GRSecurity Kernel Patch?

Sadly, there's been zero news outside of the immediate months following closing of releases.

It actually might be closer to 225,000. I read both numbers from lwn.net

If GRSec is such an excellent patch, why is it such a bitch to port to each new kernel and how come every distro previously using it (including security-focused ones like Alpine) decided it wasn't worth the hassle? This reeks of a badly-engineered hackjob people tolerated for muh features and because someone else was maintaining it.
The GRSec fags ultimately care more about squeezing shekels out of their customers than actual security. If they did, they'd either make their own unixlike OS designed around their idea of security or contribute to something like OpenBSD (assuming they could meet Theo's standards).

Attached: 7f144946551d1fbf6cbc608486063e446fe3cd6971bf98cd79f1c004e1886832.png (500x500, 137.36K)

The fact the devs are blatantly violating GPL suggests otherwise.
They wouldn't risk that much if they had a solid product, they're clearly running some sort of scam.

That scam is "build yourselves up as the Linux security guys and make a kernel patch nobody in their right mind would maintain unless they were paid to work on it fulltime." It didn't bring in as much money as they hoped so now they've turned to jewing their customers and hoping no one switches to OpenBSD.

That's how many errors the loonix devs made that spengler had to autocorrect...

It's not a product, it was a labour of love for over 15 years.

It's no scam, it was open for more than 15 years. The guy (he and Pax (slavic fellow)) actually do know how the linux code actually interacts with x86 and x86-64 machines. Linus doesn't.... not anymore.

Trust me, I've been using their patch since the beginning.
It's only in the last year or 2 they decided they wanted money.

Probably because of the ridiculous flux of the kernel. Constantly writing and rewriting 100's of 1000s of lines of code for no reason. It's not a sane project. In the past the linux-kernel wasn't like this... but then the wage-slaves got ahold of it. When they make mistakes you have to fix them, or change the code to work with the grsec features.

The reason to use loonix is the drivers. And with GRSec the fixes regarding buffer overruns etc (which OpenBSD doesn't have yet IIRC, but even windows has now).

For 15 years it was a labour of love, no charge, no violations.
It was part of the hardened linux kernel back in the mandrake days (2000) goes way back.

Now they decided to violate the GPL and want tons of money.
And no one sues them for their additional restrictive terms...

The same reason all the distros switched to systemd: Distro maintainers are lazy idiots, not programmers. Wasn't always the case but it is now.

Does anything go on in the grsec irc channels?

Not that I know of. Most of their outward presense is kept under lock since 2017. Forum is a wasteland.

I felt if this battle was fought back in 2017, it would've had more of a chance, but most people have just accepted it. I heard of it again through a mailing list, and I assume some of the other anons also heard it from a copypasta spread there. I know it was sent to the Open and Free BSD lists.

Was it this copypasta: lkml.org/lkml/2019/1/23/655
?

The battle can still be fought, each time they redistribute the work with the additional restrictive term tolls the statute of limitations (I think it's 2 years from the violation for copyright stuff, though it's split on weather it's 2 years from the violation or 2 years from discovery of the violation)

Any non-outward work going on, some insider info, or info from customers?

from a redchan.it email on the FreeBSD mailing list
```There are two iron laws when it comes to the linux-kernel and it's
facing towards the larger world.

1) The grsecurity-pax patch is absolutely vital if one wishes to not be
hacked by chinese(TM). (And has been vital for the last 15+ years.)

2) GRSecurity is _blatantly_ violating the GPL by adding additional
restrictive terms.

Other things we have come to know is that
A) Linus is a poor judge of quality, or just out of touch.

To say that GRSecurity is garbage?
No linus, it's just the layer covering up the shit heap that the
linux-kernel is when it comes to exploitable code.
That stench you smell is not that nice grassy cover over the garbage
tip, it is what is below, what that top is holding down.

You know... I would expect the things that Linus said about GRSecurity
from a white woman... I would expect that. Knowing nothing, spouting
bullshit, destroying lives. That's their _thing_.

But from a man?

Well, goes to show you. White men ain't men. Best they are is 40 year
old bois. Faggots to say for short in American parlance.

Same reason they won't hold it down when a bunch of fucking cunts CoC
them. You build the whole edifice, then you let a bunch of do-nothing
white women rule over the thing you built and you.

But hey, that's Linux!```

Everything is sent to the OpenBSD mailing list, out of respect to them, to keep them in the loop, should they wish to discuss.

They are the lain-os afterall, somehow...

I notice no one responds to such emails anymore on the LKML, years ago people would engage in debate.

Now it's all work work work. Nothing more.

Shame no one responds anymore. Only work related stuff is responded too. Feel free to respond on the bsd mailing list (and cc to Open's aswell: [email protected] (and maybe lkml: [email protected] ).

Some words of truth to linux never hurt anybody, right...

Grsec in practise refuses to deal with smaller businesses. I only know what I know from online research and a few friends in some IT teams. I have no acess to Grsec myself, and I doubt I would be able to get it for the company I work for.

What if some people just don't run services outside of localhost, and even use separate account for bloated Firefox (not my "default" browser, tbh).

grsecurity is a set of patches for the Linux kernel which emphasize security enhancements. The patches are typically used by computer systems which accept remote connections from untrusted locations, such as web servers and systems offering shell access to its users.

cringey and brownpilled

They wanted money before that, part of the reason they went full turbojew is because they saw distros/companies using their patches without paying them as thieves.

Funny, Gentoo and Alpine Linux abandoned grsecurity and both avoid systemd like the plague. Gentoo even goes out of their way to maintain a systemd-free fork of udev. If avoiding the all-consuming systemd and maintaining your own udev fork is easier than maintaining a fucking kernel patch, maybe you should take this as a sign said patch isn't as perfect as you think.

Grsec prevents alot of the standard remote execution bugs (buffer overflows etc), so if someone is exploiting your browser using those you won't get pwnd.

It is. Grsec snakes through the whole kernel. Any change made requires a fix to bring it back into working with grsec. It sounds like you kinda just don't know how C programming works... making all these vague comparisons.

(C programming works as such: you have an idea of what asm you want. You try to trick the compiler into producing said asm. It is an art)

And yet they stole the entire linux kernel source and built a derivative work from it.

So what is the solution? Sue them? It can be done. Theirs is the most blatant upfront violation of the GPL I've ever seen (they put it in writing and don't try to hide it)

Why hasn't anyone hacked their DL server and stolen the code back and released it?

It would be a great benefit if you wrote a piece regarding grsecurity and sent it to these lists:

Please do so. The more discussion the merrier.

They're afraid that a small company would pay for 1 server "license" and then release the code, I think.

What did the IT teams you talked to think about all this?

lkml.org/lkml/2019/1/23/759
>From Ivan Ivanov
Linux kernel sacrifices the security for the sake of progress, so it
is quite bloated at the moment and I am not sure that even GRSecurity
could fix it. Linux really needs to stop adding new features and
refactor itself to a smaller and more secure codebase before going
forward. Maybe 1 year break would be nice.

This man speaks the truth. The constant needless flux reintroduces long fixed bugs. It's like an endless inflowing tide.

Here's the problem. If Linux is as awful as the grsec fags claim, why didn't they work on their own kernel instead of niggerrigging their own shit onto Linux? Everything I've heard so far makes the grsec team sound legitimately stupid and now they're putting themselves at legal risk because their clusterfuck of a kernel patch wasn't making them as filthy rich as they hoped.

Right. I don't know their motivations, but that is a fair estimation. Someone sets up like, Louisville, Kentucky's first Docker vps service and pays for the grsec kernel. Suddenly its now a Zig Forums front company that leaks sources to TOR.

As for the teams I've talked to, well again, working with grsec is much higher scale than say at the company I work with. One of my friends works at a regional logistics company, and they have a boatload of things in terms of fegulations and compliance. From what it seems, grsec and related infosec focused modifications help a lot with compliance and getting sweet contracts.

Grsec only lists a bunch of no name companies and Dreamhost on their website, but with how fast AWS got their servers patched for spectre and meltdown, I wouldn't be suprised if they ran it underneath.

But teh firefox user has no privileges and also I deleted programs "sudo" and "su". :DDD

If you would spam all the Linux and FreeBSD lists with topics about us
using FreeBSD and/or Linux, while other people don't have access to
drinkable water and we should be ashamed, I would have empathy even for
whining.

what a faggot

Your fucking captcha doesn't work. You all fucking idiots here are using this shit with javascript enabled???

That doesn't make me trust you at all, retarded fanboy.

Why do you want to put your ass in dependence on its single mentally unstable developer?

That's the problem; you're going by what you heard.
You haven't been around and used grsec for 15 years and watch it develop.
You speak from ignorance and "dead rekoning", almost like any normie. You're using "common sense" in the tech world. It works as well as using such in the law world.

Your anger is warranted. You just need more history to back it up.

They are.
B L A T A N T - in writing - flagrant disregard an enumerated term in the license that allows them to make their patch in the first place

Any one of the kernel programmers who's code they modified and base their derivative work off of could sue them. They could band together and sue them. 100s of different people could sue them

"like father, like son". The patch is a monolithic "clusterfuck" because the kernel is.
It is the _best_ out-of-tree patch there has ever been however. 15 years of keeping it all working, and fixing kernel-team's bugs

They weren't looking for money for most of the existence of grsec. It was a hobby. Now bobby wants to fuck stacy, so needs muny.

But bobby ain't chad. He's nerd.
But he thinks he might be a ceo chad, so betrays his fellow nerds.

Oh and violates the copyright on the linux-kernel too.

It's the opensource way.
Linus, Theo, Spengler.

Thing is, he's the only one doing it for linux. There is no choice here.
And with the way the kernel is structured, and linus' inability to not have the whole code base constantly rewritten for no-purpose ... what other option could there be?

It is insanity to try to create an out-of-tree significant patch in that storm.
Only the corps can keep up... and spengler.

Not the user you replied to, but as i've said before, it's highly unlikely. I've taken the given-up-pill on grsec ever since the libel suit ended in a 260k settlement

Can you get him to leak the source?
I mean, GPL...

The settlement was against GRSec: they have to pay Bruce.
Why give up? It's a win...

Ofcourse not.

:P lol
Use the onion site:
oxwugzccvk3dk6tj.onion/tech/res/1022419.html

Because that was the last big news we heard about it. Yes it was only a half year ago, but there's been nothing since, and I doubt there will be big news again. Doesn't seem like any of the free software legal groups have an interest in taking the case up.

What does he mean by this?:
lkml.org/lkml/2019/1/24/497
Date Thu, 24 Jan 2019 17:03:33 +0100
From Adam Borowski
Subject Re: GRSec is vital to Linux security

On Thu, Jan 24, 2019 at 04:31:10PM +0100, Enrico Weigelt, metux IT consult wrote:

Enrico, you're responding to a notorious troll. If you haven't noticed,
this "Ivan Ivanov" sock puppet is a persona of some bastard who talks to
him/herself while tarnishing the name of our dear friend MikeeUSA (a true
pillar of the community!). His/her methods evolve, but the gist is the
same. Expect bringing up a bogus but semi-plausible controversy in order
to start as big a thread as possible, then once people who this bastard
wants to attack have joined, try to equate their position in the public view
with statements such as:

(Excuse the quotation, please wipe your monitor afterwards.)

# But from a man?
#
# Well, goes to show you. White men ain't men. Best they are is 40 year
# old bois. Faggots to say for short in American parlance.
#
# Same reason they won't hold it down when a bunch of fucking cunts CoC
# them. You build the whole edifice, then you let a bunch of do-nothing
# white women rule over the thing you built and you.

And this has been going for quite a while.

Connecting to systemd threads doesn't seem to work any longer, as people on
debian-user vs dng have wisened up. Same with license rescinsion threads.
What you read is just a yet another attempt to stir up some excrement.
Don't let any of it spray on you. Because that's the fake-Mikee's way.

Meow!
--
⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Remember, the S in "IoT" stands for Security, while P stands
⢿⡄⠘⠷⠚⠋⠀ for Privacy.
⠈⠳⣄⠀⠀⠀⠀

The "free software legal groups" exist only to commit legal malpractice.
The guy who ran the SFConservancy (Bradly Kuhn IIRC) isn't even a lawyer. He advises "clients" to wait it out: AKA run down the statute-of-limitations so you have no case.

A fucking _FAGGOT_.

You cannot rely on the "Free software legal groups" to help you because _they do not exist_.

Only recently did the SFConservancy hire a lawyer, and they had to put her in the head position because Bar rules do not allow a lawyer to be below non-lawyers in a legal firm.

Well now I'm using it. But where do you think I found this onion link? On the fucking Plebbit! But of course I didn't trust it, so I had to look into the source code of the page to get the link, because the Tor icon is not visible without javscript enbabled!

True story, bro. Now I can post without javashit. Nice site you have here.

lkml.org/lkml/2019/1/24/531
lkml.org/lkml/2019/1/24/538

Now another problem is that the Nerve Center link still leads to 8ch.net.

>lkml.org/lkml/2019/1/24/538
He said "faggot" there. B-but what about the shiny new Cock of Con-duck? Is he going to be demoted or something?

lkml.org/lkml/2019/1/24/545

From: Boris Lukashev

You've never heard of VMware, I take it? Its a proprietary half Linux
which beats GPL suits with strong arm tactics and technicalities. Unlike
grsec, they don't distribute any source, because it's proof of theft...
Grsecs back port work is also public, since they're public upstream
patches or mailing list patches, the GCC plugins are the real magic...
Those aren't as GPL as the kernel, rap is patented, respectre likely
will be as well. The critical code changes they need (per CPU PGD, for
one) will not be accepted as Linus has "said so." Those code bits are
out there...

Also, doesn't matter if their patch leaks for the most part (4.4 just
did get leaked a few weeks back), as I wrote before, nobody really has
the time or skill available to maintain at their level of quality...
Linux might be free, but it's not something that should be run in
production when there's data or resource at stake.

Is the thought process that they should open up their commercial stable
code for free to all? Because RHEL has the same "don't leak" policy on
RHEL sources too... VMware even goes so far as to blatantly claim not to
use Linux. How about Google's internal Linux?

GPL is dead (has been for 20y), build the strongest defenses you can
with whatever code you can get and prove, because your adversaries won't
care about which license clause their tooling adheres to.

Boris Lukashev
Systems Architect
Semper Victus

There are a lot of security modules.
en.wikipedia.org/wiki/Linux_Security_Modules

It's a friend of a friend thing. My friend's IT team pays for RHEL and hardens it inhouse. But he knows of other companies that have been contractors who use grsec or have used it.

lkml.org/lkml/2019/1/24/553

There is ample standing to sue. GRSec made it's "access agreement"
public,
which included terms to prevent redistribution (if you redistribute, we
punish you). Which is a direct violation of the "no additional
restrictive terms"
clause in the GPL.

Why won't anyone bring a copyright lawsuit?

Are they happy that GRSec gets to use their code, and prevent anyone
from
freeing the derivative work? The whole point of the GPL is that
derivative
works be under the same terms.

Bradly Spengler has violated this understanding, he thinks that his code
doesn't need to be under the same terms. The code which is simply a
derivative work of the linux kernel.

There is a valid, actionable case here.

Any of the programmers / copyright owners who's code he modified can sue
him.
He is violating their terms of use of their software.
He is in the USA. It's not difficult. Just SUE.

Just because VMWare does things one doesn't like doesn't mean you cannot
sue
Bradly Spengler.

Another thing is, the "Free software" legal "representation" is trash.
The SFConservancy was run for the longest time by a non-lawyer BKuhn.

He advised "clients" to WAIT it out! And then.. guess what they have
waiting years?
No case because the statute of limitations had been passed.

That's how that baby-faced moron has "helped" the free software legal
cause.

You guys need to hire real IP lawyers, not bullshit pretenders.
And if Bradly is making money, and enough of it, you might have profits
you could target.

I kinda think that the "Free software legal" teams exist only to diffuse
valid suits,
and stymie the guys who actually wrote the code and retained their
copyrights.

Pure legal malpractice by any accounting.

On 2019-01-24 16:25, Boris Lukashev wrote:

They suck.

GRSecurity is tied strictly to Spengler, there's no developer community around.

Yeah, because Spengler said so. The guy who wants to make money on kernel security, criticizes security modules. Surprise, surprise.

Where does PaxTeam stand on all this?
I notice they never update their patch anymore
(it was always updated inside grsec)

What does the user french guy (he's not a slav from eastern europe?) stand in all of this?

A collaborator still with spengler? Or a hero who will leak the whole thing?
As far as I've seen the evidence points to collaborator in the flagrant copyright violation...

Why does no one hack the servers and post Grsec-Copyright-Violation-Edition for all the world and tell spengler "we are enforcing the GEE PEEE ELLL"

It's right there, in back of a password protected pay wall.
Like "hahaha the air is so close, yet you drown one mm below the water in this cage!"

Then we could have a headline "HACKER PIRATES VIOLATE COPYRIGHT OF VIOLATOR OF COPYRIGHT!"

It really seems that PaxTeam is a close collaborator. So 2 people.

What is Adam's problem?

Just because something fixes a bug doesn't mean it's a good fix or a well-designed patch. Consistency is extremely important in an operating system and everything I've heard about grsec (including your posts and those of other grsec supporters) implies it introduces even more inconsistency for the sake of muh security features.
Convoluted and inconsistent security features only frustrate people and get turned off, like SELinux and its overdesigned kin. OpenBSD, on the other hand, tries its hardest to design features consistent, secure, and convenient enough that people will leave them turned on.

Attached: 1447959445903-3.jpg (686x584, 52.02K)

Grsecurity and it's RBAC gets used, has been consistent for 15 years.
SELinux doesn't because it's too convoluted and hard.

PaxTeam can join Brad Spengler Incorporated to form a multinational conglomerate.

hehe

Why did he call himself "PaxTeam" when he is just one user guy?

This is all an artifact of the "design" of linux.
AKA: no design.

You can't blaim a vine for conforming to the tree.

Plain SELinux is actually pretty simple. The Red Had framework on top of it with m4 macros is the mess.

lkml.org/lkml/2019/1/24/497
What is Adam's problem?

Gradm and RBAC from GrSec were nice.
Used it years ago. I had an auto-rule-set creation setting, you ran it for awhile, doing the things you did. Then made the ruleset more liberal if you wished (with * as wildcards).

All gone now, because no one can keep up with modern linux churn.

It's like a sickening sinking feeling in the gut. Had this thing forever, now they took it away.

Maybe it's just his real name. You know those Frenchmen.

Why do they get to leave the boat of software communism?
Why do they get to close a GPL'd work?

AppArmor and Tomoyo both provide MAC and have a learning mode that allows you to generate policies. Not the same as RBAC, I know, but still a nice option.

I'm not aware of anything that's a suitable replacement for PaX, though, so the loss of those patches is a shame.

You can do it on SELinux with audit2allow.

You can do it on SELinux too.
selinuxproject.org/page/AVCRules

What about a lawsuit? Would a lawsuit fill the hole?

Any leaked versions?

Anyone else have grapevine stories?

lkml.org/lkml/2019/1/25/514
Yes (also a programmer)
No

I wish I could say "to free the source", a court isn't going to order
specific performance where there is no contract, and there is no
contract between the Copyright owners and GRSec. Just a bare (and
revocable at will) license.

They could revoke if they didn't like Brad's face.
They can sue for damages (profits probably) since he violated the
license, and thus copyright (he would be more protected if he did have a
contract with the (C) owners: damages on his end would then more likely
simply be whatever he paid for the license)

I wish this were possible, but the GPL is not a contract in this
instance, so specific performance is not available. It's just a bare
license, you can get damages ($), that's all.

If the Copyright owners registered their copyrights prior to the
violation they could go for statutory damages and attorneys fees though.

So to what end...
Rage at GRSec getting off the opensource boat.
Anger at not having the security-code /slave/ we had for years.
Bellowing about how we are servants to our creed, and yet this
once-compatriot has betrayed that which we hold dear.

An attempt to use the GPL as a sword (instead of as a shield)?

Opensource works because men like being slaves. Slaves to their country,
slaves to women, slaves to an engineering field, slaves to a belief,
(and more recently: slaves to Codes of Conducts for hobby projects!).

Should not those who are still the slaves, rage against he who would use
their free labour and end his contributions back?

I think that is the entire point of "Copyleft". It's a way of getting
work that would cost millions of dollars, for free.

It works pretty well, up until 40 year old programmer has no stacy to
fuck, and no possibility of getting one.

But there's one last striving that can be done: one more needle prick
(or even knife gouge) that can be done against the escapee: and that is
a copyright lawsuit.

Since I cannot have my free leet secure kernel patch anymore... and no
one is out-in-the-open posting it in defiance of Brad (the escapee), I
would like one of the fellow slaves with standing - to sue him. In
vengeance for his betrayal of our class. They have a justiciable case,
evidence already in the hands of the courts (thanks to the libel case
(Thank you Bruce :D)).

What I really want is for GRSec to remain or return to being open and
free, like the GPL is supposed to provide.

On 2019-01-24 20:18, Boris Lukashev wrote:

I have nothing else than what i've posted. To anyone hoping for a leak, I think your best bet is something down the line. It's been only a half year, and I think a leak causing trouble is much more likely than a lawsuit(which would be very unlikely to start). Again, someone could make a front company and get the sourced that way.

The end of these patches is why I want to switch to OpenBSD.

Same here.
OpenBSD hasn't implemented all the protections though.

Could you talk to your people in the industry, and demonically conspire to at some point release the source in some spectacular way that will attract much attention and ire from grsec?

They will say it's illegal and try to get prosecutors after the leakers.
So do so user...

Could you talk to your people in the industry, and demonically conspire to at some point release the source in some spectacular way that will attract much attention and ire from grsec?

They will say it's illegal, I wonder if they will try to get prosecutors after the leakers (who must remain user)

Could you talk to your people in the industry, and devilishly conspire to at some point release the source in some spectacular way that will attract much attention and ire from grsec?

Do you think they will say it's illegal? I wonder if they will try to get prosecutors after the leakers (who must remain user)

Why Zig Forums? Why.

I think this explains it, my dude:
This page (media.8ch.net/file_store/9335c699581dc9edde6de0e02571522a98bfcc5e656c872959b997ab6baff46d.jpg) is currently offline. However, because the site uses Cuckflare's cianigger MITM™ technology you can continue to surf a snapshot of the site. We will keep checking in the background and, as soon as the site comes back, you will automatically be served the live version. Always Online™ is powered by Cloudflare | Hide this Alert 503 Service Temporarily Unavailable

The tor site doesn't use cloudflare

I don't care, I'm not fillout of Tor captchas.

Tor site doesn't have any capachatas.

Can't upload files tho.

Sometimes it does, sometimes it doesn't. Regardless it isn't 1 capcha per post, it's one per five posts which isn't too bad

Never has capathatas here.
Turn off javascript.

test

Well, according to their contract, and the GPL, someone who shares is free to do so. BUT, your contract with them would be canceled. Anyways, like I said, it's a friend of a friend thing. I personally feel that 200 is a ripoff, and my pal's team does too, seeing as I said, they harden the RHEL kernel inhouse.