Linus: Don't bother with grsecurity. Their patches are pure garbage

Re:Linus: Don't bother with grsecurity. Their patches are pu... by chrissnell on Sunday June 25, 2017 @11:03PM (#14633751)

I'm an Arch user and I have no idea what's going on with security-focused kernels these days. I was running the grsecurity kernel package but that was recently replaced by a "linux-hardened" package that I had never heard of. Then, a pacman update tonight installed a plain Linux kernel. It's very confusing. Not unexpected for Arch but there is so little on the wiki about this.

[ Parent | on HN ]

Re:Linus: Don't bother with grsecurity. Their patches are pu... by cyphar on Sunday June 25, 2017 @11:10PM (#14633785)

The grsecurity patches have been made private. Although they are under the GPL (because they are a derivative work of the Linux kernel), the company that produces grsecurity engages in the unethical (and potentially illegal) business practice of threatening to terminate customer subscriptions if they exercise their right to distribute the patches.

In other words, no customer is going to distribute the patches because they will have wasted money and lost access to updates. This is very reminiscent of free speech chilling effects, and I'm surprised none of the copyright holders in Linux (myself included) have teamed up to sue them.

Long story short, the general community (including distributions) no longer has access to new patches making grsecurity useless for the community.

[ Parent | on HN ]

Re:Linus: Don't bother with grsecurity. Their patches are pu... by snuxoll on Sunday June 25, 2017 @11:27PM (#14633847)

> the company that produces grsecurity engages in the unethical (and potentially illegal)

Unethical, probably - illegal, probably not. The GPL dictates what you can do once code hits your hands (or binaries compiled with), it doesn't prevent companies from selling it to you or what contract they do it under.

[ Parent | on HN ]

Re:Linus: Don't bother with grsecurity. Their patches are pu... by jopsen on Sunday June 25, 2017 @11:52PM (#14633944)

Sure you can sell it, and under whatever terms you like. But you have to _also_ provide the full source under the GPL, not under "the GPL with additional constraints".

I'm no lawyer, but I highly doubt it'll hold. And buying Linux from them could be very toxic as "GPL violation" => "termination of license" -- and I'm not sure how you go about getting a new license :)

[ Parent | on HN ]

Re:Linus: Don't bother with grsecurity. Their patches are pu... by infogulch on Monday June 26, 2017 @01:56AM (#14634416)

No, under the GPL you have the right to redistribute the source. You don't have a right to receive new patches or maintain any particular subscription, that is a different consideration that you can maintain in a separate contract.

[ Parent | on HN ]

Re:Linus: Don't bother with grsecurity. Their patches are pu... by jopsen on Monday June 26, 2017 @02:35AM (#14634547)

True,

But punishing people for exercising their rights, is quite similar to placing restrictions on said rights.

I'm no lawyer, but you generally can't out-smart the law :)

[ Parent | on HN ]

Re:Linus: Don't bother with grsecurity. Their patches are pu... by infogulch on Monday June 26, 2017 @10:57AM (#14637282)

Of course you can be punished for exercising your rights. There is no better example than free speech: you're free to say whatever you want, and your customers are free to leave in response. The considerations of many contracts include some form of restricting your rights in return for something.

IANAL either, in case that wasn't obvious.

[ Parent | on HN ]

Re:Linus: Don't bother with grsecurity. Their patches are pu... by skymt on Sunday June 25, 2017 @11:47PM (#14633923)

That depends on how you read section 6 of the GPL2. It states in part:

> You may not impose any further restrictions on the recipients' exercise of the rights granted herein.

The central right granted under the GPL is, of course, the right to modify and redistribute the source. I'm not a lawyer, and I'm certain that Grsecurity could find a number of legal arguments that what they're doing is allowed (likely starting with the claim that terminating a relationship with a customer isn't legally imposing a restriction on that customer's actions), but the idea that they're in violation of the GPL isn't pulled from thin air.

[ Parent | on HN ]

Re:Linus: Don't bother with grsecurity. Their patches are pu... by AstralStorm on Monday June 26, 2017 @01:47AM (#14634383)

It is enough for them to send the source on a written request. May be a link (working!), may be source code on a disk.

Someone will have to set up an automatic snail mailer.

If they do not respect that, they are explicitly violating GPL.

[ Parent | on HN ]

Re:Linus: Don't bother with grsecurity. Their patches are pu... by jopsen on Monday June 26, 2017 @02:45AM (#14634586)

The point is if they punish you (such as discontinue business relationship) because you send a request to obtain the source, and exercise the rights you've been granted in the GPL, well, that's an additional restriction.

I'm no lawyer, but the spirit of the law or a contract matters. You can't avoid a speeding ticket because the wheels of your car wasn't touching the road in the photo :)

[ Parent | on HN ]

Re:Linus: Don't bother with grsecurity. Their patches are pu... by shakna on Sunday June 25, 2017 @11:18PM (#14633819)

Because grsecurity make no effort to separate out their patches, it's really hard to upstream them. Sometimes the Arch team get the effort in time, sometimes its overly difficult so you don't get the kernel rolled out by the time an update is available for plain.

[ Parent | on HN ]