THE USENIX MAGAZINE December 2003 • volume 28 • number 6 { inside: SECURITY Perrine: The End of crypt() Passwords . Please? Wysopal: Learning Security QA from the Vulnerability Researchers Damron: Identifiable Fingerprints in Network Applications Balas: Sebek: Covert Glass-Box Host Analysis Jacobsson & Menczer: Untraceable Email Cluster Bombs Mudge: Insider Threat Singer: Life Without Firewalls Focus Issue: Security Deraison & Gula: Nessus Guest Editor: Rik Farrow Forte: Coordinated Incident Response Procedures Russell: How Are We Going to Patch All These Boxes? Kenneally: Evidence Enhancing Technology BOOK REVIEWS AND HISTORY USENIX NEWS # CONFERENCE REPORTS 12th USENIX Security Symposium The Advanced Computing Systems Association conference reports Our thanks to Murray Kucherawy for his BSDCon ’03 areas covered 10 years ago, like gram- summaries mars and finite-state automata, are mys- SEPTEMBER 8–12, 2003 teries to younger programmers. A lot of SAN MATEO, CALIFORNIA senior developer productivity is lost Summaries by Murray Kucherawy explaining debuggers to the fresh crews coming into the market, which hurts KEYNOTE both the “bottom line” and our progress COMPUTING FALLACIES (OR, WHAT IS THE in general. WORLD COMING TO?) Michi Henning, ZeroC, Inc. While it is technically true that comput- Henning presented fourteen common ers are getting faster, software bloat and misperceptions of the technology indus- inefficiency is completely obscuring the try, and explored the fallacies of each. hardware advances offered by manufac- Those of us who have weathered the turers and their research. Do your storm of the dot-com collapse may be favorite Web pages really load any faster? nestled in the comfort of stable jobs, but There’s less of an emphasis on efficiency; according to Henning, the reality is that we no longer really care about bench- we’re far from where we need to be and, marks and actual performance compar- in some cases, possibly even going in the isons. wrong direction. How do we deal with all of this and get Many of these misperceptions involve back on track? Henning says we should the idea that computers in the workplace start acting in the interests of the people are easy to use and increase productivity. we really work for, i.e., consumers, and This overlooks some key considerations: not people obsessed with the “bottom Adding computers to the workplace also line.”It needs to be okay for developers establishes some infrastructure that has to do long-term work, with long-term to be maintained. GUIs were expected to funding, rather than fussing about how close the gap between using or manag- to achieve the current quarter’s projec- ing complex software and systems, but tions. There also needs to be a code of without truly good GUI designs – and ethics to quash the high levels of self- there are very few of those – the gap is interest currently dominating the indus- only changed, not truly reduced. try. Changing a single API can cost enormous amounts of time and money. Henning asserted that a great deal of Progress can only come from a lot more computing-related talent is wasted on cooperation and respect from everyone doing things just because they’re cool. involved — the market, the developers, This also applies to the latest and great- their managers, and our sales forces. est word processors and spreadsheet packages. There has been little true STICKY PROBLEMS advancement in the last decade, but new REASONING ABOUT SMP IN FREEBSD versions keep coming out, mainly to Jeffrey Hsu, FreeBSD Project please shareholders. Hsu discussed the logic behind lock Time-to-market pressures have also placement in the highly anticipated SMP reduced the average education of a soft- code for FreeBSD. SMP itself is exciting ware developer to far below what any not because it’s new, but because it’s seasoned administrator or developer becoming affordable, making a compari- would demand, with obvious detrimen- son of the innards of various implemen- tal effects. Remember how good you tations particularly interesting. were after just two years? Major subject 64 FreeBSD’s SMP locking is based on the ning. The kernel was never designed to have no concept of CPUs of non-uni- work done by the BSD/OS team. Only have “hot-plug” hardware. With the form capacity. EPORTS two of the low-level locking primitives advent of PCMCIA, USB, Firewire, hot- R Roberson presented a comparison of are needed in this implementation — plug PCI and other upcoming technolo- various existing scheduler algorithms, namely, mutexes and spin locks. This gies, you can have devices suddenly including the existing BSD, SVr4, and approach comes from the observation appear and want to do something. ONFERENCE Linux implementations, before going C that most locks in the SMP kernel actu- We don’t want to keep writing new dae- into the ULE implementation in detail. ally go uncontested, so complex locking mons for new technologies as they arrive methods are generally not needed. In The major components of the ULE (pccardd, usbd, apmd, etc.). Taking fact, it’s been observed that bus con- implementation include several queues, advantage of dynamic kernel loading tention will become an issue before any- two CPU load-balancing algorithms, concepts would be ideal, since it keeps thing complex really becomes necessary. scoring of interactive activity, a CPU the kernel size down. It’s a better use of developer time to con- usage estimator, and slice size and prior- centrate on subsystem lock code. The configuration for devd involves ity calculators. The load-balancing algo- defining event-action mappings that can rithms work together to keep the CPUs The approach used in SMP locking be triggered by, for example, device evenly loaded under a variety of load chiefly depends on what goes into the attach, device detach, and unknown conditions, even if the CPUs are of vary- subsystems involved. There are really device vents. It is possible to control a ing power. Since moving cached data only a few places where locks are truly device’s label even if the probe order regarding a specific thread from one necessary, and other operations should changes. Attach events can invoke con- CPU to another carries a cost, migration be skipped when considering a locking figuration actions such as triggering of threads between CPUs is taken into scheme. User-level race conditions, for dhclient executions, and it is also possi- consideration by these algorithms. Also, example, should really be dealt with out ble to guide configuration of devices threads scheduled for a non-idle CPU in user space. Locking single atomic based on location. Device drivers can be can be “stolen” by an idle CPU, and a reads, e.g., a read of four bytes, would loaded when the device arrives, rather periodic task evaluates the current load also be a waste of a lock. than having them built into the installed situation and evens it out. Reference counts are also used through- kernel. The configuration is similar to Graphs comparing the performance of out the FreeBSD SMP kernel. There is the format of modern named.conf files the four schedulers under various loads rarely a need for an atomic reference to define the event-actions. were presented and are available in the count increment/decrement primitive if Future work will include handling white paper. the basic mutex primitive is fast enough, power events, e.g., suspend and resume, especially given that most mutexes are ULE’s gains come mainly from the dock and undock. Link up/down events uncontested anyway. decoupling of interactivity, priority, and will also be able to trigger actions. Also slice size into individual parameters. Hsu closed by going over some of the planned is a control socket so that a Other schedulers leave these tightly cou- basic synchronization concepts that user-land application can monitor for pled, with varying side effects. The result should revive memories of threaded certain device events. of this is a system that appears to be programming courses from years past. much more interactive even when con- Obviously, such practices are especially ULE: A MODERN SCHEDULER FOR FREEBSD fronted with a lot of re-niced load: important in SMP as well, as it is proba- Jeff Roberson, FreeBSD Project “Livelock under nice load has been a bly a prime example of why those con- Jeff Roberson took on the task of writing constant problem for UNIX schedulers cepts are key. a new scheduler for SMP environments which ULE now avoids entirely.” after observing a lack of CPU affinity in DEVD – A DEVICE CONFIGURATION DAEMON the existing scheduler. “CPU affinity” RELEASE ENGINEERING M. Warner Losh, Timing Solutions, Inc. refers to a thread preferring the same Losh presented his work on devd, an CPU for later time slices to take advan- AN AUTOMATED BINARY SECURITY UPDATE event-driven device configuration dae- tage of large CPU caches. Supporting SYSTEM FOR FREEBSD mon package. The goal here is to over- this leads to enhanced support for Colin Percival, Computing Lab, Oxford come UNIX’s traditionally monolithic hyperthreading/SMT (symmetric multi- University approach to devices. Drivers are typi- threading) processors. Roberson also Percival’s package is intended to address cally compiled into the kernel or loaded observed that the common priority the ever-present problem of lazy system at boot time, but the device subsystems decay algorithms aren’t very fair in SMP administrators. Though Microsoft is never change while the system is run- environments, and current schedulers BSDCON ‘03 G 65 best known for system managers who published in the update index. Percival CPU should take into consideration don’t bother to apply security updates in says this is a limitation he can accept price, performance and software sup- a timely fashion (or, indeed, at all), the because such a case would only occur for port, but don’t forget to think about dis- open source community is not immune.