commit, but we gnashed our teeth a lot to try to find other solutions. Clever cpu architectures don't have this issue because the virtual address spaces are seperate, so i386/amd64 are the ones with the big impact. We did think long and hard about tlb bashing page 0 everytime we switch into the kernel, but it still does not look attractive from a performance standpoint. I'm confused. That came out a bit weird: are you saying you knew about the bug for 2 years but did not fix it? c.b-
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
On Wed, Nov 4, 2009 at 1:04 PM, Gonzalo Lionel Rodriguez gonz...@sepp0.com.ar wrote: 2009/11/3 Claire beuserie claire.beuse...@gmail.com: Hi, On Wed, Nov 4, 2009 at 12:58 AM, Theo de Raadt dera...@cvs.openbsd.orgwrote: 2) At least three of our developers were aware of this exploitation method going back perhaps two years before than the commit, but we gnashed our teeth a lot to try to find other solutions. Clever cpu architectures don't have this issue because the virtual address spaces are seperate, so i386/amd64 are the ones with the big impact. We did think long and hard about tlb bashing page 0 everytime we switch into the kernel, but it still does not look attractive from a performance standpoint. I'm confused. That came out a bit weird: are you saying you knew about the bug for 2 years but did not fix it? c.b- Linux way. What a knob. It makes me sad to say I used his crap now if he has that much contempt for those who value security before practicality. It's good to see Theo et al stick to their guns on this issue. I'd rather have a machine that is secure than one that can run Windows binaries. Wine is a good idea, but it's stifling an even better idea - making applications compatible across multiple OSes, something that hasn't needed to be done in the M$ world because of the stranglehold they had/have over the consumer market. Let's put this into perspective: Linux would absolutely jump in popularity if Valve ported Steam and the Source engine to it, meaning games like the Half Life series, Left 4 Dead and Team Fortress 2 could run natively - not to mention that it would prompt other games that sell their wares through the Steam CDS to port their games as well - but since most of the games run just fine in Wine these days, there's no incentive. Linus is shooting himself in the foot and he has no idea. Linux tries to be everything to everyone, and by doing it the way is does, it greatly limits its potential. OpenBSD does one thing and does it well - being secure. That's all there is to it. -- Aaron Mason - Programmer, open source addict - Oh, why does everything I whip leave me?
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
On Tue, Nov 03, 2009 at 04:58:25PM -0700, Theo de Raadt wrote: [bcc'd to Dan Goodin @ theregister] If anyone wants a choice quote from me about the recent Linux holes, this is what I have to say: Linus is too busy thinking about masturabating monkeys, he doesn't have time to care about Linux security. I was considering offering him this: http://www.wellcoolstuff.com/Merchant2/graphics/0001/20-Apr-07-05.jpg But couldn't get my hands on one yet ;-) Gilles -- Gilles Chehade freelance developer/sysadmin/consultant http://www.poolp.org
http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
[bcc'd to Dan Goodin @ theregister] If anyone wants a choice quote from me about the recent Linux holes, this is what I have to say: Linus is too busy thinking about masturabating monkeys, he doesn't have time to care about Linux security. For the record, this particular problem was resolved in OpenBSD a while back, in 2008. We are not super proud of the solution, but it is what seems best faced with a stupid Intel architectural choice. However, it seems that everyone else is slowly coming around to the same solution. The commit message: CVSROOT:/cvs Module name:src Changes by: dera...@cvs.openbsd.org 2008/06/24 15:24:03 Modified files: sys/arch/alpha/include: vmparam.h sys/arch/amd64/include: vmparam.h sys/arch/arm/include: vmparam.h sys/arch/i386/include: vmparam.h sys/arch/sh/include: vmparam.h sys/arch/sparc/include: vmparam.h sys/arch/vax/include: vmparam.h sys/arch/sh/sh : trap.c Log message: On user/kernel shared page table machines, do not let processes map their own page 0, as discussed with miod (and many others previously, including art and toby). On sparc, make this __LDPGSZ because PAGE_SIZE is non-constant ok miod tedu There are four things interesting about this change: 1) The #1 reason why the Linux team has not commited this by default is because it breaks Wine, which wants to play with page 0 -- so basically they are resisting this for Windows binary compatibility Ironic, isn't it? If anyone else tells you that is not the #1 reason, they are lying. We decided we don't care about Wine. 2) At least three of our developers were aware of this exploitation method going back perhaps two years before than the commit, but we gnashed our teeth a lot to try to find other solutions. Clever cpu architectures don't have this issue because the virtual address spaces are seperate, so i386/amd64 are the ones with the big impact. We did think long and hard about tlb bashing page 0 everytime we switch into the kernel, but it still does not look attractive from a performance standpoint. 3) Last week a bug was found in OpenBSD's kernel which was locally exploitable before the commit on Jun 24, 2008. Afterwards that fix, it simply becomes a kernel crash; you cannot gain priviledge from it. The reality is that kernel bugs will always exist, no matter how hard we try. Our focus therefore is always on finding innovative ideas which make bugs very hard to exploit succesfully. Bugs will exist. At least they should be more difficult to exploit. 3) Note the date of the commit, 2008/06/24. Interestingly, this commit was done 1 month before Linus posted this: http://article.gmane.org/gmane.linux.kernel/706950 I'm glad we care about security and trying to make things better, and I am glad that Linus prefers to write articles about monkey masturbation. In life, everyone should stick to what they know the most about. Because Linus knows dick all about security research.
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
Theo de Raadt wrote: http://article.gmane.org/gmane.linux.kernel/706950 I replaced Linux around '01 or '02 with OpenBSD both at companies I've worked for since and at home. I don't really care what other people use for their needs, and I've been neutral in my opinion about Torvalds and Linux (mostly because I don't pay any attention to what he or anyone else in the Linux crowd have to say.) I didn't move to, or stick with, OpenBSD as an anti-Linux (or anti-anything) statement. My opinion changed today when I read Linus' email from Theo's link. Linus seriously thinks that any random bug in any app that causes a crash is just as important as a security hole that gets your box rooted? Now I don't just think he's an idiot, I know it. Now I understand the background to the disparaging comments Theo has made about Linus now and then. -- -RSM http://www.erratic.ca
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
Theo de Raadt wrote: http://article.gmane.org/gmane.linux.kernel/706950 I replaced Linux around '01 or '02 with OpenBSD both at companies I've worked for since and at home. I don't really care what other people use for their needs, and I've been neutral in my opinion about Torvalds and Linux (mostly because I don't pay any attention to what he or anyone else in the Linux crowd have to say.) I didn't move to, or stick with, OpenBSD as an anti-Linux (or anti-anything) statement. My opinion changed today when I read Linus' email from Theo's link. Linus seriously thinks that any random bug in any app that causes a crash is just as important as a security hole that gets your box rooted? Now I don't just think he's an idiot, I know it. Now I understand the background to the disparaging comments Theo has made about Linus now and then. Don't tell us; we know. Tell linus. You can google for his email address. Not that he'll care. He's too busy watching monkey porn instead of building researching last-year's security technology that will stop an exploit technique that has been exploited multiple times. He's got redhat to try to cover for that now, they're a public company filling his bank account, and the best way to increase his stock is to accuse other people of having the wrong standards. Security technology? Why does he need to bother. He's got NSA to write that code for him! (a previous exploitable hole using this exploit mechanism was in NSA-donated code. And God bless America.)
Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
2009/11/3 Gilles Chehade gil...@openbsd.org: On Tue, Nov 03, 2009 at 04:58:25PM -0700, Theo de Raadt wrote: [bcc'd to Dan Goodin @ theregister] If anyone wants a choice quote from me about the recent Linux holes, this is what I have to say: Linus is too busy thinking about masturabating monkeys, he doesn't have time to care about Linux security. I was considering offering him this: http://www.wellcoolstuff.com/Merchant2/graphics/0001/20-Apr-07-05.jpg But couldn't get my hands on one yet ;-) God damn Gilles.. And you didn't find one to bring to us at a hackathon! Linus doesn't *deserve* one of those - I thought because I work on OpenBSD only I do! I will be deeply offended if Linus gets one of those before OpenBSD developers do.. Well, the hell with the rest of you.. *I* at least want one first.. Proudly! Linus doesn't deserve one 'till he has a commit in our tree. ;) -Bob
