View Full Version : Back door in Linux kernel


sattia
The following link is from the LKML and is discussing a back door attempt in kernel 2.6.

http://kerneltrap.org/node/view/1584

So we encourage ppl here not to run undeclared -stable-yet software especially the kernel on their production systems.

People who r fond of testing every new peace of software may get into troubles.

habdin
Salamo 3alaikom,

Production machines equals Desktops or servers? I read the article. The article says that one should take care while doing this. That is what I got from it.

Salam.

alaa
>So we encourage ppl here not to run undeclared -stable-yet software
>especially the kernel on their production systems.

and how is this software ever going to be declared stable without people testing it??
you should be gratefuk to people testing unstable code as long as they send bug reports.

cheers,
Alaa

mohamed
The man is talking about PRODUCTION SERVERS.

BTW, sattia is fond of testing and giving feedback, but not on the production servers.

Regards

alaa
sorry I meant to quote this line
>People who r fond of testing every new peace of software may get into troubles.

and anyway what you choose to do on your production servers is yours to decide.
Linus and Andrew Morton asked enterprise to start seriously testing 2.6 kernels including on production servers if possible.
without testing in reallife situations we'll have all these bugs waiting for us in stable versions.
the point is to be aware of the dangers of unstable software and have a plan on how to deal with issues and to keep track of development and any issues that arise.

if you're using software that is deemed unstable on your production servers, and if you did this with the consent of your employers and if you're aware of what it means to run such a server and if you activly monitor this server and submit bug reports then you're doing us all a great service and I thank you for it.

cheers,
Alaa

aix_32
just wonder of the mis-understanding of PRODUCTION SERVER term ?

it will cost you your job if u destroy a " PRODUCTION SERVER "

so, be carefull

salam,

mohamed
Originally posted by alaa

if you're using software that is deemed unstable on your production servers, and if you did this with the consent of your employers and if you're aware of what it means to run such a server and if you activly monitor this server and submit bug reports then you're doing us all a great service and I thank you for it.

cheers,
Alaa

I don't think the customers will thank me too for losses in their data and risking their business!!

sattia
No mohamed they will thank u too cuz u let them to know for sure that ur providing the worst service ever

alaa
It seems that u got the spirit and philosophy of Mandrake in ur reply. This is what keeps Mandrake away from reaching the servrers arena.

I think it is not accepted at all to put an unstable component into ur production servers even if Linus said so we simply will say no.

This is why development and test servers are made.

alaa
>just wonder of the mis-understanding of PRODUCTION SERVER term ?

how can I misunderstand a term that is redifined acording to the context and the person who uses it??

what redhat considers fit for production servers debian doesn't
what M$ considers fit for production servers other don't

the operative word I used is consent
webber says consent means

Voluntary accordance with, or concurrence in, what is done
or proposed by another; acquiescence; compliance;
approval; permission.


so if you boss agrees its fine
if you're the boss and you see it fit to use whatever software on your production server its fine.

if you have a small business with an intranet server, you needed some of the features in Samba CVS and decided to use it anyway, you'll rely on the community and good backup procedure to cover for you, who's to say you're wrong???
your an independant artist you have your own website, this new beta streaming server will make life much easier for you it looks good enough to use now and you can always ask for help on IRC when things break, go ahead use it who's to stope you??

>it will cost you your job if u destroy a " PRODUCTION SERVER "
how could this be true, people use M$ exchange servers everyday, they break practicaly everyday and nobody loses his job
of course this is not something good but lets think of it this way
by experience you know that sometimes unstable software is very usable in the free software world
you calculate your risks and find out that you can afford a bit of downtime as long asit can be resolved quickly
there is a compeling feature you want to use
or there is a compeling feature you'd like to use and you want your admins/engineers to experimant with it now to have an edge when its in wide use
or there is this very important feature to you that you have to realy test and stress to make sure is absolutley stable at some later date, you don't want to rely on others to test it
so you propose the use of the unstable software in some production servers, you take apropriate steps to make sure that downtime is not very painful, you don't do this unless probability of dataloss is low and you double check the backup procedure yourself
where is the problem?????

>I don't think the customers will thank me too for losses in their data and
>risking their business!!

risk of data loss and downtime is always there, no software is foolproof and other events can always happen, you don't promise your customers zero trouble you promise them minimum trouble and good sane procedure to cope with problems when they happen.
if you don't think testing on production servers is needed, if you think test severs are enough fine don't do it, but to some it makes sense, it might need more preperation and more calculation but it doesn't mean its wrong.

>It seems that u got the spirit and philosophy of Mandrake in ur reply. This is
>what keeps Mandrake away from reaching the servrers arena.

nice we can't discuss anything without someone bashing somebody else's choice of a distro
how about a vi vs emacs on production servers to boot

how on earth do you know what runs on servers and what doesn't????
there are statistics that show that advx, mandrakes packaging of Apache is in fact very popular on the web, there are of course statistics to prove anything including that cigarets are good for you.
in the mandrake bizcase website http://www.mandrakebizcases.com/ you'll find lots of companies that use Mandrake as servers in various setups and sectors.
and yes most of them are small business so what??

cheers,
Alaa

aix_32
Originally posted by alaa
>just wonder of the mis-understanding of PRODUCTION SERVER term ?

how can I misunderstand a term that is redifined acording to the context and the person who uses it??

what redhat considers fit for production servers debian doesn't
what M$ considers fit for production servers other don't

the operative word I used is consent
webber says consent means


so if you boss agrees its fine
if you're the boss and you see it fit to use whatever software on your production server its fine.

if you have a small business with an intranet server, you needed some of the features in Samba CVS and decided to use it anyway, you'll rely on the community and good backup procedure to cover for you, who's to say you're wrong???
your an independant artist you have your own website, this new beta streaming server will make life much easier for you it looks good enough to use now and you can always ask for help on IRC when things break, go ahead use it who's to stope you??

>it will cost you your job if u destroy a " PRODUCTION SERVER "
how could this be true, people use M$ exchange servers everyday, they break practicaly everyday and nobody loses his job
of course this is not something good but lets think of it this way
by experience you know that sometimes unstable software is very usable in the free software world
you calculate your risks and find out that you can afford a bit of downtime as long asit can be resolved quickly
there is a compeling feature you want to use
or there is a compeling feature you'd like to use and you want your admins/engineers to experimant with it now to have an edge when its in wide use
or there is this very important feature to you that you have to realy test and stress to make sure is absolutley stable at some later date, you don't want to rely on others to test it
so you propose the use of the unstable software in some production servers, you take apropriate steps to make sure that downtime is not very painful, you don't do this unless probability of dataloss is low and you double check the backup procedure yourself
where is the problem?????

>I don't think the customers will thank me too for losses in their data and
>risking their business!!

risk of data loss and downtime is always there, no software is foolproof and other events can always happen, you don't promise your customers zero trouble you promise them minimum trouble and good sane procedure to cope with problems when they happen.
if you don't think testing on production servers is needed, if you think test severs are enough fine don't do it, but to some it makes sense, it might need more preperation and more calculation but it doesn't mean its wrong.

>It seems that u got the spirit and philosophy of Mandrake in ur reply. This is
>what keeps Mandrake away from reaching the servrers arena.

nice we can't discuss anything without someone bashing somebody else's choice of a distro
how about a vi vs emacs on production servers to boot

how on earth do you know what runs on servers and what doesn't????
there are statistics that show that advx, mandrakes packaging of Apache is in fact very popular on the web, there are of course statistics to prove anything including that cigarets are good for you.
in the mandrake bizcase website http://www.mandrakebizcases.com/ you'll find lots of companies that use Mandrake as servers in various setups and sectors.
and yes most of them are small business so what??

cheers,
Alaa

i have one question, what number and type of production server u ever admin ??

alaa
zero what difference does it make
I made an argument you have something to say about it say it.

there is no way you can confirm my claims, I can just claim that I worked with 10 production servers, does this make my arguments valid??

what would make my arguments vaild is if they made sense, I probably stand a higher chance of making good arguments if I had direct experience but it is not nessecary.

and BTW did you realy need to quote all my post??
this happens to be a webforum, my post is above yours no need to quote it unless you'll reply to specific parts.

aix_32
alla,

1st,
i do apreciate yr efforts in giving help to all ppl in many events

2nd,
I asked you this question to find out if u ever have a real resposibility about a server that makes money to your company, in turn if there is a problem with that server, the money pumping will stop, u will be asked so many questios

3rd,
if u ever worked in a huge enviroment u would found out that, there 2 two types of servers:
1. staging server that can be used to test almost every thing
2. prodiction server, that should run smoothyl with min down time


u for sure have a very good experince in linux or even windows, but u still YOUNG , u need lots of real experiance

hope u understand my point of view

alaa
SORRY SORRY SORRY

I accidentaly hit edit instead of quote and completley borked aix's post
I'm sorry this was not an act of censorship wala 7aga
I left what I could salvage from the messgae (yes I only found out after submitting).
I'm soooo sorry, if others admins no how to remedy this please do so
I'll try to see if my browser cache has it.

cheers,
Alaa

aix_32
funny alla , it is okay
it is not the 3rd world war

peace

RedHat
It is intersting to see how a production systems can be treated. Linus when he said for the big companies to test 2.6 he means the following , as well as the big companies understand it this way:

Every big companies has labs, every big companies has R&D staff, every big company has a production-like servers with tools which simulate the actual load and actuall production applications.

By asking to test it, is to put it in the lab, not to run it on a production system. I have been testing 2.6 with big enterprise clients in this matter, and it never got to anyone mind that it has to be tested in production!

There is levels of comfort and acceptance and test matrix things has to go through before it can be said stable or ready for producion.

That what makes certain distros called stable, and big companies can trust to run the OS because 30 min might be in thousands or million of loss to the organization. Thats why QA is the most important thing and to keep balance about state of the art new cool feature and stable releases and WELL TESTED. You can not do that with Mandrake or Diabian or any cool systems, it will always be at the development level or box to play with rather than a server.

alaa
That what makes certain distros called stable, and big companies can trust to run the OS because 30 min might be in thousands or million of loss to the organization. Thats why QA is the most important thing and to keep balance about state of the art new cool feature and stable releases and WELL TESTED. You can not do that with Mandrake or Diabian or any cool systems, it will always be at the development level or box to play with rather than a server.

fortunatley the world does not consist entirly of big companies, these toy distros you're talking about (first time I hear someone call Debian a toy distro but then you're a redhat employee) are used as server in thousands of organization all over the world.
yeah most of them (probably all of them in the case of Mandrake) are small businesses and non for profits, but this doesn't make it a toy.

the Free Software/Open Source development model relies heavily on users testing new and even unstable software in real life situations, I don't know if your average mega-corp would do that or not and I don't care the fact remains that this is how the thing was developed and it is still being developed this way.

take a look at http://userlinux.com/white_paper.html not everyone is happy with the way things work at Enterprise Linux.

cheers,
Alaa

habdin
Salamo 3alaikom,

I guess that Redhat was only speaking out of data within his hands based on statistics already made. It is not a bad thing to do so. I think it is more scientific that way. The only objection to that is: Are those statistics really realistic and objective to give a figure about how many enterprises really use Redhat and how many enterprises use other Linux distros?

Salam.

RedHat
I am not saying that you should not test, my point which I was trying to make no one from the big organizations or whoever have a proper setup will use not stable version on a production server where money go through that server.

As for calling other distros toys, did not mean also the meaning of toys rather than: If you look at ppl here and other LUGs, you will find "I will try X distro" .. "X Distro is cool" ... etc. Me, when calling it toys was not ment to be in bad way because due to GPL and the nature of the Linux OS and how it is being developed, no Linux can do much about the OS, only the way it handels the OS, updates, features, support, services, ..etc.

As for the Enterprise users (Support, Services, Stability, ISV, IHV, long development cycles) are the most intangibles. You can not run a business and keep changing every 3 monthes or 6 monthes you distro, or upgrade. Usually big orgs do certify certain load which they use on the production. They archtiect a system to meet their needs. That takes time and effort which are money in their language.

In the Enterprise area, there are only two "real" distro which can compete in that area .. "Red Hat" and "SUSE". Red Hat is widely used and is the number one by all statistics. Red Hat do maintain a very long and good list of both ISV & IHV. Enterprise customers does not care about 12 CDs full of goods distro where they know there is no way that each package has been tested. You will not beleive if I tell you usually they cut the distro to 200 package in their load. What it does not have a business need it does not go to their load, so you will end up seeing one of the organization BOM stating software packages listed are trimed to 200 or so.

I am not sure if you heard the last news about new record which RHEL 3 on HP with Oracle had a new world record of handling 1million transaction ?

Let me name somethings which I see in my real every day work here:

- Sotrage specially SAN. What kind of performance you may get between other distros ? Do you have any idea how each of the distros performe , and why RH might be the fast and stable because of ported features and well tested features before it goes out ?
- HBA .. QLogic and Enulex cards. Do you know why Emulex decided to provide Open Source driver and RH will maintain and ship it ? Do you know how much effort has been put in QLogic so there is only one certified driver between EMC, HBA, and OS level .


There a very long list of why Red Hat is leading, and it is considered number one in the Linux market , and has big companies like most of the wall street financial orgs and banks, like big companies and governments, ...etc

There are big difference between Linux in business and Linux for home users, developers, hackers, LUGs, ... etc. Linux for Business is on a totally different needs.