Re: [gentoo-hardened] RIP hardened-sources

[Andrew Savchenko]

On Sat, 29 Apr 2017 22:34:14 +0200 Tóth Attila wrote:
> 2017.Április 29.(Szo) 20:43 időpontban Daniel Cegiełka ezt írta:
> >> That's the part I don't get either. Since the only possible motivation
> >> I can think of for this move is to generate more income, they could've
> >> at least tried asking the community for donations first.
> >
> > It's more complex:
> >
> > https://www.theregister.co.uk/2015/08/27/grsecurity/
> >
> > I don't judge them. I'm interested in the future of projects that were
> > heavily dependent on PaX (Gentoo Hardened, Alpine Linux).
>
> I also have concernes about the future of Gentoo Hardened userspace.
> Security initiatives drew my attention 15+ years ago, when Adamantix was
> alive. After discontinuation of the project I've discovered Gentoo
> Hardened as something providing a remedy for security-aware refugees. Over
> the years I get used to the infrastructure of Daniel Robbins' Gentoo and
> experienced the benefits of the rolling release nature of the distro and
> all those simple compile time tools provides to the power users.
> When you go hardened, you cant stop it.
> I wish Hardened Gentoo survives and continue to exist for long.

The only way to preserve this functionality in the long run is to
port it to the mainline kernel. This will not be easy, most likely
not everything will be accepted, some stuff will have to be
reimplemented using another approaches, etc.

But there is no other way. GrSec/PaX team can be trusted no longer.
They ruined all 16 years of good and trustworthy record by what was
done 3 days ago, though the first bells rang 2 years ago when paid
subscription for stable patches was enforced. Even if they will
yield to the community pressure now, they may repeat this betrayal
later and thus can be trusted no longer.

Best regards,
Andrew Savchenko