Kees Cook
outflux.net · Personal blog · on HN since 2011
Kees Cook, a Linux kernel security developer, writes about kernel hardening and security improvements in each Linux release.
What HN saysHN commenters recommend his 'Security things in Linux' series as an excellent, in-depth look at kernel security, and link his talk slides.
42HN people shared it
12linked it in comments
48stories submitted
565story points
3 years agolast shared
2011people per year2026
Most-shared posts
- 1Making C Less Dangerous [pdf]5 people · 15 points · first shared 2018 · discussion on HN
- 2Security things in Linux v4.123 people · 59 points · first shared 2017 · 1 comments on HN
- 3Security Things in Linux v5.83 people · 6 points · first shared 2021 · discussion on HN
- 4Security things in Linux v4.82 people · 97 points · first shared 2016 · 21 comments on HN
- 5Security things in Linux v4.32 people · 66 points · first shared 2016 · 6 comments on HN
- 6Security-related improvements in Linux 4.202 people · 13 points · first shared 2018 · discussion on HN
- 7security things in Linux v5.42 people · 7 points · first shared 2020 · discussion on HN
- 8Security things in Linux v5.32 people · 6 points · first shared 2019 · discussion on HN
- 9Security Things in Linux v5.52 people · 6 points · first shared 2020 · discussion on HN
- 10Security things in Linux v4.72 people · 5 points · first shared 2016 · discussion on HN
- 11Security Things in Linux v5.12 people · 5 points · first shared 2019 · discussion on HN
- 12Security Things in Linux 4.172 people · 4 points · first shared 2018 · discussion on HN
- 13Security things in Linux v4.52 people · 4 points · first shared 2016 · discussion on HN
- 14Security things in Linux v4.42 people · 3 points · first shared 2016 · discussion on HN
- 15Security things in Linux v4.62 people · 2 points · first shared 2016 · discussion on HN
What HN people wrote when they linked it
tptacek · 2017-08-31
For similar content but in much greater depth, this is a pretty excellent series of blog posts:
https://outflux.net/blog/archives/2017/07/10/security-things-in-linux-…
ndsipa_pomu · 2022-12-13
You can boot from a MD RAID1 system that's degraded easily enough. Here's some info on how to implement it https://outflux.net/blog/archives/2018/04/19/uefi-booting-and-raid1/
silisili · 2022-03-11
I like data like this - it reminds me of the pleasant places maps[1].
That said - you have to be wary of both types of maps because it doesn't take into account other potentially annoying factors. The biggest being humidity - there's a huge difference between 90 degree phoenix and 90 degree miami. Then there's rainfall, and one a lot of people don't think about - wind.
To add - if you're thinking about seriously comparing two climates, check out this comparison tool [2]. Has any metric you can dream of charted together.
1 - https://kellegous.com/j/2014/02/03/pleasant-places/
2 - https://outflux.net/weather/noaa/index.php
pjmlp · 2022-01-28
Slides are available here, if you don't want to watch the full talk.
https://outflux.net/slides/2022/lca/
jolmg · 2019-09-22
https://outflux.net/blog/archives/2010/01/24/google-is-wardriving/
If you don't have Wifi on, maybe you had it before, and Google saved your location based on it?
cheiVia0 · 2016-10-21
Update for the latest security issue:
https://outflux.net/blog/archives/2016/10/20/cve-2016-5195/
symtos · 2016-05-29
not necessarily. there are software emulation -- examples would be W^X on OpenBSD[1] and Grsecurity/PaX on linux[2]. Ubuntu[3] and RedHat[4] also has (partial) NX-emulation thanks to ExecShield.
As for OpenBSD and Linux without grsec/pax, one can bypass NX (whether the CPU has the NX-bit or not) by marking the region with the shellcode as executable, eg:
mprotect(shellcode & -pagesize, len, PROT_EXEC);
((void()()) shellcode)();
in an exploit this could be accomplished by ROPing
1: http://marc.info/?l=openbsd-misc&m=105056000801065
2: https://pax.grsecurity.net/docs/mprotect.txt
3: https://outflux.net/blog/archives/2009/05/14/nx-emulation-in-ubuntu/
4: https://en.wikipedia.org/wiki/Exec_Shield
bitcartel · 2012-12-10
Any risk is increased by sloppy implementation. For example, every single keystroke is being sent over HTTP without encryption. (http://www.outflux.net/blog/archives/2012/11/09/product-search-in-ubun…
Today, if you want to de-Amazon Ubuntu, it's not just the shopping lens you have to disable, you should also remove Unity web app integration. (https://news.ycombinator.com/item?id=4888234)
If it gets to the point where you have to run a shell script to remove the 'spyware' (for lack of a better word), Ubuntu will have a real marketing problem on its hands.
JoachimSchipper · 2012-04-12
According to http://www.outflux.net/blog/archives/2009/10/22/tpm-as-rng/#comment-79… TPM may even be using PRNGs. So you're right that the quality of output need not be better than what a modern OS already provides. (I am not aware of any case where a properly-used /dev/random failed to produce sufficient entropy. Note that doing something sensible at boot is part of "properly-used" here.)
It is possible to provide true randomness from a chip, but it's probably cheaper not to.
aranazo · 2011-11-09
If you run pulseaudio you can use parec. It's fiddly but there is an example script here http://www.outflux.net/blog/archives/2009/04/19/recording-from-pulseau…
rlpb · 2014-06-25
Doing one of these things may introduce a security vulnerability, depending on the rest of your environment.
Some programs that use select(2) are known to assume that FD_SETSIZE is at least the maximum number of file descriptors available (instead of checking FD_SETSIZE). This lack of bounds checking may lead to a stack or heap overflow and a security vulnerability.
More recently, if you build with fortified glibc options, then you'll get automatic bounds checking, but do you know that your own daemons are built this way?
This is an example of why it's not a good idea to arbitrarily change a list of default settings system-wide without understanding the implications. The defaults have not been changed for a reason; otherwise distributions would already ship with these changes.
References: https://lists.ubuntu.com/archives/ubuntu-devel/2010-September/031446.h… http://www.outflux.net/blog/archives/2014/06/13/5-year-old-glibc-selec…
cm3 · 2016-10-10
Kees Cook and others have been porting or reimplementing features exclusive to grsec in upstream linux.
https://outflux.net/blog/archives/2016/09/26/security-things-in-linux-…
https://outflux.net/blog/archives/2016/09/27/security-things-in-linux-…
https://outflux.net/blog/archives/2016/09/28/security-things-in-linux-…
https://outflux.net/blog/archives/2016/09/30/security-things-in-linux-…
https://outflux.net/blog/archives/2016/10/03/security-things-in-linux-…
https://outflux.net/blog/archives/2016/10/04/security-things-in-linux-…
And naturally some stuff is exclusive to linux upstream, though grsec will benefit from those automatically if they deem it good enough.