From: "\"Tóth Attila\"" <atoth@atoth.sote.hu>
To: gentoo-hardened@lists.gentoo.org
Subject: Re: [gentoo-hardened] RIP hardened-sources
Date: Sun, 30 Apr 2017 16:56:48 +0200 [thread overview]
Message-ID: <e6dd254356e6005aad6b0f9cba4125cf.squirrel@atoth.sote.hu> (raw)
In-Reply-To: <20170430173412.f3f678cefe9c47f8034f35de@gentoo.org>
2017.Április 30.(V) 16:34 időpontban Andrew Savchenko ezt írta:
>> On Sun, Apr 30, 2017 at 04:00:39PM +0300, Andrew Savchenko wrote:
>> > The only way to preserve this functionality in the long run is to
>> > port it to the mainline kernel. This will not be easy, most likely
>> > not everything will be accepted, some stuff will have to be
>> > reimplemented using another approaches, etc.
>>
>> We had 16 years to do this with help of GrSec/PaX developers. It wasn't
>> happened, and it's unlikely happens now unless some huge company decide
>> to
>> spend a lot of resources for this.
>
> There was not enough motivation for this. Why to invest resources
> into porting if it works the way it is? Now situation is different,
> so we'll see what follows.
>
> BTW a number of features were ported to or reimplemented in the
> mainline kernel: ASLR, MAC, auditing, ptrace snooping protection.
> Probably many more, I haven't studies this in detail.
It's unlikely in my opinion to squeez stuff in the mainline kernel, given
a long history of ignorance regarding security and the bad habit of
reimplementing some features anyway in a contraproductive, weaker way.
If the leading developers could not reason for inclusion, it is unlikely
that some of those involved could achieve acceptance. Who is reading
processor specifications in the morning instead of watching the news -
apart from pipacs?
Think of it. You implement and invent unique stuff. Linux leaders
repeatedly fail to get the point and giving bogus reasons for rejection.
You have one life and limited resources. What would you do?
I don't have time to worry about the non-security-savvy part of the Linux
community going unprotected without even realizing it. However I hope
there will be a chance for everybody having enough knowledge to understand
the importance of the hardened track to use these unmatched software
techniques.
Best regards:
Dw.
--
dr Tóth Attila, Radiológus, 06-20-825-8057
Attila Toth MD, Radiologist, +36-20-825-8057
next prev parent reply other threads:[~2017-04-30 14:56 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-29 11:49 [gentoo-hardened] RIP hardened-sources Luis Ressel
2017-04-29 12:47 ` Alex Efros
2017-04-29 15:56 ` Daniel Cegiełka
2017-04-29 16:52 ` Javier Juan Martinez Cabezon
2017-04-29 16:58 ` Luis Ressel
2017-04-30 8:15 ` Javier Juan Martinez Cabezon
2017-04-29 17:04 ` Luis Ressel
2017-04-29 18:43 ` Daniel Cegiełka
2017-04-29 20:34 ` "Tóth Attila"
2017-04-29 22:04 ` Brant Williams
2017-04-30 13:00 ` Andrew Savchenko
2017-04-30 13:16 ` Alex Efros
2017-04-30 14:34 ` Andrew Savchenko
2017-04-30 14:56 ` "Tóth Attila" [this message]
2017-04-30 13:07 ` Andrew Savchenko
2017-04-29 13:11 ` Alex Efros
2017-04-29 13:46 ` PaX Team
2017-04-29 16:46 ` Alex Efros
2017-04-30 11:08 ` Alex Efros
2017-04-30 11:50 ` SK
2017-04-30 11:55 ` SK
2017-04-30 12:32 ` Andrew Savchenko
2017-04-30 12:56 ` Alex Efros
2017-04-30 13:28 ` Andrew Savchenko
2017-04-30 13:07 ` Daniel Cegiełka
2017-04-29 15:30 ` Paweł Hajdan, Jr.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e6dd254356e6005aad6b0f9cba4125cf.squirrel@atoth.sote.hu \
--to=atoth@atoth.sote.hu \
--cc=gentoo-hardened@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox