DebConf 14: QA with Linus Torvalds

I'm the opening act or possibly the floorshow I'm not quite sure which one we have the distinct privilege of having the Disturbed's with us it's a Q&A session I would like to put the emphasis on the queue so form an orderly queue if you'd like to ask something because I will not talk to you if you don't actually dkg over here is doing the actual question moderation and I suppose without further ado um welcome Dennis so apparently there are absolutely no questions that's fine we'll cut it short just louder interest how many of people are local here I just want to know okay so not too many because I did a QA a few months ago at the local Portland Linux UNIX users group so I was I was hoping there were new people here which the reverently is I don't do speeches I hate doing public speaking just so I don't know what you're interested in so that it is a QA or it's nothing I'll start with something non-controversial no no I'm fine with controversy that's not usually my problem it's well known around these parts that in 2007 you did an interview where you said that although you've used many Linux distributions you had never used Debian because you found it difficult to install yes have you tried it since uhm now that was quick so I'm sure it's gotten much easier to install a do to me a distribution is I'm sorry you may want to close your ears now the distribution is not very interesting I wanted to be easy to install so that I can just get on with my life right which is mostly the kernel the closest I got to installing Debian was there was one machine I forget which one it was it may have been the MacBook Air that actually had trouble installing something and and Debian the Installer would boot but then it didn't install there either and eventually I figured out what was the problem with that machine but but by then it was too late I had tried Ubuntu and that God next really fast because they made it really hard for me to install my own kernel and when make install doesn't work for me I'm like whatever I'll do something else then right so somebody should check that you can just do make install and you don't have to build a package and install a package right because if I have to install a package at that point the distribution gets in my way and at that point I'm saying okay I'll do something else instead okay if there's a way to break installing an operating system I've found it multiple times and if there isn't one you already know of I found it and Debian last time super easy highly recommended trying maybe maybe I should try I mean one of the problems I have is I am NOT an Mis person I mean I may do kernels and people think that that means that I'm technical but when it comes to actually maintaining machines I am a complete disaster right and I changed my own machines regularly so changing the system I run on my machine would be easy right I end up a crate of grading machines a couple of times a year usually but I end up having also to maintain my family's machines and that ends up being the one that I don't upgrade my family's machines very often and I don't want to run multiple multiple different distributions across different machines because I suck at I am is so so it ends up being for me a distribution is something very sticky once I started with one thing I have a really hard time just doing something else because that means I have to switch over all my kids machines my wife's machine and and and that's just painful so that's why okay so this is a little difficult I I guess we're all at least for me I'm kind of wondering very much like I think you are lately how to get to the year of the Linux desktop if you will right all right and we don't like it to be the year of the Debian desktop if possible and I'm trying to figure out if anything if you have any insight is to possibly how to get closer or towards that if so I mean there's a lot of things that are getting closer to that and I think I mean I people technical people don't I'm to use Chromebooks but I think that Chromebooks are the kind of thing that will make the year of the desktop more possible right because once people get used to running their applications basically as a browser that makes a lot of things much easier that said let me go on my first rant of the evening right one of the problems desktop has I mean ignoring all the purely market and getting free installs and making it just so that normal people and by normal people I mean obviously non-technical people will just buy a machine and it just works one of the things that none of the deaths and the distributions have ever gone right is application packaging right and now somebody will say hey D package is way improved and much better than rpm and that's not at all what I'm talking about I'm talking about actual application writers that want to make a package of their application for Linux and I've seen this firsthand with the other project I've been involved with which is my dive log application right we make binaries for Windows and OS X we basically don't make binaries for Linux why because making binaries for Linux desktop applications is a major pain in the ass right you don't make binaries for Linux you make binaries for Fedora 19 for Oh 20 maybe there's even like rl5 from ten years ago you make binaries for Debian still actually you don't make banners for Debian stable because phibian stable has libraries that are so old that anything that was built in the last century doesn't work right but you might make binaries available for Debian whatever the code name is for for unstable and and even that is a major pain because Christ we had this small local flame that's just a couple of days ago Damien has these rules that you're supposed to use shared libraries right and if you don't use shared libraries getting your package in like is just painful but using shared libraries is not an option when the libraries are experimental and the libraries are used by two people and one of them is crazy so every other day some ABI breaks right so you actually want to just compile one binary and have it work preferably forever and preferably across all the Linux distributions and I actually think distributions had done horribly horribly bad job one of the things that I do in the kernel and I have a fight this every single release and I think it's sad we have one rule in the kernel there is one rule we don't break user space everything else is kind of a guideline the whole security thing it's a guideline that we shouldn't do stupid right but that's not a hard rule people do stupid all the time I don't get that upset people break user space I get really really angry I mean I this is something that is religious for me you do not break user space and even in the kernel I every single release I have people saying ok I'm changing this API because it's cleaning stuff up and I'm like no you're not changing that API because I will crush you right and actually it's often okay to change ABI as long as nobody notices but immediately when somebody notices it's a bad thing and this is like a big deal for the kernel and I spend a lot of effort explaining to all the developers that this is a really really important thing and then all the distributions come in and they screw it all up because they break binary compatibility left and right they update glibc and everything breaks you a you can recompile everything right that really seems to be this mindset right often it's like the G loop see people say it was a bug look here's the standard it says you can't rely on that nobody cares if it's a bug that people rely on it's not a bug it's a feature right and I won't even get into all the other libraries but it's really sad when the most core library in the whole system is okay with breaking stuff and as long as things improve and they fix the API so that's my rant and that's what I really fundamentally think needs to change for Linux to work on the desktop because you can't have application writers do 15 billion different versions and I'm on record as saying that maybe valve will actually save the Linux desktop and it's actually not because I think games are important I don't care I don't play games I think some people do is against may be important but the really important issue is I guarantee you valve will not make 15 different binaries and I also guarantee you that every single desktop distribution will care about Valve binaries so the problem is valve will build everything statically linked and create huge binaries and that's kind of sad but it's what you have to do right now sorry about the rant this isn't a question for Venus I just wanted to this should have actually been something that was related to the audience at the beginning of the talk and I'm terribly sorry that I didn't do this it's my fault due to the nature of this session there may be course language involved you are sensitive to course language I invite you to step out with me and we can discuss it thank you I'm I'm sorry I didn't read the guidelines I guess I should they sent me the guidelines so you can't really blame the organizers it's my fault what version of GCC do you think we should ship in the next version of Debian well we fixed the particular problem we had with the particular version of GCC you already shipped so you're fine you're off the hook there's still some discuss all the discussion seems to mostly died down that the way the kernel fix the GCC bug and realistically almost nobody else is going to be impacted by that bug because you need to have inline assembly and and very few projects do that the way we did it in the kernel was kind of a big hammer approach and some people were a bit upset about that but it does mean that any version of GCC that is more recent than let's say 4.2 is probably fine I have an incredibly boring technical question I recently saw that there was another patch for proposal of we revoke getting implemented so have you had to look at this yet I haven't had time to look at the patch I looked at some of the very core infrastructure for it the whole counting thing that it used and it's probably going to happen one thing that I was happy about was that one of the comments was that this might end up being generic enough that we can use the same thing that we basically use for Sisyphus which kind of has the same issue anyway I mean we have a lot of our own internal things that can be revoked already it's just that it's not exposed generically for any file descriptor it's going to be painful I mean it's there's no question about that and and at the same time people have been asking about revoke for a long long time so it's going to get done I just I'm not going to say it's next version I'm it's probably going to be some discussion before it goes in hi I'm sorry to ask this question almost but it's something that I think is a little bit important how do you think it affects the culture of a community of a project when the leader is on that projects public mailing list telling people in response to patch reviews that they should be retro actively aborted and maybe that you're surprised that they're still alive because they should have starved to death when they were children because they were too stupid to find a to suck on I I agree that some people might be put off by that but on the other hand you know what I in the end I don't care right I care about technology and I've actually seen projects that took the whole political correctness so far that the project no longer is about the technology I actually so Who am I Wow we're getting more questions I think at some point we might want to moderate them so my tape I'm a Duncan I actually am very happy to talk about this it's not a problem for me my standpoint has always been that hey people are different I'm abrasive I grew up in a culture that I think is not quite as politically correct as the culture especially in the u.s. today I also grew up in a family that was largely dysfunctional so I mean so people are different and some people take offense and some people give offense and we all have to live together but the living together is not by finding some lowest common denominator the living together and it has actually been fairly successful is to try realize that hey unlike your family you can actually pick your friends and you can pick the co-workers an open source is actually really good at that better so than many commercial software projects because in a commercial setting you're kind of stuck with your boss in open source find people you like find people you like working with I I work directly with let's say 20 people closely and 50 people more or less right there's every release there's a thousand people involved find somebody you like better than AMI then that's fine right I'm not willing to be less honest because I know I'm abrasive right and quite often the whole like when I say something like I wonder how he grew to be an adult when he's so stupid that he I don't expect him to find food some people might realize that it's kind of hyperbole and joked not I'm not I'm not saying something bad that you know it's not politically correct or whatever although certainly I would understand if people do say this it's more about treating other people with respect and maybe saying technical you know what are you gonna float everything you want but I don't respect people on this that you think they deserve the respect there are people who think that respect is something that should be given and I happen to be one of the people who am perfectly happy saying no respect should be earned and without being earned you don't get it right it's really that simple and I am not everybody agrees and that's fine too right there are people I refuse to work with right it's it cuts both ways and and I realized that right okay thank you good evening so systemd Wow it exposure it uses a technology exposed by the kernel in the linux kernel that is not you know exposed by other kernels it's a user space thing are you happy about systemd using linux only technology do you not care since it's user space and a follow up what's your opinion about pit one Wow I don't think paid one as that is special right and I actually think system D does a lot of things right the problem I've had with system D has been there are a few I mean literally before system D really got started this must be one of the kernels summits and I'd like to say five years ago but that's the number completely made-up right Lenart was giving a talk about you you IDs to the kernel people at the kernel summit and we laughed him out of the room right you you IDs are crazy there there up there with xmls bad ideas right and and exposing them as something really cool and clever was I felt just stupid and I wasn't the only one at the same time there's no question that the UNIX init system is not wonderful right and it wasn't being very actively maintained assistant Lee gives a lot of features that it that you really couldn't get any other way the boot up speed ups are real right and it's not saying that you couldn't get the same things with non system D but system D stepped up and hit it right so I think the fight mostly is over the lack of portability is that the the thing that I absolutely hate is that the bug reports have been basically ignored in some cases and and I don't like that but is there really much discussion left i maybe i mean i I thought Debian already basically decided to go with system B but apparently I mean I I may have heard just one side of the story right I realize people expected me to hate system D I don't hate it really I mean it's I think it's somewhat interesting and it has quirks but what does not right okay thank you so you mentioned desktops and distros as being something that more or less you wanted to not get in your way or make your life more difficult or add overhead things like make install for example what are the top couple of ways that a distribution like Debian could make your life personally or professionally easier actually be a positive influence above just having Linux and a bunch of software my personal linux use is actually beautiful it is I've shown what my desktop looks like and the universal response is that's it right I have a web browser and three terminal windows open and that's pretty much it I have no need for a distro to do anything fancy on for my own case like I I use make GCC bash and external or G term or anything I don't even care which terminal right the thing that would make my life easier and that I've sometimes heard like ranting about is it sometimes annoy a mean my family runs Linux obviously they running Linux for a long time I have no trouble of Linux but I was ranting not that long ago about how setting the time zone or connecting to a new wireless printer was unnecessarily hard and required privileges that my kids should not need to have even though clearly when they go to school they need to be able to connect to the school printer and the solution is not that I as a system administrator go to the school and install that printer right the solution was at that point to just say okay kids you can be admins and whatever here here's the root password in the case of one of them and the other ones I just made admins so that they've wrote they wrote their own password but that was that was to me annoyance and it was an unnecessary annoyance right where and that's so I would like distributions to really concentrate on making it easy for normal people because that way I don't have to maintain the machines so much thanks by the way I would like to point out that both of my complaints actually did get fixed at least times on thing on the district I do use you can now set whatever time son you want and it never complaints of course it crashes if you set the time zone to be the automatic Network time and the network goes away but that's that's not a distro bag that was a gone buck hi you may remember a few years ago an event in Cambridge you probably don't we gave you a Debian t-shirt I hope you appreciated it and it's it's inappropriate use probably having a question what happens cash you mind a few years forward now one of your kids comes to you and says daddy I want to be a kernel hacker what are you going to say to them I'm going to say hallelujah because it's not gonna happen I have never pushed my I mean I want my kids to get an education and my wife claims I push them but I have never pushed them into computer science and and I kind of hope because I think it's a great education I think it's a great way to get a job I think it's just a wonderful area to be and so I'd hope that they decide to look at it but so far there is absolutely zero interest in I don't I don't see it happening so yeah I'd love for them to be kernel developers but I may have to adopt hi I'm in discussion to further the conversation about subsurface I have a half trawl half serious question which is have you considered circumventing distributions entirely and distributing subsurface as something that runs inside a Linux container using LXE or docker or supplies I haven't and I have to admit that I'm not even the maintainer subsurface anymore I started the project and like most smart people I just pushed it off to somebody else who was willing to take it it has been talked about it's not something subsurface will do on its own but there are projects that apparently have realized that this is a problem and and there's being noises about making the whole docker container work as a way to install application packages sanely securely and in an environment that is is limited at where maybe not limited is the right word but in a standardized environment so that you can do things like upgrade your system and not break your your your applications so I'm actually hopeful that there are people who are looking at this subsurface is a small project with basically a handful of developers which is actually true of most of them I mean look I mean you probably know you probably all of you work on small projects with a handful of developers it means that you those kinds of products don't really have the resources to say hey we will push through this thing that makes our binary work across all these myriad Linux distributions but is anybody working on something like that here one hand now two hands so someday yes this isn't really a question and I'm sorry to have to say this but you know I like working with people that can express technical disagreement in you know a reasonable and an often Pleasant way and without resorting to playground insults and it's really disappointing to me that you don't think that's important that's fine I can deal one of the things I have noticed this doing this for a long time thick-skinned is a good thing to have and I think it also means that the criticism ends up not working so well just because I'm used it in so many other areas so sparse was sort of born out of you know GCC is too painful to hack on and get was born out of well bitkeeper went away and I'm not putting up with any other version control system so I'm going to go right one have you considered going off in solving the application binary distribution problem how what would it take to get you sufficiently annoyed with that problem to dolphin solve it and you know write something in a week that becomes the new standard you know I am kid was actually a really simple problem it was just that everybody looking at it we're not I mean there was something with version control people they they they had their mind warped by years of CVS and get is actually a really simple problem to solve and and that's why it took two weeks to get a first running version spars took longer but at the same time writing a see front end is still a fairly simple and self-contained thing the C preprocessor is interesting but solving the whole binary issue is really hard and I mean part of the problem is you can solve it by just linking everything statically and giving your own file system with the thing too but you really have to do that right now right you because you have can't rely on the libraries that the system gives you and you can't rely on all the paths that those libraries depend on we literally have that issue I mean and this is not Linux specific this is when you do Windows or OS X binaries you will notice that packaging applications is hard because different systems have different fonts they have different paths to icons and things like that and basically to be really a complete package you have to include all of those resources - I'd love to say that I'll solve that but I think it's very unlikely since most of the projects I being involved with have been solving my own personal problem and for sub-surface my solution right now is I will recompile I know it's the wrong solution but it works for me and sadly it works for almost everybody here it doesn't tend to work very well for maintained errs of packages because they can't necessarily ask all their users to recompile but I don't maintain sub-surface well other than compile runs install and compile it once install it and run it anywhere what are your requirements for such a system is that the one and only requirement or is there more to it than that it's so one of the like for example people have suggested that what we do by using QT and before we used qt we are cute like the QT people say we use gtk I had people tell me that you guys are crazy you should do that use the Java class libraries and it will look ugly but it will be easy to get to run most places right one of the problems is applications can't do that because they end up requiring like in the case of subsurface we require these odd interfaces to USB direct interfaces to USB devices or serial ports or stuff like that and anybody who tells me that serial ports work under Java has obviously been I don't know they've been eating the wrong kind of mushroom I we I tried some Java dialogues and the problem was no serial ports do not work with Java so the requirements are actually you want everything you want actual hardware access because not everything wants hardware access but a lot of programs do want to talk over Bluetooth to something or of a serial line to something else and so you actually want you don't want the kind of Linux standard base thing which is a minimal install that says ok for this simple application and databases tend to be simple in that sense right this is all you need to rely on now I mean for user facing applications you want all these graphical libraries with OpenGL with everything and I mean this is part of why I'm hopeful about valve because they want obviously the graphical part but in games you actually want the hardware parts to you want to have access to your own controller and things like that so my questions my question is about git first of all thank you forget it's a great tool really seriously whenever ever people thank me forget you should thank junior Amano and that he's I mean I mean he's been maintaining it for now eight eight years and overnight he really took it where it needed to go and so that's actually leading into exactly my question so I was going to say that just over nine years ago you handed over maintainer to him and I was wondering you know what your thoughts were on where it has gone in that time so for example you know the starting with a less obvious one that's relevant in the Debian community of get NX which Joey has made it would sort of a Dropbox sort of synchronization type of thing on the more obvious ones of github and actually that's a mixture of you know an interesting monoculture of you know often its own world but also really popularizing get and open source Drive by contributions making a low barrier to entry and everyone from companies to you know you know two teenagers are are using it and doing really cool things so what's your thought on how things have gone since you hand it over so I mean I I have to say it has been a huge success story and by now if you're a developer I mean you tend to be using it I mean and the interesting part is it's true not just it's definitely not just the Linux kernel but it's outside Linux - its Windows its Mac everybody's using it and it's interesting just because looking back people used to complain so loudly about all the horrible user interface issues and some of them were horrible user interface issues don't get me wrong I mean there were warts there at the same time some of those warts were not actually warts they were they were the design and people had complained endlessly about it and five years went past and people stopped complaining and started realizing that hey this whole renamed thing actually works so much better than it worked in any other SCM or or the whole okay get blame is kind of slow and odd but wow it actually follows the code to other files and things like that it's been interesting seeing how it's not just that people have started using it it's that people have started realizing the whole point of distributed and and the get model of distributed systems I think github has been hugely important the the fact that you have an easy way to do hosting is just enormous ly important for an SCM and and get made it easy right get made it technically fairly easy to do that kind of hosting in a way that pretty much any centralized system did not do but it's still kudos to to github who has been as a company one of the driving forces making it popular and very much I'd like to say I mean junior it's interesting one of the things I personally consider most important when it comes to technical people is this notion of taste and the reason I gave get off to juniors it took me not even months it took me like weeks to realize okay this guy has taste and and I shown it ever since so I mean it's I designed the kind of basics and and the rules for how good would work but all the actual work has been Junio and a lot of other people obviously - but jr. has been a very central force thank you I would like to go back to your original earlier statement about breaking years of speech and I want to make sure that one of the feelings I have agree with that in my role as a driver developer I also review other people's drivers in our group and one of the frustrations I have and bear with me if I try to articulate it is that I see changes being made in the data structure that is passed between years of space and the driver in the IATA calls which would break the I also call that's one thing also I see data types used in the data structure for the IATA that are not consistent between 32 bit and 66 t4 but one of them comes to mind is something called DMA underbar adder underbar tea and I get annoyed when I see that being used in the data structure your Newseum I also is that is that reasonable at all for me - it's absolutely reasonable I octaves have been a huge mess of there are sub areas in the kernel that have been burned so many times that they basically cleaned up their act so the GPU layer comes to mind for being a very heavy user of I octal and they got burned exactly but it's not even a type like 64-bit which you would think how different can a 64-bit type be it turns out Wow on to bid it maybe 32-bit aligned and on 64-bit maybe 64-bit aligned so depending on where in the structure it is the layout of the struct is different and that's a huge pain and part of it is intrinsic to iocked all's iocked roles are designed to be things that kind of bypass all the normal rules and it's very annoying they've they've been problematic for everything like the compact layer has a huge amount of code to deal with just the I optional mess so part of it is kind of by design part of it is driver right and I really can't blame them rut driver of writers don't have the background and should need to have the background to really realize all of these kinds of problems and and it's so easy to get wrong so in particular in drivers it is it is a very common mistake and it's sad when it happens and I hate it when it happens but I also understand why it happens yes firstly I'd like to thank you for your focus on backward api compatibility because that's really useful and by and large you've done an awesome job at it so thank you very much now you talked about user space compatibility now I'm from a debian background so I've not used the distros that you've used so maybe you're going to have a different experience also I have a tendency to you know I don't much like desktop environments and things so I tend to be quite low layers of the stack but my experience have used the space backward compatibility is quite good as well I just had a look in the user local of my Colo which was installed several decades ago and the oldest binary there that I could still run was from April 1995 there were a couple of slightly older binaries and I could have run those I had the Lib C I'm pretty sure they would have worked but Mike doesn't have a dot our executable support anymore yeah you and that if you can still cartilage that I use isn't your fault that my kernel which is the Debian destroyed kernel doesn't have that in it's just you know even if you compile again I will not guarantee that it works but that said we did and I was very proud of the fact that at some point I think it was Alan Cox who took the original binaries that I made available for like on the floppy boot disks in 1991 and and tried to run them and they still ran the problem is saying that yes our backwards compatibility goes back almost 20 years is patting ourselves on the back but the fact is all the real compatibility issues aren't the old binaries all the real compatibility issues tend to be modern binaries because they do way more complicated things and and the combat issues tend to be things like when you upgrade a library the application stops working I I'm pretty sure everybody here has seen that right and sometimes it's a library bug you've never seen that Wow you know I don't deal with gnome right I don't know what I do you know I am I stuff that stuff is off my radar but I've not had like executables break because I up I'm getting lower lash code tends to be easier it tends to be UI code partly because the the libraries are way more complicated partly also because UI code tends to be much bigger so bugs happen more one thing that annoyed me personally enormous ly this was a couple of years ago back when people still used flash and Adobe used to make flash player available and flash player used men coffee - coffee overlapping memory in the audio layer of flash player and this is everybody knows that's wrong you're not supposed to do that you're supposed to use men move right it just happened to work because it was coughing from a lower address than enough for one or something so that it no from a upper one to lower it was compacting memory and an a forward moving mmm coffee happened to work right by pure luck and then he leaves he fixed that pure luck and broke a binary that I could not recompile and when I can't watch kittens on YouTube I got upset right it's I have to see that right so I said I appreciate your pain there I would actually agree with you on that point and I think they should have used symbol versioning to to give you a backward-compatible slower version of member you know they could have just made the old them cook I think it ended up happening after many many flames but I'm not I'm not sure these days I don't have to care to about that anymore but it's the kind of example that we actually have a lot in the kernel where we fix something that clearly was a bug and when we fix it we break something else and I hope I wasn't the unintentionally funny one here but but it turns out people sometimes rely on bugs and some of our bugs have been outrageously stupid right and then people say hey this commit which was clearly a bug fix broke my application and it is really frustrating and sometimes we just say okay we'll undo it sometimes the problems of being that one of our problems in the kernel ends up being that people often test kernels especially in like big commercial environments they tend to be like two years behind so some of these things literally the breakage doesn't happen when we break things it happens two years after we broke something and we get a report that hey three point four point fifteen broke my application and and it can be really hard to find but we try our best and I do not guarantee that we don't ever break user space we do break user space sometimes we have to because it's it turns out sometimes the interfaces were so buggy that they were glaring security holes without the fix and sometimes it's like okay two years have passed we don't even know what broke I'm sorry you need to really dig into this if you need to get it fixed and a lot of people at that point say Oh screw that so so we break things and I'd love to say we never do but we do do you agree that you undermine GPL version three and how can I get you to stop what how can we get you to stop oh I hate GPL version three I underlined it on purpose I actually thought the GPL version three extensions were horrible I understand why people would want to do them but I I think it should have been a completely nude license my argument for liking version two and I still think version two is a great license was that I give you source code you give me your changes back we're even right that's that's my take on GPL version two right it's that simple and version three extended that in ways that I personally am really uncomfortable with namely I give you source code that means that if you use that source code you can't use it on your device unless you follow my rules and to me that's that's a violation of everything version two stood for and I understand why the FSF did it because I know what the FSF wants but to me it's not the same license at all so I was I was very upset and made it very clear and this is months before version three was actually published there was discussion about this long before there was an earlier version of version 3 years before actually where I said no this is not going to fly and during that earlier discussion I had already added to the kernel but hey I don't have the version two or later and there was no and I was really happy then when version three came out that I had done that something like five years before because there was ever never any question about what the license for the kernel was but I actually thought that version threes now I actually think version three is a fine license right I'm a firm believer in if you write your code it is your choice to pick a license and version three is a flying licensed version three was not a good here we give you version two and then we try to sneak in these new rules and try to force everybody to upgrade that was the part I disliked and the FSF did some really sneaky stuff downright immoral in my opinion you're talking about t-bo's asian yeah the TV station was always my main dislike of version 3 and the FSF was being very dishonest thing Hey we actually allow you to invalidate the TiVo ization plus and and they try to they literally lied to people and said hey so that means that you can use GPL version 3 without the TiVo ization part right this is how many people heard this particular statement from the FSF okay maybe they only try to convince me with that one but they did right and it was like I'm not stupid right yes you can you the GPL version 3 allows you to say ok TiVo zation is not an issue for us but it allows somebody else to take the project and say hey I the GPL version 3 without civilization is compatible with the full GPL version 3 so I will now make my own fork of this and I will start doing drivers that use the full version of version 3 and we're am I stuck then I'm stuck saying hey I gave you the source code and now I can't take it back your changes that's completely against the whole point of the license in the first place so the FSF was I mean this the kind of stuff that was going on behind the scenes made me once and for all to decide to never have anything to do with the FSF again so if you want to give money to an organization that does good give it to the e FF the FSF is full of crazy bigoted people that's just my opinion right and will actually live i overstated that a bit right the FSF has a lot of nice people in it but some of them are a bit too extreme well I wish the e FF cared more about software freedom but so do you think that Tebow's asian benefits me as a user somehow no no I don't I mean that but that was never my argument that was not why I select the GPL version - this isn't my whole point it's not that I think civilization is necessarily something that you should strive for but it is something that in my worldview it's your decision if you make hardware that locks down the suffer that's your decision as a Hardware maker let us know impact on my decision as a software maker to give you the software do you see whatever I'm coming from I don't like lock down hardware but at the same time that was never the social contract I intended with Linux to me I mean people may or may not realize GPL version 2 wasn't even the first license for Linux to me the important part was always I give you software you can do whatever you want with it if you make improvements you have to give them back that was the first version of license it also had a completely broken clause which was completely insane and I was stupid hey it happens my original license says you can't make money change hands and I was a mistake right that was clearly just wrong and bad because it really didn't have anything to do with what I wanted but I was young I was poor I didn't realize that the whole money thing wasn't the important part and I saw the error of my ways and I saw the GPL version too and said hey that's the perfect license and then I saw the GPL version 3 and I said no that's overreaching a lot that's not what I wanted and so I made Linux GPL version 2 only right you think getting the pastor's back is useful even if you can't modify the device that it's used on yeah saluting and I mean TiVo itself was actually an example of this their patches were kind of crafty but I mean they were basically running on a originally a fairly standard MIPS thing and their passions were working around bugs in the chipsets they used and they were valid patches the fact that they then felt that their hardware had to be locked down some way I didn't like it but as I mentioned I felt that that was their decision and they had real reasons for that that's something people sometimes miss there are sometimes reasons to do what TiVo did sometimes it's imposed on you by wireless carriers sometimes it's supposed to you on you by Disney sometimes it's imposed on you by laws the GPL version 3 actually accepts the last one when it comes to things like medical equipment I think but the point is that that the whole civilization thing sometimes it's there's a reason for it and if you make I mean I'm not a hardware designer I think FPGA is and stuff like that is really cool but I uh I mean I really don't want to impose my worldview on anybody else you don't have to use lens if you do use Linux the only thing I ask for is source code back right and then there's all the other verbiage in the GPL version too about exact details and those aren't important and that was always my standpoint okay well stop monopolizing the mic now I mean don't get I mean I like other licenses too I have used like the four which which BSD licenses that's the acceptable one one of the BSD licenses is actually really nice and it's actually the what is C and and I actually encourage people who don't care about the giving code back but care about the hey I did something cool please use it I encourage people to use the BSD license for that and and I mean the BSD license is wonderful for that it so happens that I thought that from my project that giving back was equally important so I for me BSD is bad but the point is for me right the GPL version 3 may be the perfect license for what you guys want to do and that's fine and then it's the license you should use it's just that when somebody else wrote the code you don't get a choice right I would like I would like to come back to the topic of getting application running every round every distribution and compare it to the out of three modules in the corner where the rule is to get your module in the in the conversion the kernel who we'd ask may be the same for the application to get them version 2 distributions I think that's what actually happens quite often I mean that's this is what most of you actually I don't know what most of you are doing I'm assuming most of you maintain one or more packages am i completely wrong right now ok so most of you your work is literally to bring in the applications into the system and I think that's actually the right solution for all the base applications do not get me wrong I do not think that's something like like 90% of the core stuff that is open source should just be in the distribution but then there's the crazy stuff right there's something like some surface is open source but let's face it we have maybe a thousand users worldwide out of which maybe a couple of hundred are running Linux out of which maybe 10 are running on debía I don't know the the we do have some numbers so those numbers are not completely made up but my point is if you have 10 users on Debian and you have 10 users on fedora and I know we have a couple of users on actually we have a couple of users on arch and most of the Linux users seem to be on a bun too which actually kind of makes sense right because divers are not necessarily computer technical people so an Ubuntu has been selling to that kind of crowd so if you have that kind of situation does it make sense to have people inside every distribution package that application for that distribution and do so in a really timely manner when we're making major changes that is really important to users because without those changes their dive computer does not work right no it does not make any sense at all so even for open source projects bringing that project into a project like Debian is just waste of manpower you guys have better things to do trust me you really do some surfaces of fun applications but nobody should waste their life mein - oh maybe the maintainer is actually here but the point is I I'm grateful we actually do have a debian maintainer I am did I screw that up now but it's this is an example of something where it would make more sense for us like for windows we have nightly builds and by we I don't need me because I haven't touched the Windows machine in a long time but Dirk Handel who's the real maintainer builds basically nightly and it's really convenient because these users that have problems with a particular model of die computer he can make a Windows binary and say hey install that package and see if it fixes your problem this is what you want for real users right from links we can't do that the Debian package is out of date it's not a nightly build there's no way to create them and I could build the only thing you can tell these kind of people is hey take the git tree and compile it and see if it's works or not and that works if your people like us but if you're a diver who's in Hawaii and has trouble with his dive computer and is running Ubuntu or Debian it's not really a very good solution right so even for open source I don't think maintainer or distros should maintain everything you should do the core and the core is still going to be thousands of packages right there's no question about that and then we have all the commercial software and Debian is probably mostly people who really don't care I don't know maybe I'm just projecting here what is Debian's feeling about like commercial databases and stuff like that I don't know yeah so so I'm probably talking to the wrong cloud but some other distributions definitely have the whole thing with no hey valve is actually using Debian isn't they started off using Ubuntu but now they're using Debian right so even Debian should be aware of these kinds of commercial packages and for them they have to give a package and right now they have to pick not just a distro but a version of the district so I think I think we have time for two more questions how convenient you're really timely I guess we're running badly low on the number of brands so I have to ask sorry behind not being able to watch kittens on TV and GPL sorry and and video and breaking user space what is you think is this thing that is most wrong with the world most wrong with the world you know I mean I'm famous for being a negative Nelly and just shouting at people and being an ass in public and just using 20% curse words in any random email the fact is most the time I'm actually very happy it's just that when I'm happy I'm quiet right so I'm not really all that down on things it's just that my you see me in public it's usually because something went wrong right so world does go deverson is okay with it the world is actually mostly good I mean and Linux is doing great and I really have no real complaints but then I get up on the wrong side of the bed and I want to bite somebody's head off and and somebody sends me a patch that breaks something and I get really upset actually yeah I mean part of it is I actually I enjoy arguments I like people still quote the argument I had with Andrew Tannenbaum 23 years ago because I was this young stupid University student and what do I do I start arguing with the professor who made the operating system that I was using right so I'm argumentative I get negative but on the whole I mean things are so good not watching not being able to watch get on sexually top set what not being able to watch kittens on YouTube actually tops your list even I can watch kids these days because I stopped having to care about Flash because it turns out chrome has flash built-in and they actually maintain its I don't have to worry anymore and even like I'm famous for my in media rant even in video what the hell happened they they have been active maintained errs in their areas it's like the world turned all pink and roses your aunt happened I I'd like to say that maybe was helpful it certainly raised the profile of the problem so hey maybe sometimes cursing is good right but I've I actually think the rant raise the issue but realistically Nvidia also noticed that Android is so important to them and Linux has actually become major player 2 then now that they are working on the mobile space so they started realizing hey maybe we should play together and that's the that's the much more important part where and that's the one that has brought so many companies around so thank you so I just wanted to ask a question about security get your ideas on that are you familiar with capsicum and the per process I've heard the name I have to admit that I do not know the details so it's per process so you can fork a process and then limit the the privileges yeah so but I beat curious about your thoughts on SELinux or app armor or any of the other half so I the thing is that I dislike black and white people and a lot of the security people are very black and white and the only thing they care about is security this has often resulted in me butting heads with security people at the same time I mean security is important there's no question about that we've had problems with security code that does horribly horribly bad things because the people who've wrote it thought security was the only thing that mattered and we've had huge performance issues for example and I used to run without SELinux because when I did fall snow optimizations having selinux enabled was completely pointless because at that point any optimization I did was worth nothing right because selinux would just take up all available time checking credentials right at some point I realized hey everybody else is actually running with selinux on so I started turning NC Linux on and seeing where the problems were and most of them are reasonably easily fixable so I see links is still quite noticeable under certain loads but it's much better than it used to be and I'm not taking credit for all of that I am taking credit for some of it and pushing some of the involve people into looking more at perform as angles because performance matters even when security matters one of the biggest problems I've had with sa links or not so much with SELinux but security in general is is people constantly tend to ask me to mark security bugs in commit logs and it's one of those things where I push back very much because some of the first people who read the commit logs are the black hats and marking something as a security bug tends to just help that class of people so I'm very nervous about doing that on a per commit basis because once you see hey this one-liner fixes a security bug it's not that hard to figure out what the security bug is right so I consciously do something that some security people absolutely hate and they think I'm a weenie and they make that very clear by kind of not making a big deal of it the other reason I don't make a big deal out is that most bugs can are not most but a lot of bugs can be security bugs and you don't even realize there was a great write-up of the project zero bug how many read it it was like last week where there was an overflow in G Lib C of a single byte on the stack and the overflow was only a zero byte so it was it was an off by one error on a bounced check with a string wow those never happened right and and basically the argument was this is not a security bug because there's no way to take advantage of it and then it took people a couple of weeks and it's a really interesting read of how you turn that zero bite bug into an actual root hole and it's interesting not because it proves any particular point except the fact that you can turn pretty much any bug into a security bug and this again flies in the face of saying marking patches the security fixes because hey anything can be a security fix so I I'm at odds with some of the security people at the same time it has been interesting working with them I knew some of the smartest people and most I mean emails that made me go wow this guy is just out of this world smart have actually been from the people who have have been on the wrong side of the security debate some of that has been really eye-popping so I kind of sometimes end up respecting the black hats more than the white hats which is kind of sad but because from a technical angle sometimes they seem to be more on top of it but I think we're doing a reasonably good of a job and I say reasonably good because I don't think this is something you can solve right we do this as well as we can on security and we have multiple layers of SC Linux or a farmer or anything like that is just one of the layers we need to be aware of and most of the layers aren't even in the kernel I mean there are all the user land layers that need to also work so that maybe didn't actually answer the original question but the question was kind of open-ended thanks very much

Channel: Adnan Hodzic

Views: 428,563

Rating: 4.9076538 out of 5

Keywords: Linus Torvalds (Author), linus, torvalds, linux, QA, question, answers, debconf, debconf14, portland, debian, linus debian, linus debconf, linux debian, debian linus, debian linus torvalds

Id: 5PmHRSeA2c8

Length: 71min 43sec (4303 seconds)

Published: Sun Aug 31 2014

Reddit Comments

[u/gaggra]

I feel that what comes before is what is really important. A simple breakdown of the horrorshow that is Linux packaging, from well-respected central figure that can't be casually dismissed as an outsider who "doesn't get it":

"...making binaries for Linux desktop applications is a major fucking pain in the ass. You don't make binaries for Linux, you make binaries for Fedora 19, Fedora 20, maybe even RHEL5 from 10 years ago. You make binaries for Debian Stable...well actually no, you don't make binaries for Debian Stable because Debian Stable has libraries that are so old that anything built in the last century doesn't work."

"...and this ["Don't Break Userspace!"] is like, a big deal for the kernel, and I put a lot of effort into explaining to all the developers that this is a really important thing, and then all the distributions come in, and they screw it all up. Because they break binary compatibility left and right."

[u/[deleted]]

Once he gets irritated enough, he'll start his own reference distro and package manager, all written in C

[u/X1Z2]

Seeing that I cant help but wonder why the Linux foundation only restricts itself to the Kernel and not create an "official" package manager and interface. I know now that all of these current choices/varieties are actually hurting Linux in a big way. Maybe "less is more" is very true in this case.

[u/stratosmacker]

You know, while not perfect, the irony in my life is that since using Arch Linux this has become much less of an issue. Sure it's hard as hell to install and configure if you're new to Linux, but for a programmer, the AUR+yaourt and the versioning schemes make it a breeze to at least get something running (even if that means compiling it BSD ports style with AUR). And that wiki... Mmm it makes me happy

[u/boarhog]

I really hope one of these new proposals about distribution independent packaging gets worked and implemented

[u/[deleted]]

I think a big problem Linux has is with video drivers, especially with laptops and "hybrid graphics". Valve, which is focused on gaming, is helping to better these drivers. I really thino having better drivers will greatly helo Linux gain more traction (including programs for designing like photoshop). We habe pretty much everything but good video drivers.

[u/mostlypissed]

There will never be a "Linux Home PC" that the general public would accept, ever, because the time for that has already passed. The general public has since moved on to things other than computers now, and indeed the whole previous 'desktop paradigm' era of computing has become so uncool it may as well be from the last century - which it is anyway.

Oh well.

[u/lopedevega]

I think containerization approach (read Docker and LXC) would be a big game changer here. Because Gnome starts to experiment with using containers even to run GUI apps.

This apporach certainly has its own problems (namely, getting important updates for critical libraries such as OpenSSL for all containers), but at the same time it solves most of the problems Linus is talking about - "dependency hell" and differences in Linux distributions. Because everything you need to run containerizied apps is the kernel itself. You execute "docker run postgres" on a bare system, and you have a running PostgreSQL database - it's simple as that.

That's why some new distributions such as Ubuntu Core and CoreOS look promising - they replace deb/rpm entirely with containers, and I believe that's the future of Linux.

[u/[deleted]]

totally irrelevant comment:

With each year Linus looks more and more like Tux ...