Google slams Linux kernel, says it needs major security investment
Downstream vendors should allocate more resources to the upstream kernel, suggests Google
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Googlehas highlighted what it says are shortcomings in theLinuxkernel from a security perspective, and the issues these create for downstream vendors who roll the kernel into products.
In ablog post, Kees Cook from Google’s Open Source Security Team compares the Linux kernel to the US automotive industry of the 1960s in order to drive home the point that while the kernel runs flawlessly, when it fails, it falls apart miserably.
“The huge community surrounding Linux allows it to do amazing things and run smoothly. What’s still missing, though, is sufficient focus to make sure that Linuxfails welltoo,” wrote Cook.
Cook states he believes the problem is two-pronged. First, Linux needs to invest to make sure its code is robust, which will ensure that bugs don’t manifest at the rate that they do currently. But when they do, they should also be handled in a more efficient manner than the current arrangement.
Calling all downstream vendors
Sharing the “sobering” statistics, Cook says that the stable bug-fix only release of the kernel comes out with about 100 new fixes every week. This leaves downstream vendors with three choices; either to ignore all fixes, prioritize the “important” ones, or apply them all.
Highlighting the issues with all three strategies, he says that the only real option, from a security point of view, is to apply all fixes. This option however presents an engineering nightmare for vendors.
Instead Cook suggests that rather than individual vendors applying the fixes, greater onus should be laid on increasing upstream collaboration. He suggests various mechanisms including introducing more automated testing, continuous integration, and other steps to streamline the kernel’s development process.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
“Instead of testing kernels after they’re released, it’s more effective to test during development,” suggests Cook, asking downstream vendors to infuse at least a 100 more engineers to work on the upstream kernel.
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Red One isn’t perfect but it proves we need more action-packed Christmas movies
