07-19-2018, 10:45 AM
Greg Kroah-Hartman on Linux, Security, and Making Connections at Open Source Summit
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/07/greg-kroah-hartman-on-linux-security-and-making-connections-at-open-source-summit.png" width="1322" height="554" title="" alt="" /></div><div><div><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/07/greg-kroah-hartman-on-linux-security-and-making-connections-at-open-source-summit.png" class="ff-og-image-inserted" /></div>
<p><span>People might not think about the Linux kernel all that much when talking about containers, serverless, and other hot technologies, but none of them would be possible without Linux as a solid base to build on, says Greg Kroah-Hartman. He should know. Kroah-Hartman maintains the stable branch of the Linux kernel </span><a href="https://en.wikipedia.org/wiki/Greg_Kroah-Hartman"><span>along with several subsystems. </span></a><span>He is also co-author of the </span><a href="https://www.linuxfoundation.org/2017-linux-kernel-report-landing-page/"><span>Linux Kernel Development Report</span></a><span>, a Fellow at The Linux Foundation, and he serves on the program committee for </span><a href="https://events.linuxfoundation.org/events/open-source-summit-north-america-2018/"><span>Open Source Summit.</span></a></p>
<p><span>In this article, we talk with Kroah-Hartman about his long involvement with Linux, the importance of community interaction, and the upcoming Open Source Summit.<br /></span></p>
<p><strong><span>The Linux Foundation: New technologies (cloud, containers, machine learning, serverless) are popping up on weekly basis, what’s the importance of Linux in the changing landscape?</span></strong></p>
<p><strong><span>Greg K-H: </span></strong><span>There’s the old joke, “What’s a cloud made of? Linux servers.” That is truer than most people realize. All of those things you mention rely on Linux as a base technology to build on top of. So while people might not think about “Linux the kernel” all that much when talking about containers, serverless and the other “buzzwords of the day,” none of them would be possible without Linux being there to ensure that there is a rock-solid base for everyone to build on top of. </span></p>
<p><span>The goal of an operating system is to provide a computing platform to userspace that looks the same no matter what hardware it runs on top of. Because of this, people can build these other applications and not care if they are running it locally on a Raspberry Pi or in a cloud on a shared giant PowerPC cluster as everywhere the application API is the same.</span></p>
<p><span>So, Linux is essential for all of these new technologies to work properly and scale and move to different places as needed. Without it, getting any of those things working would be a much more difficult task.</span></p>
<p><strong><span>LF: You have been involved with Linux for a very long time. Has your role changed within the community? You seem to focus a lot on security these days.</span></strong></p>
<p><span><strong>Greg K-H:</strong> </span><span>I originally started out as a driver writer, then helped write the security layer in the kernel many many years ago. From there I started to maintain the USB subsystem and then co-created the driver model. From there I ended up taking over more driver subsystems and when the idea for the stable kernel releases happened back in 2005, I was one of the developers who volunteered for that.</span></p>
<p><span>So for the past 13 years, I’ve been doing pretty much the same thing, not much has changed since then except the increased number of stable trees I maintain at the same time to try to keep devices in the wild more secure.</span></p>
<p><span>I’ve been part of the kernel security team I think since it was started back in the early 2000’s but that role is more of a “find who to point the bug at” type of thing. The kernel security team is there to help</span></p>
<p><span>take security problem reports and route them to the correct developer who maintains or knows that part of the kernel best. The team has grown over the years as we have added the people that ended up getting called on the most to reduce the latency between reporting a bug and getting it fixed.</span></p>
<p><strong><span>LF: We agree that Linux is being created by people all over the map, but once in a while it’s great to meet people in person. So, what role does Open Source Summit play in bringing these people together?</span></strong></p>
<p><span><strong>Greg K-H:</strong> </span><span>Because open source projects are all developed by people who work for different companies and who live in different places, it’s important to get together when ever possible to actually meet the people behind the email if at all possible. Development is an interaction that depends on trust, if I accept patches from you, then I am now responsible for those changes as well. If you disappear I am on the hook for them, so either I need to ensure they are correct, or even better, I can know that you will be around to fix the code if there is a problem. By meeting people directly, you can establish a face behind the email to help smooth over any potential disagreements that can easily happen due to the lack of “tone” in online communication.</span></p>
<p><span>It’s also great to meet developers of other projects to hear of ways they are abusing your project to get it to bend to their will, or learn of problems they are having that you did not know about. Or just learn </span><span>about new things that are being developed in totally different development groups. The huge range of talks at a conference like this makes it easy to pick up on what is happening in a huge range of </span><span>different developer communities easily.</span></p>
<p><strong><span>LF: You obviously meet a lot of people during the event. Have you ever come across an incident where someone ended up becoming a contributor or maintainer because of the exposure such an event provided?</span></strong></p>
<p><strong><span>Greg K-H: </span></strong><span>At one of the OSS conferences last year, I met a college student who was attending the conference for the first time. They mentioned that they were looking of any project ideas that someone with their skill level could help out with. At a talk later that day a new idea for how to unify a specific subsystem of the kernel came up and how it was going “just take a bunch of grunt work” to accomplish. Later that night, at the evening event, I saw the student again and mentioned the project to them and pointed them at the developer who asked for the help. They went off to talk in the corner about the specifics that would be needed to be done.</span></p>
<p><span>A few weeks later, a lot of patches started coming from the student and after a few rounds of review, were accepted by the maintainer. More patches followed and eventually the majority of the work was done, which was great to see, the kernel really benefited from their contribution.</span></p>
<p><span>This year, I ran into the student again at another OSS conference and asked them what they were doing now. Turns out they had gotten a job offer and were working for a Linux kernel company doing development on new products during their summer break. Without that first interaction, meeting the developers directly that worked on the subsystem that needed the help, getting a job like that would have been much more difficult.</span></p>
<p><span>So, while I’m not saying that everyone who attends one of these types of conferences will instantly get a job, you will interact with developers who know what needs to be done in different areas of their open source projects. And from there it is almost an easy jump to getting solid employment with one of the hundreds of companies that rely on these projects for their business.</span></p>
<p><strong><span>LF: Are you also giving any talks at Open Source Summit?</span></strong></p>
<p><span><strong>Greg K-H:</strong> </span><span> </span><a href="https://events.linuxfoundation.org/events/open-source-summit-north-america-2018/program/schedule/">I’m giving a talk about the Spectre and Meltdown</a><span> problems that have happened this year. It is a very high-level overview, going into the basics of what they are, and describing when the many different variants were announced and fixed in Linux. This is a new security type of problem that is going to be with us for a very long time and I give some good tips on how to stay on top of the problem and ensure that your machines are safe.</span></p>
<p><em>Sign up to receive updates on Open Source Summit North America:</em></p>
<p><em>This article originally appeared at <a href="https://www.linuxfoundation.org/blog/greg-kroah-hartman-on-linux-security-and-making-connections-at-open-source-summit/">The Linux Foundation</a>.</em></p>
</div>
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/07/greg-kroah-hartman-on-linux-security-and-making-connections-at-open-source-summit.png" width="1322" height="554" title="" alt="" /></div><div><div><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/07/greg-kroah-hartman-on-linux-security-and-making-connections-at-open-source-summit.png" class="ff-og-image-inserted" /></div>
<p><span>People might not think about the Linux kernel all that much when talking about containers, serverless, and other hot technologies, but none of them would be possible without Linux as a solid base to build on, says Greg Kroah-Hartman. He should know. Kroah-Hartman maintains the stable branch of the Linux kernel </span><a href="https://en.wikipedia.org/wiki/Greg_Kroah-Hartman"><span>along with several subsystems. </span></a><span>He is also co-author of the </span><a href="https://www.linuxfoundation.org/2017-linux-kernel-report-landing-page/"><span>Linux Kernel Development Report</span></a><span>, a Fellow at The Linux Foundation, and he serves on the program committee for </span><a href="https://events.linuxfoundation.org/events/open-source-summit-north-america-2018/"><span>Open Source Summit.</span></a></p>
<p><span>In this article, we talk with Kroah-Hartman about his long involvement with Linux, the importance of community interaction, and the upcoming Open Source Summit.<br /></span></p>
<p><strong><span>The Linux Foundation: New technologies (cloud, containers, machine learning, serverless) are popping up on weekly basis, what’s the importance of Linux in the changing landscape?</span></strong></p>
<p><strong><span>Greg K-H: </span></strong><span>There’s the old joke, “What’s a cloud made of? Linux servers.” That is truer than most people realize. All of those things you mention rely on Linux as a base technology to build on top of. So while people might not think about “Linux the kernel” all that much when talking about containers, serverless and the other “buzzwords of the day,” none of them would be possible without Linux being there to ensure that there is a rock-solid base for everyone to build on top of. </span></p>
<p><span>The goal of an operating system is to provide a computing platform to userspace that looks the same no matter what hardware it runs on top of. Because of this, people can build these other applications and not care if they are running it locally on a Raspberry Pi or in a cloud on a shared giant PowerPC cluster as everywhere the application API is the same.</span></p>
<p><span>So, Linux is essential for all of these new technologies to work properly and scale and move to different places as needed. Without it, getting any of those things working would be a much more difficult task.</span></p>
<p><strong><span>LF: You have been involved with Linux for a very long time. Has your role changed within the community? You seem to focus a lot on security these days.</span></strong></p>
<p><span><strong>Greg K-H:</strong> </span><span>I originally started out as a driver writer, then helped write the security layer in the kernel many many years ago. From there I started to maintain the USB subsystem and then co-created the driver model. From there I ended up taking over more driver subsystems and when the idea for the stable kernel releases happened back in 2005, I was one of the developers who volunteered for that.</span></p>
<p><span>So for the past 13 years, I’ve been doing pretty much the same thing, not much has changed since then except the increased number of stable trees I maintain at the same time to try to keep devices in the wild more secure.</span></p>
<p><span>I’ve been part of the kernel security team I think since it was started back in the early 2000’s but that role is more of a “find who to point the bug at” type of thing. The kernel security team is there to help</span></p>
<p><span>take security problem reports and route them to the correct developer who maintains or knows that part of the kernel best. The team has grown over the years as we have added the people that ended up getting called on the most to reduce the latency between reporting a bug and getting it fixed.</span></p>
<p><strong><span>LF: We agree that Linux is being created by people all over the map, but once in a while it’s great to meet people in person. So, what role does Open Source Summit play in bringing these people together?</span></strong></p>
<p><span><strong>Greg K-H:</strong> </span><span>Because open source projects are all developed by people who work for different companies and who live in different places, it’s important to get together when ever possible to actually meet the people behind the email if at all possible. Development is an interaction that depends on trust, if I accept patches from you, then I am now responsible for those changes as well. If you disappear I am on the hook for them, so either I need to ensure they are correct, or even better, I can know that you will be around to fix the code if there is a problem. By meeting people directly, you can establish a face behind the email to help smooth over any potential disagreements that can easily happen due to the lack of “tone” in online communication.</span></p>
<p><span>It’s also great to meet developers of other projects to hear of ways they are abusing your project to get it to bend to their will, or learn of problems they are having that you did not know about. Or just learn </span><span>about new things that are being developed in totally different development groups. The huge range of talks at a conference like this makes it easy to pick up on what is happening in a huge range of </span><span>different developer communities easily.</span></p>
<p><strong><span>LF: You obviously meet a lot of people during the event. Have you ever come across an incident where someone ended up becoming a contributor or maintainer because of the exposure such an event provided?</span></strong></p>
<p><strong><span>Greg K-H: </span></strong><span>At one of the OSS conferences last year, I met a college student who was attending the conference for the first time. They mentioned that they were looking of any project ideas that someone with their skill level could help out with. At a talk later that day a new idea for how to unify a specific subsystem of the kernel came up and how it was going “just take a bunch of grunt work” to accomplish. Later that night, at the evening event, I saw the student again and mentioned the project to them and pointed them at the developer who asked for the help. They went off to talk in the corner about the specifics that would be needed to be done.</span></p>
<p><span>A few weeks later, a lot of patches started coming from the student and after a few rounds of review, were accepted by the maintainer. More patches followed and eventually the majority of the work was done, which was great to see, the kernel really benefited from their contribution.</span></p>
<p><span>This year, I ran into the student again at another OSS conference and asked them what they were doing now. Turns out they had gotten a job offer and were working for a Linux kernel company doing development on new products during their summer break. Without that first interaction, meeting the developers directly that worked on the subsystem that needed the help, getting a job like that would have been much more difficult.</span></p>
<p><span>So, while I’m not saying that everyone who attends one of these types of conferences will instantly get a job, you will interact with developers who know what needs to be done in different areas of their open source projects. And from there it is almost an easy jump to getting solid employment with one of the hundreds of companies that rely on these projects for their business.</span></p>
<p><strong><span>LF: Are you also giving any talks at Open Source Summit?</span></strong></p>
<p><span><strong>Greg K-H:</strong> </span><span> </span><a href="https://events.linuxfoundation.org/events/open-source-summit-north-america-2018/program/schedule/">I’m giving a talk about the Spectre and Meltdown</a><span> problems that have happened this year. It is a very high-level overview, going into the basics of what they are, and describing when the many different variants were announced and fixed in Linux. This is a new security type of problem that is going to be with us for a very long time and I give some good tips on how to stay on top of the problem and ensure that your machines are safe.</span></p>
<p><em>Sign up to receive updates on Open Source Summit North America:</em></p>
<p><em>This article originally appeared at <a href="https://www.linuxfoundation.org/blog/greg-kroah-hartman-on-linux-security-and-making-connections-at-open-source-summit/">The Linux Foundation</a>.</em></p>
</div>